CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- mintlify, mintlify platform +1 moreThe Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject...6.4 Medium
- mediawikiAction API xslt option allows JavaScript execution by administrators who are not interface administrators0.0 None
- wikimedia foundation luasandbox, scribunto +1 moreLua segfault in unpack()1.7 Low
- mediawikimw.message(…).parse() doesn't output safe HTML, but it's being used as if it does0.0 None
- mediawikilist=allrevisions can be used to bypass Extension:Lockdown0.0 None
- wikimedia foundation cite, mediawiki +1 moreMagic word replacement in legacy parser allows using reserved data attributes through wikitext0.0 None
- mediawiki checkuserWrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"0.0 None
- mediawikiStored XSS through edit summaries in MW Core0.0 None
- eve-ngEVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal. The /api/export interface allows...7.6 High
- turms-im turmsTurms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in...6.5 Medium
- turms-im turmsTurms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in...6.0 Medium
- turms-im turmsTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial...7.5 High
- turms-im turmsTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation...5.3 Medium
- turms-im turmsCross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows...6.1 Medium
- takes tkfilesThe Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths...7.5 High
- gtedge gt edge aiAn issue in GT Edge AI Platform Versions before v2.0.10-dev allows attackers to execute arbitrary...9.8 Critical
- pali igmpproxyigmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service ...7.5 High
- https://github.com/mkj/dropbear/ dropbearDropbear: privilege escalation via unix domain socket forwardings5.4 Medium
- codeastro real estate management systemCodeAstro Real Estate Management System Administrator Endpoint userbuilderdelete.php sql injection5.1 Medium
- codeastro real estate management systemCodeAstro Real Estate Management System Administrator Endpoint useragentdelete.php sql injection5.1 Medium
- microsoft azure cosmos dbAzure Cosmos DB Spoofing Vulnerability8.3 High
- weblateWeblate has git config file overwrite vulnerability that leads to remote code execution9.1 Critical
- weblateWeblate has an arbitrary file read via symbolic links7.7 High
- elastic kibanaKibana Improper Authorization4.3 Medium
- elastic kibanaKibana Improper Authorization4.3 Medium
- elastic elasticsearchElasticsearch Allocation of Resources Without Limits or Throttling4.9 Medium
- elastic kibanaKibana Allocation of Resources Without Limits or Throttling6.5 Medium
- elastic kibanaKibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.1 Medium
- elastic kibanaKibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.2 High
- elastic elasticsearchElasticsearch Allocation of Resources Without Limits or Throttling6.5 Medium
- microsoft office out-of-box experienceOffice Out-of-Box Experience Spoofing Vulnerability8.2 High
- microsoft purviewMicrosoft Purview eDiscovery Remote Code Execution Vulnerability7.2 High
- microsoft partner centerMicrosoft Partner Center Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure container appsAzure Container Apps Remote Code Execution Vulnerability10.0 Critical
- microsoft azure cognitive service for language, azure language +1 moreCustom Question Answering Elevation of Privilege Vulnerability9.9 Critical
- microsoft edge chromium, edge for android +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability3.1 Low
- elastic filebeatFilebeat Improper Validation of Specified Index, Position, or Offset in Input6.5 Medium
- google cloud dialogflow cx messengerAuthentication Bypass in Dialogflow CX Messenger6.9 Medium
- elastic packetbeatPacketbeat Out-of-bounds Read6.5 Medium
- elastic packetbeatPacketbeat Improper Bounds Check6.5 Medium
- elastic packetbeatElasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments5.3 Medium
- streamaStreama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write8.7 High
- proxychains-ng project proxychains-ngrofl0r/proxychains-ng <= 4.17 Stack-based Buffer Overflow6.9 Medium
- rtl 433 project 433, merbanan rtl 433 +1 moremerbanan/rtl_433 <= 25.02 Stack-based Buffer Overflow6.9 Medium
- genymobile scrcpyGenymobile/scrcpy <= 3.3.3 Global Buffer Overflow6.9 Medium
- palantir com.palantir.codeassist2:code-assist-proxy, com.palantir.compute:compute-service +1 moreNetwork boundaries not respected in certain Foundry namespaces.7.5 High
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Missing TLS hostname verification in Socket appender6.3 Medium
- advantech webaccess/scada, webaccess\/scada +1 moreAdvantech WebAccess/SCADA Path Traversal5.3 Medium
- bullwall server intrusion protectionBullWall Server Intrusion Protection (SIP) initialization race condition7.7 High
- bullwall server intrusion protectionBullWall Server Intrusion Protection RDP MFA connection delay7.7 High
- Show moreLoading…