CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- pretixInsecure direct object reference3.8 Low
- pretix pretix-offlinesalesInsecure direct object reference3.8 Low
- restajet online food delivery systemImproper Authentication in Restajet's Online Food Delivery System9.1 Critical
- restajet online food delivery systemCSRF in Restajet's Online Food Delivery System7.1 High
- restajet online food delivery systemOpen Redirect in Restajet's Online Food Delivery System5.4 Medium
- mongodb, mongodb and mongodb server, mongodb inc. server +1 more +3 moreZlib compressed protocol header length confusion may allow memory read8.7 High
- wp chill image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management5.4 Medium
- saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycredmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure4.3 Medium
- apache nifiApache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor7.5 High
- extend themes colibri page builderColibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- veronalabs slimstat analyticsSlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- foxit pdf editor cloud, foxit software inc. pdfonline.foxit.com +1 moreFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field6.3 Medium
- foxit software inc. pdfonline.foxit.com, foxit pdf editor cloud +1 moreFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Trusted Certificates Feature6.3 Medium
- foxit pdf editor cloud, foxit software inc. pdfonline.foxit.com +1 moreFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG Handling6.3 Medium
- foxit software inc. pdfonline.foxit.com, foxit pdf editor cloud +1 moreFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import Functionality6.3 Medium
- foxit software inc. pdfonline.foxit.com, foxit pdf editor cloud +1 moreFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates Feature6.3 Medium
- foxit software inc. pdfonline.foxit.com, foxit pdf editor cloud +1 moreFoxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text Feature6.3 Medium
- foxit software inc. webplugins.foxit.com, foxit pdf editor cloud +1 moreFoxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage Vulnerability6.3 Medium
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader PDF Parsing Heap-Based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader 3D Annotation Out-of-Bounds Memory Access Vulnerability5.3 Medium
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader 3D Annotation Out-of-Bounds Memory Access Vulnerability5.3 Medium
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader 3D Annotation Out-of-Bounds Memory Access Vulnerability5.3 Medium
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability7.8 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability7.8 High
- m-files corporation serverSession Token Disclosure in M-Files Web8.6 High
- bplugins html5 audio player – the ultimate no-code podcast, mp3 & audio playerHTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery7.2 High
- bookingalgorithms ba book everythingBA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode6.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- hikvision ds-7104hghi-f1, ds-7104hghi-f1 firmware, ds-7204hghi-f1 +1 more +3 moreThere is an improper authentication vulnerability in some Hikvision DVR products. Due to the...6.5 Medium
- hikvision ds-7104hghi-f1, ds-7104hghi-f1 firmware, ds-7204hghi-f1 +1 more +3 moreThere is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper...6.2 Medium
- m-files serverUnintended temporary cached data included in a structure only copy intended to be empty of data5.6 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: unbounded allocation in virtio-crypto5.5 Medium
- unknown ocean modal windowOcean Modal Window < 2.3.3 - Editor+ Remote Code Execution via Modal Conditions7.2 High
fastapi-ssoPyPIFastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation6.9 Medium- code-projects scholars tracking systemcode-projects Scholars Tracking System delete_user.php sql injection6.9 Medium
- anisha online appointment booking systemcode-projects Online Appointment Booking System deletemanager.php sql injection5.1 Medium
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability8.8 High
- linksys e9450-sg firmware, e9450-sg +1 moreBypass Authentication8.8 High
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC FTP Daemon Service handle_retr path traversal5.3 Medium
- jeecg bootJeecgBoot SysUserOnlineController.java SysUserOnlineController user session5.3 Medium
- jeecg bootJeecgBoot Multi-Tenant Management SysTenantController.java improper authentication5.3 Medium
- mitsubishi electric corporation genesis64, iconics suite, mc works64 +1 more +3 moreMalicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works648.2 High
- codeastro real estate management systemCodeAstro Real Estate Management System Administrator Endpoint userdelete.php sql injection5.1 Medium
- codeastro real estate management systemCodeAstro Real Estate Management System Administrator Endpoint stateadd.php sql injection5.1 Medium
- watchguard firebox, fireware, fireware os +2 moreWatchGuard Firebox iked Out of Bounds Write Vulnerability9.3 Critical
- mintlify, mintlify platform +1 moreThe Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to...4.9 Medium
- mintlify, mintlify platform +1 moreA Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform...6.4 Medium
- mintlify, mintlify platform +1 moreThe GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to...5.0 Medium
- mintlify, mintlify platform +1 moreA Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify...8.3 High
- Show moreLoading…