CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- websitebakerWebsiteBaker 2.13.3 Stored Cross-Site Scripting via Page Creation5.1 Medium
- innovastudio wysiwyg editorInnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulation9.3 Critical
- filezilla-project filezilla clientFileZilla Client 3.63.1 DLL Hijacking via Missing TextShaping.dll8.5 High
- ltb-project ldap tool box self service passwordLDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header8.6 High
- kimaiKimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking8.5 High
- altervista flatnuxFlatnux 2021-03.25 Authenticated File Upload Remote Code Execution8.7 High
- actfaxActFax 10.10 Unquoted Path Services Privilege Escalation Vulnerability8.5 High
- dotclearDotclear 2.25.3 Authenticated Remote Code Execution via File Upload8.7 High
- gauzy ever gauzyEver Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret9.3 Critical
- aspemailAspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission Vulnerability8.5 High
- cat03 lilac-reloadedLilac-Reloaded for Nagios 2.0.8 Remote Code Execution via Autodiscovery9.3 Critical
- oscinventory ocs inventory ngOCS Inventory NG 2.3.0.0 Unquoted Service Path Privilege Escalation8.5 High
- arcsoft photostudioArcsoft PhotoStudio 6.0.0.172 Unquoted Service Path Privilege Escalation8.5 High
- brainycpBrainyCP 1.0 Remote Code Execution via Authenticated Crontab Manipulation8.7 High
- fastapi-users project fastapi users, fastapi-users +1 moreFastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO5.9 Medium
- esri arcgis web appbuilder {developer edition)HTML injection issue in ArcGIS Web App Builder4.7 Medium
- carmelo simple stock systemcode-projects Simple Stock System update.php sql injection6.9 Medium
- quest coexistence manager for notesHTTP Request Smuggling in Quest Coexistence Manager for Notes6.3 Medium
- angeljudesuarez student management systemitsourcecode Student Management System candidates_report.php sql injection6.9 Medium
- fastadminFastAdmin Backend Controller Backend.php selectpage sql injection5.1 Medium
- 1541492390c yougou-mall1541492390c yougou-mall ResourceController.java delete path traversal5.1 Medium
- totolink t10, t10 firmware +1 moreTOTOLINK T10 cstecgi.cgi sprintf stack-based overflow9.3 Critical
- carmelo simple stock systemcode-projects Simple Stock System chatuser.php cross site scripting5.3 Medium
- code-projects simple blood donor management systemcode-projects Simple Blood Donor Management System editedcampaign.php sql injection6.9 Medium
- code-projects simple blood donor management systemcode-projects Simple Blood Donor Management System editeddonor.php sql injection6.9 Medium
- carmelo simple stock systemcode-projects Simple Stock System signup.php sql injection6.9 Medium
- floooh sokolfloooh sokol sokol_gfx.h _sg_pipeline_common_init heap-based overflow4.8 Medium
- cvat-ai cvat, cvat computer vision annotation tool +1 moreCVAT vulnerable to directory traversal via mounted share listing5.3 Medium
- langflowLangflow Vulnerable to External Control of File Name or Path7.1 High
- webassembly binaryenWebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference4.8 Medium
- langflowLangflow vulnerable to Server-Side Request Forgery7.7 High
- boscop orejimeOrejime has executable code in HTML attributes0.6 Low
- the browser company of new york arcsearchAddress bar spoofing risk in ArcSearch on Android7.4 High
- the browser company of new york arcsearchAddress bar spoofing risk in Arc Search on iOS7.5 High
- openagentplatform diveDive has Cross-Site Scripting vulnerability that can escalate to Remote Code Execution9.7 Critical
- pluginsglpi databaseinventoryGLPI Database Inventory Plugin Vulnerable to Stored Object Injection6.4 Medium
- palantir com.palantir.acme.gaia:gaiaGaia unauthenticated endpoints6.8 Medium
- palantir com.palantir.gotham:gluttonGlutton V1 endpoints missing authentication9.1 Critical
- webassembly binaryenWebAssembly Binaryen wasm-binary.cpp readExport heap-based overflow4.8 Medium
- open5gsOpen5GS PFCP handler.c ogs_pfcp_handle_create_pdr initialization6.3 Medium
- galetteGalette has a privilege escalation vulnerability4.9 Medium
- galetteGalette has groups managers access control bypass on Members2.1 Low
- open5gsOpen5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertion6.3 Medium
- open5gsOpen5GS FAR-ID handler.c ogs_pfcp_handle_create_pdr null pointer dereference2.3 Low
- world wide broadcast network avideoAVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt9.3 Critical
- galetteGalette has access control bypass1.3 Low
- campcodes supplier management systemCampcodes Supplier Management System add_category.php sql injection6.9 Medium
- code-projects scholars tracking systemcode-projects Scholars Tracking System home.php sql injection6.9 Medium
- code-projects scholars tracking systemcode-projects Scholars Tracking System delete_post.php sql injection6.9 Medium
- red hat libnbd, enterprise linux 10, enterprise linux 8 +2 more +4 moreLibnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri4.8 Medium
- Show moreLoading…