CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- floooh sokolfloooh sokol sokol_gfx.h _sg_validate_pipeline_desc stack-based overflow4.8 Medium
- code-projects refugee food management systemcode-projects Refugee Food Management System home.php sql injection6.9 Medium
- carmelo simple stock systemcode-projects Simple Stock System logout.php sql injection6.9 Medium
- ragic enterprise cloud databaseRagic｜Enterprise Cloud Database - Hard-coded Cryptographic Key9.3 Critical
- ragic enterprise cloud databaseRagic｜Enterprise Cloud Database - Arbitrary File Read8.7 High
- tenda wh450, wh450 firmware +1 moreTenda WH450 SafeUrlFilter stack-based overflow9.3 Critical
- delta electronics dvp15mc11t, deltaww dvp15mc11t firmware +1 moreModbus/TCP Dos Vulnerability in DVP15MC11T4.0 Medium
- 1000mz chestnutcmsliweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted upload5.3 Medium
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request L7Port stack-based overflow6.9 Medium
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request L7Im stack-based overflow9.3 Critical
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request CheckTools stack-based overflow9.3 Critical
- couchcmsCouchCMS reCAPTCHA config.example.php hard-coded key6.3 Medium
- dedecmsDedeCMS freelist_main.php sql injection5.3 Medium
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreA Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra...8.8 High
- k7computing k7 ultimate securityAn issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE)...7.7 High
- schlix cmsSchlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript...6.1 Medium
- pluxmlAuthenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with...6.5 Medium
- oxygenz clipbucketClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or...9.8 Critical
- dotnetfoundation piranha cmsPiranha has stored cross-site scripting (XSS) vulnerability6.1 Medium
- dotnetfoundation piranha cmsPiranha has stored cross-site scripting (XSS) vulnerability6.1 Medium
- frappe, frappe erpnext +1 moreAn arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0...9.6 Critical
- umbraco cmsUmbraco CMS has an arbitrary file upload vulnerability10.0 Critical
- youlai youlai-bootyoulai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in...7.1 High
- youlai youlai-bootyoulai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in...7.5 High
- xiongmaitech xm530v200 x6-weq 8m firmwareAn issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624...7.5 High
- xiongmaitech xm530v200 x6-weq 8m firmwareAuthentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8...9.8 Critical
- publiccmsPublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.5.4 Medium
- lsc smart connect indoor ip camera firmwareLSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.8.8 High
- realtimelogic fuguhubA reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files...6.1 Medium
- clincapture captivate electronic data captureReflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an...6.1 Medium
- gtedge gt edge aiIncorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform...7.5 High
- gtedge gt edge aiIncorrect access control in the /api/v1/conversations/*/files API of GT Edge AI Platform before...7.5 High
- gtedge gt edge aiInsecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows...7.5 High
- keyfactor signserverAn error in the SignServer container startup logic was found in Keyfactor SignServer versions...4.7 Medium
- airc mynetMyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability...4.3 Medium
- airc mynetIframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before...9.6 Critical
- airc mynetMyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability...6.1 Medium
- airc mynetMyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability...6.1 Medium
- seacmsSeaCMS admin_video.php sql injection5.1 Medium
- seacmsSeaCMS mysqli.class.php sql injection6.9 Medium
- tormorten wp microdataWordPress WP Microdata plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- happydevs temptool [show current template info]WordPress TempTool [Show Current Template Info] plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- happydevs temptool [show current template info]WordPress TempTool [Show Current Template Info] plugin <= 1.3.1 - Sensitive Data Exposure vulnerability4.3 Medium
- tenda fh1201, fh1201 firmware +1 moreTenda FH1201 SetIpBind sprintf stack-based overflow8.7 High
- tenda fh1201, fh1206, fh1201 firmware +1 more +3 moreTenda FH1201/FH1206 HTTP Request webtypelibrary strcat stack-based overflow8.7 High
- themeisle redirection for contact form 7Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload8.1 High
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- tenda ac18, ac18 firmware +1 moreTenda AC18 HTTP Request SetDlnaCfg sprintf stack-based overflow8.7 High
- tenda ac18, ac18 firmware +1 moreTenda AC18 HTTP Request GetParentControlInfo strcpy stack-based overflow8.7 High
- campcodes complete online beauty parlor management systemCampcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting4.8 Medium
- Show moreLoading…