CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- ruben garcia automatorwpWordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerability7.6 High
- eaton xcomfort eci, xcomfort ethernet communication interface +1 moreImproper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could...8.8 High
- thehappymonster happy addons for elementorHappy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS6.4 Medium
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes6.4 Medium
- kiboit phastpressPhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection9.8 Critical
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'4.3 Medium
- beaverbuilder beaver builder page builder – drag and drop website builderBeaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update8.1 High
- humhub calendarCalendar <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc'6.4 Medium
- leap13 premium addons for elementor – powerful elementor templates & widgets, premium addons for elementor +1 morePremium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'5.3 Medium
- angeljudesuarez student management systemitsourcecode Student Management System record.php sql injection6.9 Medium
- learningcircuit local deep research, local-deep-research +1 moreLocal Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service6.3 Medium
- objectcomputing openddsAn integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows...7.5 High
- eclipse cyclone data distribution serviceImproper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows...10.0 Critical
- eprosima fast ddseProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation,...10.0 Critical
- nooncarlett techstoreA reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0...6.1 Medium
- eprosima fast ddsAn integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS)...7.5 High
- home-assistantHome Assistant Core before is vulnerable to Directory Traversal4.0 Medium
- unrtf project unrtfA stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a...6.2 Medium
- puneethreddyhc event managementImproper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management...9.8 Critical
- cadmium-cms cadmium cmsCadmium CMS has a background arbitrary file upload vulnerability9.8 Critical
- netgear ex8000 firmwareNetgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the...9.8 Critical
- netgear ex8000 firmwareNetgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the...6.5 Medium
- linksys e5600 firmwarelinksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.9.8 Critical
- linksys e5600 firmwareLinksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via...9.8 Critical
- connectify speedifyA command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify...8.4 High
- ruoyiSQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute...10.0 Critical
- net-snmp, debian linux +1 moreNet-SNMP snmptrapd crash9.8 Critical
- librenmsLibreNMS Alert Rule API Cross-Site Scripting Vulnerability4.3 Medium
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset Vulnerability8.8 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write8.8 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery5.1 Medium
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References9.3 Critical
- thibaud-rohmer photoshowPhotoShow 3.0 Remote Code Execution via Exiftran Path Injection8.6 High
- projectsendProjectSend r1605 Remote Code Execution via File Extension Manipulation8.7 High
- mybbMyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities8.6 High
- mybb, mybb forums +1 moremyBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements5.1 Medium
- mybb, mybb forums +1 moremyBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management5.1 Medium
- mybb, mybb forums +1 moremyBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management5.1 Medium
- thedigicraft atom cms, thedigitalcraft atomcms +1 moreAtom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page9.3 Critical
- d-link dsl-124 wireless n300 adsl2+, dlink dsl-124 firmware +1 moreD-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request8.8 High
- zillya total securityZillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine Module8.5 High
- luiswang webtareasWebTareas 2.4 Unauthenticated SQL Injection via Session Cookie Parameter9.3 Critical
- luiswang webtareasWebTareas 2.4 Authenticated Remote Code Execution via File Upload8.7 High
- db elettronica telecomunicazioni spa screen sft dab 600/c, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config8.7 High
- db elettronica telecomunicazioni spa screen sft dab 600/c, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change9.3 Critical
- db elettronica telecomunicazioni spa screen sft dab 600/c, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase Account9.3 Critical
- db elettronica telecomunicazioni spa screen sft dab 600/c, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change9.3 Critical
- sound4 linkandshare transmitterSOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow9.3 Critical
- Show moreLoading…