CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- hugging face diffusersHugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face smolagentsHugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability10.0 Critical
- hugging face transformersHugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- hugging face transformersHugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request Natlimit stack-based overflow9.3 Critical
- tenda wh450, wh450 firmware +1 moreTenda WH450 NatStaticSetting stack-based overflow9.3 Critical
- langchain langchain.js, langchain\/core, langchain-ai langchainjs +2 moreLangChain serialization injection vulnerability enables secret extraction8.6 High
- cszcms csz cmsCSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard5.1 Medium
- cmsimpleCMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding5.1 Medium
- orangescrumOrangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints5.1 Medium
- redmine pmbPMB 7.4.6 SQL Injection Vulnerability via Unsanitized id Parameter9.3 Critical
- epic games easy anti-cheatEpic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service Path8.5 High
- cszcms csz cmsCSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging5.1 Medium
- cmsimple-xh cmsimple xhCMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing8.6 High
- cmsimpleCMSimple 5.4 Authenticated Remote Code Execution via Template Editing8.6 High
- cmsimpleCMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution8.6 High
- cmsimpleCMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input5.1 Medium
- axesstmc zucchetti axess cloki access controlZucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery5.1 Medium
- orangescrumOrangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation8.7 High
- orangescrumOrangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters8.7 High
- jnunemaker httpartyhttparty Has Potential SSRF Vulnerability That Leads to API Key Leakage7.8 High
- langchain-ai langchain, langchain core +1 moreLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs9.3 Critical
- nvidia isaac launchableNVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded...9.8 Critical
- nvidia isaac launchableNVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with...9.8 Critical
- nvidia isaac launchableNVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with...9.8 Critical
- freyrscada iec-60870-5-104FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service...7.5 High
- linuxcan: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header5.2 Medium
- linuxcan: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data4.3 Medium
- linuxveth: reduce XDP no_direct return section to fix race9.8 Critical
- linux, linux kernel +1 moreteam: Move team device type change at the end of team_port_add7.8 High
- linuxatm/fore200e: Fix possible data race in fore200e_open()No score
- linuxnet: dsa: microchip: Don't free uninitialized ksz_irqNo score
- hotech software inc. otelloStored XSS in Hotech's Otello7.3 High
- ideabox creations powerpack pro for elementorWordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability7.5 High
- tyche softwares product delivery date for woocommerce – liteWordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.0 - Broken Access Control vulnerability5.3 Medium
- thembay nikaWordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability7.5 High
- thembay dizaWordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability7.5 High
- webcodingplace responsive posts carousel proWordPress Responsive Posts Carousel Pro plugin <= 15.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- villatheme wpbulkyWordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability7.6 High
- vikas ratudi vpsuformWordPress VPSUForm plugin <= 3.2.24 - Sensitive Data Exposure vulnerability6.5 Medium
- villatheme happyWordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability5.3 Medium
- vikas ratudi chakra testWordPress Chakra test plugin <= 1.0.1 - Broken Access Control vulnerability4.3 Medium
- codexthemes thegem theme elements (for elementor)WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codexthemes thegem theme elements (for elementor)WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…