CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- linuxregulator: core: Protect regulator_supply_alias_list with regulator_list_mutex7.8 High
- linuxnet: vxlan: prevent NULL deref in vxlan_xmit_one5.7 Medium
- linuxspi: ch341: fix out-of-bounds memory access in ch341_transfer_one7.8 High
- linux, linux kernel +1 moreexfat: fix refcount leak in exfat_find5.5 Medium
- linuxexfat: fix divide-by-zero in exfat_allocate_bitmapNo score
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreNFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid7.5 High
- linuxblock: fix memory leak in __blkdev_issue_zero_pagesNo score
- linuxALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events7.8 High
- linuxALSA: dice: fix buffer overflow in detect_stream_formats()7.0 High
- linuxALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()5.5 Medium
- linuxALSA: wavefront: Fix integer overflow in sample size validation6.8 Medium
- mattermost, mattermost server +1 moreMattermost Jira plugin crafted action leaks Jira issue details4.1 Medium
- mattermost, mattermost server +1 moreUnauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3 Medium
- honor magic osPrivilege Bypass in ADB2.2 Low
- gravity forms forms, unknown gravity forms +1 moreGravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload6.8 Medium
- hitachi infrastructure analytics advisor, ops center analyzer +1 moreCross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer8.2 High
- hitachi infrastructure analytics advisor, ops center analyzer +1 moreAuthorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer7.1 High
- tychesoftwares print invoice & delivery notes for woocommercePrint Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution9.8 Critical
- code-projects student information systemcode-projects Student Information System searchresults.php sql injection6.9 Medium
- code-projects student information systemcode-projects Student Information System profile.php cross site scripting5.1 Medium
- code-projects student file management systemcode-projects Student File Management System save_file.php unrestricted upload5.3 Medium
quickjsOSS-FuzzUse-of-uninitialized-value in js_create_functionNo score- returnfi blitzAn open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to...6.1 Medium
- jcthiele openxrechnungtoolboxOpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow...5.0 Medium
- airc mynetA reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to...6.1 Medium
- airc mynetMyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability...6.5 Medium
- airc mynetMyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability...6.1 Medium
- anisha online farm systemcode-projects Online Farm System addProduct.php sql injection6.9 Medium
- 5ire5ire vulnerable to Remote Code Execution (RCE) via mermaid9.7 Critical
- continuwuityConduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue9.9 Critical
- fluidsynthUse after free in fluidsynth7.0 High
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request CheckTools command injection6.9 Medium
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path9.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename9.4 Critical
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request PPTPDClient stack-based overflow9.3 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename9.4 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import9.4 Critical
- senstar symphonySenstar Symphony FetchStoredLicense Information Disclosure Vulnerability7.5 High
- dreamfactoryDreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability7.2 High
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup10.0 Critical
- msp360 free backupMSP360 Free Backup Link Following Local Privilege Escalation Vulnerability7.3 High
- deciso opnsenseDeciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability4.5 Medium
- tencent facedetection-dsfdTencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent tfaceTencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent tfaceTencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent patrickstarTencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent neuralnlp-neuralclassifierTencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent mimicmotionTencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent medicalnetTencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- tencent hunyuanvideoTencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- Show moreLoading…