CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- linuxf2fs: fix to do sanity check on summary info7.8 High
- linuxconfigfs: fix possible memory leak in configfs_create_dir()No score
- linuxacct: fix potential integer overflow in encode_comp_t()7.8 High
- linuxhfs: Fix OOB Write in hfs_asc2mac7.8 High
- linuxerofs: validate the extent length for uncompressed pclusters8.4 High
- linuxstaging: media: tegra-video: fix device_node use after free7.8 High
- linuxmisc: ocxl: fix possible refcount leak in afu_ioctl()No score
- linuxmedia: imx-jpeg: Disable useless interrupt to avoid kernel panic5.6 Medium
- linuxfs/ntfs3: Add null pointer check for inode operations7.1 High
- linuxfs/ntfs3: Validate index root when initialize NTFS security7.8 High
- linuxfs/ntfs3: Fix memory leak if ntfs_read_mft failed7.8 High
- jewel theme master addons for elementorWordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability6.5 Medium
- wpjobboardWordPress WPJobBoard plugin <= 5.9.0 - Unauth. Blind SQL Injection (SQLi) vulnerability8.6 High
- bob hostelWordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS)5.9 Medium
- bnayawpguy resotoWordPress Resoto theme <= 1.0.8 - Broken Access Control to Arbitrary Plugin Activation4.3 Medium
- deluxethemes userproWordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerability7.5 High
- wp shuffle subscribe to unlock liteWordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion vulnerability7.5 High
- thembay fanaWordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability7.5 High
- thembay zotaWordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability7.5 High
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerability4.3 Medium
- hasthemes wc builderWordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- modeltheme addons for wpbakery and elementorWordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pavothemes bookoryWordPress Bookory theme <= 2.2.7 - Local File Inclusion vulnerability7.5 High
- rhys wynne wp email captureWordPress WP Email Capture plugin <= 3.12.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wpfactory free shipping bar: amount left for free shipping for woocommerceWordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kodezen llc academy lmsWordPress Academy LMS plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pixelgrade category iconWordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- spiffy plugins calendarWordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability4.3 Medium
- wpstreamWordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability4.3 Medium
- wpstreamWordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability5.3 Medium
- berocket brands for woocommerceWordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability8.5 High
- essekia tablesomeWordPress Tablesome plugin <= 1.1.35.1 - Broken Access Control vulnerability5.4 Medium
- essekia tablesomeWordPress Tablesome plugin <= 1.1.35.1 - Sensitive Data Exposure vulnerability5.0 Medium
- boldthemes bold timeline liteWordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- creativeinteractivemedia real 3d flipbookWordPress Real 3D FlipBook plugin <= 4.11.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jegstudio gutenverse formWordPress Gutenverse Form plugin <= 2.3.1 - Broken Access Control vulnerability6.5 Medium
- jeff starr user submitted postsWordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability4.7 Medium
- braveWordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability5.3 Medium
- icc0rz h5pWordPress H5P plugin <= 1.16.1 - Broken Access Control vulnerability5.3 Medium
- bdthemes prime slider – addons for elementorWordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- brainstorm force astra widgetsWordPress Astra Widgets plugin <= 1.2.16 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- syed balkhi user feedbackWordPress User Feedback plugin <= 1.10.0 - SQL Injection vulnerability7.6 High
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.53 - Sensitive Data Exposure vulnerability5.3 Medium
- linuxASoC: mediatek: common: Fix refcount leak in parse_dai_link_infoNo score
- linuxf2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()7.8 High
- linuxbtrfs: fix race when deleting free space root from the dirty cow roots list7.8 High
- linuxnet: dsa: realtek: fix out-of-bounds access7.8 High
- linuxfs/ntfs3: Fix OOB read in indx_insert_into_buffer7.8 High
- linuxsoc: mediatek: mtk-svs: Enable the IRQ laterNo score
- linuxfirmware: arm_ffa: Check if ffa_driver remove is present before executingNo score
- Show moreLoading…