CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- smartwares home easySmartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages8.8 High
- carlo gavazzi ab smarthouse webappCarlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS5.1 Medium
- ave s.p.a. dominaplusAVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities5.1 Medium
- cube-js cube, teradek cube firmware +1 moreTeradek Cube 7.3.6 Cross-Site Request Forgery Password Change5.1 Medium
- teradek, llc slice, teradek slice firmware +1 moreTeradek Slice 7.3.15 Cross-Site Request Forgery via Password Change5.1 Medium
- the gnu project | free software foundation, inc. gnu barcodeGNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism8.5 High
- ecessa corporation edge ev150Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration5.1 Medium
- ecessa corporation wanworx wvr-30Ecessa WANWorx WVR-30 < 10.7.4 Cross-Site Request Forgery via User Configuration5.1 Medium
- ecessa corporation shieldlink sl175ehqEcessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration5.1 Medium
- microhard systems 3g/4g cellular ethernet and serial gateway csrf vulnerabilities, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface5.1 Medium
- microhard systems 3g/4g cellular ethernet and serial gateway remote root exploit, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface8.7 High
- microhard systems 3g/4g cellular ethernet and serial gateway default credentials, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass9.3 Critical
- microhard systems 3g/4g cellular ethernet and serial gateway service control dos, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Service Control Denial of Service7.1 High
- microhard systems 3g/4g cellular ethernet and serial gateway configuration download, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download7.1 High
- microhard systems 3g/4g cellular ethernet and serial gateway arbitrary file attacks, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor8.7 High
- microhard systems 3g/4g cellular ethernet and serial gateway backdoor jailbreak, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Backdoor Jailbreak via Microhard Sh Service8.7 High
- novarad corporation novapacs diagnostics viewerNovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection7.1 High
- flir thermal traffic camerasFLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated RTSP Stream Disclosure8.7 High
- flir systems, inc. thermal traffic camerasFLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation9.3 Critical
- flir systems ax8 thermal camera, flir ax8 firmware +1 moreFLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure8.7 High
- flir systems ax8 thermal camera, flir ax8 firmware +1 moreFLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass9.3 Critical
- flir systems, inc. brickstream 3d+FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure8.7 High
- flir systems, inc. brickstream 3d+FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure8.7 High
- anviz biometric technology co., ltd. aim crosschex standardAnviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import9.3 Critical
- synaccess networks inc. netbooter np-02x/np-08xSynaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass via webNewAcct.cgi9.3 Critical
- synaccess networks inc. netbooter np-0801duSynaccess netBooter NP-0801DU 7.4 Cross-Site Request Forgery via Admin Interface5.1 Medium
- leica geosystems ag gr10/gr25/gr30/gr50 gnssLeica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Stored XSS via Config Upload5.1 Medium
- beward r&d co., ltd intercomBeward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database6.8 Medium
- soca technology co., ltd access control systemSOCA Access Control System 180612 Information Disclosure via Multiple Endpoints7.1 High
- soca technology co., ltd access control systemSOCA Access Control System 180612 SQL Injection and Authentication Bypass9.3 Critical
- soca technology co., ltd access control systemSOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface5.1 Medium
- ibm concertIBM Concert Software Cleartext Storage in a File or on Disk.6.2 Medium
- eclipse foundation bluechiBluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies7.2 High
- linuxusb: potential integer overflow in usbg_make_tpg()No score
- johnson controls istar ultra g2, istar ultra g2 se, istar edge g2, istar ultra, istar ultra se +1 moreiSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings8.7 High
- johnson controls istar ultra g2, istar ultra g2 se, istar edge g2, istar ultra, istar ultra se +1 moreiSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo8.7 High
- echo call center services trade and industry inc. specto cmArbitrary File Upload in EchoCCS's Specto CM8.8 High
- echo call center services trade and industry inc. specto cmStored XSS in EchoCCS's Specto CM5.4 Medium
- wpxpo postxWordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability5.3 Medium
- pickplugins post grid and gutenberg blocksWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- marketing fire editorial calendarWordPress Editorial Calendar plugin <= 3.8.8 - Broken Access Control vulnerability5.4 Medium
- scott paterson accept donations with paypal & stripeWordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability4.7 Medium
- rustaurius five star restaurant reservationsWordPress Five Star Restaurant Reservations plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- yannick lefebvre link libraryWordPress Link Library plugin <= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- embeds for youtube plugin support youtube embedWordPress YouTube Embed plugin <= 5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- live composer team page builder: live composerWordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- blueglass interactive ag jobs for wordpressWordPress Jobs for WordPress plugin <= 2.8.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bit apps assistWordPress Bit Assist plugin <= 1.5.11 - Broken Access Control vulnerability5.3 Medium
- trustindex widgets for social photo feedWordPress Widgets for Social Photo Feed plugin <= 1.8 - Broken Access Control vulnerability5.3 Medium
- assaf parag poll, survey & quiz maker plugin by opinion stageWordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin <= 19.12.0 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…