CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
bitmapscrates.io`Bitmap::try_from(&[u8])` can create invalid valuesNo score- angeljudesuarez student management systemitsourcecode Student Management System list_report.php sql injection6.9 Medium
- angeljudesuarez student management systemitsourcecode Student Management System form137.php sql injection6.9 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 public path traversal6.9 Medium
- angeljudesuarez student management systemitsourcecode Student Management System student_p.php sql injection6.9 Medium
- itsourcecode online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System customer_details.php sql injection6.9 Medium
tarantoolOSS-FuzzHeap-buffer-overflow in mmcallNo scorequickjsOSS-FuzzStack-buffer-overflow in lre_execNo score- pexip infinityPexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media...7.5 High
- pexip infinityPexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a...7.5 High
- pexip infinityPexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP...5.9 Medium
- pexip infinityPexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product...7.5 High
- pexip infinityPexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler...8.2 High
- pexip infinityPexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join)...5.9 Medium
- pexip infinityPexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that...7.5 High
- pexip infinityPexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that...7.5 High
- pexip infinityPexip Infinity before 37.0 has improper input validation in signalling that allows a remote...7.5 High
- openopsOpenOps before 0.6.11 allows remote code execution in the Terraform block.7.4 High
- itsourcecode online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System contact_us.php sql injection6.9 Medium
- kermitproject c-kermitC-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote...8.9 High
- fujitsu / fsas technologies eternus sf acm/sc/expressFujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8...5.6 Medium
- onlyoffice document serverONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is...6.4 Medium
- megasys computer technologies telenium online web applicationMegaSys Computer Technologies Telenium Online Web Application Improper Input Validation9.3 Critical
- mitsubishi electric europe smartrtuMitsubishi Electric Europe smartRTU Missing Authentication for Critical Function8.7 High
- riello netman, riello-ups netman 208 +1 moreRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory...9.1 Critical
- riello netman, riello-ups netman 208 +1 moreRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted...5.5 Medium
- riello netman, riello-ups netman 208 +1 moreRiello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection....6.5 Medium
- logicaldoc, logicaldoc srl enterprise +1 moreLogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities7.1 High
- logicaldoc srl enterpriseLogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation8.7 High
- videoflow ltd. digital video protection dvpVideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal7.1 High
- videoflow ltd. digital video protection dvpVideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution8.7 High
- kyocera net adminKYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration5.1 Medium
- kyocera net adminKYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection7.1 High
- teradek vidiu pro, vidiu firmware, vidiu mini firmware +1 more +3 moreTeradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change5.1 Medium
- teradek, llc vidiu pro, teradek vidiu firmware, vidiu mini firmware +1 more +3 moreTeradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings6.9 Medium
- devolo ag dlan 550 duo+ starter kitDevolo dLAN 500 AV Wireless+ 3.1.0-1 Cross-Site Request Forgery5.1 Medium
- devolo ag dlan 550 duo+ starter kitdevolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr8.7 High
- beward n100 h.264 vga ip cameraBeward N100 M2.1.6 Unauthenticated RTSP Video Stream Disclosure8.7 High
- beward n100 h.264 vga ip cameraBeward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability5.1 Medium
- beward n100 h.264 vga ip cameraBeward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure7.1 High
- ross video ltd. dashboardRoss Video DashBoard 8.5.1 Privilege Escalation via Insecure Permissions8.5 High
- bticino s.p.a. legrand bticino driver manager f454Legrand BTicino Driver Manager F454 1.0.51 CSRF and Stored XSS Vulnerabilities5.1 Medium
- iwt facesentry access control system firmware, iwt ltd. facesentry access control system +1 moreFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test8.7 High
- iwt ltd. facesentry access control system, iwt facesentry access control system firmware +1 moreFaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface5.1 Medium
- iwt ltd. facesentry access control system, iwt facesentry access control system firmware +1 moreFaceSentry Access Control System 6.4.8 Remote SSH Root Access9.8 Critical
- rifatron co., ltd. dvrRifatron 5brid DVR 5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504) Unauthenticated Live Stream Disclosure via animate.cgi8.7 High
- guangzhou v-solution electronic technology gpon/epon olt platformV-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download8.7 High
- guangzhou v-solution electronic technology co., ltd. sol gpon/epon olt platformV-SOL GPON/EPON OLT Platform 2.03 Cross-Site Request Forgery Vulnerability5.1 Medium
- guangzhou v-solution electronic technology co., ltd. sol gpon/epon olt platformV-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter8.7 High
- iseeq hybrid dvr wh-h4iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure8.7 High
- Show moreLoading…