CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- hanwha vision co., ltd. qnv-c8012, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreImproper Input Validation5.2 Medium
- giteaGitea vulnerable to Cross-site Scripting5.4 Medium
- hanwha vision co., ltd. qnv-c8012, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreInadequate account permissions management6.3 Medium
- hanwha vision co., ltd. qnv-c8012, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreInsufficient certificate validation6.3 Medium
- simsimstudioai sim CRON Secret internal.ts improper authentication6.9 Medium
- giteaGitea: anonymous user can visit private user's project5.8 Medium
- giteaGitea sometimes mishandles propagation of token scope for access control within one of its own package registries5.0 Medium
- giteaGitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order5.3 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery5.3 Medium
- giteaGitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text5.4 Medium
- alteryx serverAlteryx Server status improper authentication6.9 Medium
- giteaGitea mishandles access to a private resource upon receiving an API token with scope limited to public resources4.9 Medium
- giteaGitea doesn't adequately enforce branch deletion permissions after merging a pull request.3.1 Low
- giteaGitea allows attackers to add attachments with forbidden file extensions8.2 High
- postmanlabs httpbinpostmanlabs httpbin core.py cross site scripting5.1 Medium
- sunkaifei flycmssunkaifei FlyCMS User Login UserController.java userLogin cross site scripting5.3 Medium
- giteaGitea mishandles authorization for deletion of releases4.3 Medium
- sunkaifei flycmssunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting5.3 Medium
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W ConfigExceptMSN strcpy buffer overflow8.7 High
- fluentcmsA cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as...6.1 Medium
- comtech cdm-625 firmware, cdm-625a firmware +1 moreIncorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with...7.5 High
- axing dev7113 firmwareIncorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32...7.5 High
- etlsystems c0401d1uia-22476 firmware, c0401d1ula-22419 firmware, c0401d1ula-22456 firmware +24 more +26 moreThe web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution...6.5 Medium
- krishanmurariji student management systemSQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class...6.5 Medium
- yealink sip-t21\(p\)e2 firmwareAn issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to...8.8 High
- yealink sip-t21\(p\)e2 firmwareYealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged...4.3 Medium
- symwld delight custom firmwareAn issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on...5.1 Medium
- abelche cola dnslogCola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is...7.5 High
- libxmljs project libxmljslibxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)7.5 High
- magicbug cloudlogTime-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php...9.8 Critical
- croogoCroogo CMS has a path traversal vulnerability6.5 Medium
- terrainformatica sciterAn issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain...5.5 Medium
- forgejoForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server...9.5 Critical
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formPictureUrl strcpy buffer overflow8.7 High
- wpshuffle frontend post submission manager lite – frontend posting wordpress pluginFrontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion5.3 Medium
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formConfigNoticeConfig strcpy buffer overflow8.7 High
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W APSecurity strcpy buffer overflow8.7 High
- ketr jepaasketr JEPaaS loadPostil postilService.loadPostils sql injection5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall OrderController.java submitOrderPayment improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall MemberController.java getMemberByMobile access control5.3 Medium
- onlyoffice document serverONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.6.4 Medium
- onlyoffice document serverONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings...6.4 Medium
- youlai youlai-mallyoulaitech youlai-mall Balance MemberController.java deductBalance improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control2.3 Low
- tozed zlt m30s, gztozed zlt m30s firmware +1 moreTOZED ZLT M30s UART on-chip debug and test interface with improper access control1.0 Low
- tozed zlt m30s, gztozed zlt m30s firmware +1 moreTOZED ZLT M30s Web Management proc_post information disclosure6.9 Medium
- jd cloud be6500JD Cloud BE6500 jdcapi sub_4780 command injection5.3 Medium
- verisay communication and information technology industry and trade ltd. co. aidangoXSS in Verisay Communication's Aidango7.6 High
- verisay communication and information technology industry and trade ltd. co. trizbiXSS in Verisay Communication's Trizbi7.6 High
- verisay communication and information technology industry and trade ltd. co. titarusXSS in Verisay Communication's Titarus7.6 High
- Show moreLoading…