CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- zkteco biotimeZKTeco BioTime Endpoint safe_setting credentials storage6.9 Medium
- fantasticlbp hotels serverFantasticLBP Hotels_Server Room.php sql injection6.9 Medium
- jeecg bootJeecgBoot getPositionUserList improper authorization2.3 Low
- jeecg bootJeecgBoot queryDepartPermission improper authorization2.3 Low
- jeecg bootJeecgBoot list getParameterMap improper authorization2.3 Low
- jeecg bootJeecgBoot datarule improper authorization2.3 Low
- jeecg bootJeecgBoot datarule loadDatarule improper authorization2.3 Low
- jeecg bootJeecgBoot getDeptRoleByUserId information disclosure4.8 Medium
- jeecg bootJeecgBoot getDeptRoleList improper authorization2.3 Low
- jeecg bootJeecgBoot list queryPageList improper authorization2.3 Low
- macrozheng mallmacrozheng mall Member Endpoint update improper authorization5.3 Medium
- dromara sa-tokenDromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization2.3 Low
- opencartOpenCart Single-Use Coupon race condition6.3 Medium
- gnupgIn GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary...5.9 Medium
- jackq xcmsjackq XCMS Backend ProductImageController.class.php upload unrestricted upload5.1 Medium
- jackq xcmsjackq XCMS upload.php unrestricted upload6.9 Medium
- pandaxgo pandaxPandaXGO PandaX JWT Secret config.yml hard-coded key6.3 Medium
- actionsky sqleactiontech sqle JWT Secret jwt.go hard-coded key6.3 Medium
- getmaxun maxungetmaxun Authentication Endpoint auth.ts router.get improper authorization5.3 Medium
- getmaxun maxungetmaxun auth.ts hard-coded key6.3 Medium
- emqx nanomqNanoMQ has a Use After Free vulnerability via sub info list7.5 High
- eigent1-click Remote Code Execution (RCE) vulnerability in Eigent9.3 Critical
- b3log siyuanSiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret6.9 Medium
- xspeeder sxzosXspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python...10.0 Critical
- espressif esp-idfESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling6.1 Medium
- espressif esp-idfESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling0.0 None
- freshrssFreshRSS globally denies access to feed via proxy modifying to 429 Retry-After4.3 Medium
- freshrssFreshRSS has weak cryptographic randomness in remember-me token and nonce generation2.9 Low
- lemon8866 streamvaultStreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection10.0 Critical
fastmcpPyPIFastMCP updated to MCP 1.23+ due to CVE-2025-66416No score- n8nSelf-hosted n8n has Legacy Code node that enables arbitrary file read/write7.1 High
- n8nn8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node9.9 Critical
- internlm lmdeploylmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()8.8 High
- n8nn8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox7.3 High
- apidoc apidoc-coreapidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker9.3 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software.7.7 High
- ibm aspera faspex 5, aspera faspex +1 moreXSS in IBM Aspera Faspex5.4 Medium
- ibm aspera faspex 5, aspera faspex +1 moreExposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex3.1 Low
- ibm aspera faspex 5, aspera faspex +1 moreIncorrect Execution-Assigned Permissions in IBM Aspera Faspex3.8 Low
- ibm ds8900f ( r9.4), ds8a00 ( r10.0), ds8a00( r10.1) +2 more +4 moreMissing Authorization with the DS8900F and DS8A00 Hardware Management Console6.7 Medium
- ibm db2 intelligence centerClient-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center4.3 Medium
- ibm api connectAuthentication bypass in IBM API Connect9.8 Critical
- ibm concertIBM Concert Software Improper Restriction of Operations within the Bounds of a Memory Buffer.7.8 High
- ibm concertBM Concert Software Improper Clearing of Heap Memory Before Release.5.9 Medium
- eaton ups companion software, ups companion +1 moreDue to insecure library loading in the Eaton UPS Companion software executable, an attacker with...7.8 High
- eaton ups companion software, ups companion +1 moreImproper quotation in search paths in the Eaton UPS Companion software installer could lead to...6.7 Medium
- eaton ups companion software, ups companion +1 moreImproper authentication of library files in the Eaton UPS Companion software installer could lead...8.6 High
- delta electronics dvp-12se, deltaww dvp-12se firmware +1 moreDVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information7.2 High
- hanwha vision co., ltd. qnv-c8012, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreImproper Input Validation5.8 Medium
- hanwha vision co., ltd. device manager, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreHardcoding sensitive information6.3 Medium
- Show moreLoading…