CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- hiroaki miyashita custom field templateWordPress Custom Field Template plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mobile builder builderWordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability9.8 Critical
- code-projects student file management systemcode-projects Student File Management System download.php sql injection5.3 Medium
- olell uuruIn µURU, a Specially Crafted Federation Name Allows Dialplan Injection6.3 Medium
- sohu cachecloudSohuTV CacheCloud QuartzManageController.java doQuartzList cross site scripting4.8 Medium
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via operator.methodcaller Detection Bypass7.6 High
- sohu cachecloudSohuTV CacheCloud ResourceController.java index cross site scripting4.8 Medium
- sohu cachecloudSohuTV CacheCloud TaskController.java taskQueueList cross site scripting4.8 Medium
- tp-link systems inc. tl-wr820n v2.8, tp-link tl-wr820n firmware +1 moreWeak Algorithm Support in SSH Server on TL-WR820N6.0 Medium
- arthurfiorette axios-cache-interceptor, axios-cache-interceptor axios cache interceptor +1 moreaxios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header6.0 Medium
- struktur libheiflibheif has Potential Heap Buffer Over-Read6.5 Medium
- rapid7 velociraptorRapid7 Velociraptor Directory Traversal Vulnerability6.8 Medium
- sohu cachecloudSohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting5.1 Medium
- sohu cachecloudSohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting4.8 Medium
- monetizemore advanced ads – ad manager & adsenseAdvanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode7.2 High
- pixelyoursite – your smart pixel (tag) & api managerPixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File5.3 Medium
- code-projects college notes uploading systemcode-projects College Notes Uploading System userprofile.php unrestricted upload5.3 Medium
- code-projects college notes uploading systemcode-projects College Notes Uploading System login.php sql injection6.9 Medium
- com.ritense.valtimo webPriority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')4.8 Medium
- plugin optimizer optimizer, pluginoptimizer plugin optimizer +1 moreWordPress Plugin Optimizer plugin <= 1.3.7 - Broken Access Control vulnerability7.1 High
- com.ritense.valtimo webPriority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')4.8 Medium
- com.ritense.valtimo webPriority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')4.8 Medium
- com.ritense.valtimo webPriority - CWE-434 Unrestricted Upload of File with Dangerous Type8.8 High
- com.ritense.valtimo webPriority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')6.1 Medium
- anirbandutta news-buzz, anirbandutta9 content management system +1 morecode-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload5.1 Medium
- code-projects assessment managementcode-projects Assessment Management login.php sql injection6.9 Medium
- meshtastic firmwareMeshtastic firmware allows forged DMs with no PKC to show up as encrypted5.3 Medium
- codeaffairs wp text slider widgetWordPress Wp Text Slider Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- redim gmbh cookiehint wpWordPress CookieHint WP plugin <= 1.0.0 - Local File Inclusion vulnerability7.5 High
- invelity sps connectWordPress Invelity SPS connect plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cedcommerce integration for good marketWordPress CedCommerce Integration for Good Market plugin <= 1.0.6 - Local File Inclusion vulnerability7.5 High
- code-projects assessment managementcode-projects Assessment Management add-module.php sql injection6.9 Medium
- nestjs nestNest has a Fastify URL Encoding Middleware Bypass (TOCTOU)6.9 Medium
- prasadkirpekar advanced custom cssWordPress Advanced Custom CSS plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- councilsoft content grid sliderWordPress Content Grid Slider plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hetworks wordpress image shrinkerWordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- mohammad i. okfie if as shortcodeWordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability9.9 Critical
- hemmelig, hemmeligorg hemmelig.app +1 moreHemmelig has SSRF Filter bypass in Secret Request functionality4.3 Medium
- quenary tugtainerTugtainer has RCE in Agent Command Execution Api8.1 High
- d-link dir-600, dlink dir-600 firmware +1 moreD-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow9.3 Critical
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran7.6 High
- mmaitre314 picklescanPickleScan - Unsafe Globals Check Bypass via pty.spawn Function8.7 High
- phpmyfaqphpMyFAQ has unauthenticated config backup download via /api/setup/backup7.5 High
picklescanPyPIPicklescan missing detection when calling pty.spawn8.9 High- mmaitre314 picklescanpicklescan - Remote Code Execution via Incomplete Disallowed Inputs9.3 Critical
- mmaitre314 picklescanpicklescan - Remote Code Execution via Unblocked ctypes Module9.3 Critical
- mmaitre314 picklescanpicklescan - Arbitrary File Writing via distutils Module Bypass9.3 Critical
- phpmyfaqphpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw5.4 Medium
- elated-themes frappeFrappe may be vulnerable remote code execution due to server-side template injection9.1 Critical
- Show moreLoading…