CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- unknown advance wp query search filterAdvance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax6.1 Medium
- unknown advance wp query search filterAdvance WP Query Search Filter <= 1.0.10 - Reflected XSS via counter6.1 Medium
- dromara sa-tokenDromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization2.3 Low
- sohu cachecloudSohuTV CacheCloud AppDataMigrateController.java index cross site scripting5.1 Medium
- sohu cachecloudSohuTV CacheCloud LoginController.java init cross site scripting5.3 Medium
- sohu cachecloudSohuTV CacheCloud MachineManageController.java doPodList cross site scripting5.1 Medium
- tenda ac10u, ac10u firmware +1 moreTenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflow8.7 High
- tenda ac23, ac23 firmware +1 moreTenda AC23 HTTP POST Request formSetPPTPUserList buffer overflow8.7 High
- tenda ac23, ac23 firmware +1 moreTenda AC23 SetIpMacBind fromSetIpMacBind stack-based overflow8.7 High
- tenda ac10u, ac10u firmware +1 moreTenda AC10U HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow8.7 High
- campcodes park ticketing systemCampcodes Park Ticketing System admin_class.php save_pricing cross site scripting4.8 Medium
- naver whale browser, navercorp whale +1 moreWhale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar...7.5 High
- naver whale browser, navercorp whale +1 moreWhale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar...9.1 Critical
- code-projects student file management systemcode-projects Student File Management System File Download download.php improper authorization5.3 Medium
- coturnCoturn has unsafe nonce and relay port randomization due to weak random number generation.7.7 High
- code-projects refugee food management systemcode-projects Refugee Food Management System regfood.php sql injection5.3 Medium
- code-projects refugee food management systemcode-projects Refugee Food Management System refugee.php sql injection5.3 Medium
- jdcloud ax1800 firmware, ax3000 firmware, ax6600 firmware +3 more +5 moreJD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 ...9.8 Critical
- trueconfTrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local...7.1 High
- trueconf serverA CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to...7.3 High
- trueconf serverA Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the...8.7 High
- trueconf serverAn HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description...5.4 Medium
- inmusicbrands engine dj desktopinMusic Brands Engine DJ 4.3.0 suffers from Insecure Permissions due to exposed HTTP service in...7.5 High
- zeroheightAn issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API...6.5 Medium
- unrtf project unrtfA NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to...7.5 High
- gnu recutilsA divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to...7.5 High
- symphorien nixseparatedebuginfodnixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal.7.5 High
- pangolinAuthentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin...9.1 Critical
- jakub glos off page seoWordPress Off Page SEO plugin <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kemal yazici product pullerWordPress Product Puller plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sleekplanWordPress Sleekplan plugin <= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rakessh ads24 liteWordPress Ads24 Lite plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- code-projects refugee food management systemcode-projects Refugee Food Management System editrefugee.php sql injection5.3 Medium
- emraan cheema cubewpWordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability7.5 High
- wedevs wp project managerWordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability6.5 Medium
- wpdive better elementor addonsWordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability5.4 Medium
- codexthemes thegem (elementor), thegem (wpbakery) +1 moreWordPress TheGem theme < 5.8.1.1 - Broken Access Control vulnerability5.4 Medium
- crocoblock jettabsWordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability6.5 Medium
- crocoblock jettabsWordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- code-projects refugee food management systemcode-projects Refugee Food Management System editfood.php sql injection5.3 Medium
- qs project qsarrayLimit bypass in bracket notation allows DoS via memory exhaustion6.3 Medium
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval7.6 High
- code-projects refugee food management systemcode-projects Refugee Food Management System editrefugee.php sql injection6.9 Medium
- campcodes supplier management systemCampcodes Supplier Management System view_products.php sql injection6.9 Medium
- github.com/golang/vscode-go, go +1 moreUnexpected untrusted code execution in github.com/golang/vscode-go5.4 Medium
- campcodes supplier management systemCampcodes Supplier Management System add_area.php sql injection6.9 Medium
- crocoblock jetpopupWordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.7 - Broken Access Control vulnerability6.5 Medium
- crocoblock jetsearchWordPress JetSearch plugin <= 3.5.16 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- romancode mapsvgWordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability9.9 Critical
- Show moreLoading…