CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- linuxmedia: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()No score
- linuxf2fs: fix to check readonly condition correctly7.1 High
- linuxbpf: Fix issue in verifying allow_ptr_leaks4.6 Medium
- linuxbtrfs: handle case when repair happens with dev-replaceNo score
- linuxof: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()No score
- linuxquota: fix warning in dqgrab()No score
- linuxi2c: xiic: xiic_xfer(): Fix runtime PM leak on error pathNo score
- linuxtracing: Fix memory leak of iter->temp when reading trace_pipeNo score
- linuxRDMA/mlx4: Prevent shift wrapping in set_user_sq_size()7.8 High
- linuxm68k: mm: Move initrd phys_to_virt handling after paging_init()No score
- linuxBluetooth: ISO: fix iso_conn related locking and validity issues8.0 High
- linuxscsi: lpfc: Fix memory leak in lpfc_create_port()No score
- linuxipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection()6.8 Medium
- linuxSUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails8.7 High
- linuxscsi: pm8001: Fix running_req for internal abort commandsNo score
- linuxext2: Add sanity checks for group and filesystem size7.1 High
- linuxcrypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr4.8 Medium
- linuxdrivers: mcb: fix resource leak in mcb_probe()No score
- linuxsecurity: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6No score
- linuxrapidio: devices: fix missing put_device in mport_cdev_openNo score
- linuxksmbd: fix possible memory leak in smb2_lock()8.8 High
- linuxmedia: s5p-mfc: Clear workbit to handle error conditionNo score
- linuxfsi: occ: Prevent use after free7.8 High
- gmg137 snap7-rsgmg137 snap7-rs client.rs download heap-based overflow6.9 Medium
- asfhtgkdavid theshittheshit vulnerable to unsafe loading of user-owned Python rules when running as root.6.7 Medium
- aizuda snail-jobaizuda snail-job API FurySerializer.deserialize deserialization5.3 Medium
- villatheme lucky wheel for woocommerce – spin a saleLucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags7.2 High
- d-link dcs-850l, dlink dcs-850l firmware +1 moreD-Link DCS-850L Firmware Update Service uploadfirmware path traversal5.1 Medium
- wpdesk shopmagicWordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability5.3 Medium
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kraft plugins demo importer plusWordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerability4.3 Medium
- autolistings auto listingsWordPress Auto Listings plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vidish combo offers woocommerceWordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mikado-themes lekkerWordPress Lekker theme <= 1.8 - Local File Inclusion vulnerability8.1 High
- a wp life blog filterWordPress Blog Filter plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mikado-themes fivestarWordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- getarcaneapp arcaneWordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability5.3 Medium
- mikado-themes backpack travelerWordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- select-themes strukturWordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- boldgrid weformsWordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability5.3 Medium
- tychesoftwares product delivery date for woocommerce – liteWordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerability5.3 Medium
- roxnor popupkitWordPress PopupKit plugin <= 2.1.5 - Sensitive Data Exposure vulnerability4.3 Medium
- aethonic popticsWordPress Poptics plugin <= 1.0.20 - Sensitive Data Exposure vulnerability4.3 Medium
- bizswoop bizprintWordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerability6.5 Medium
- marketing fire discussion boardWordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability4.3 Medium
- weblizar - wordpress themes & plugin hr management liteWordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability5.4 Medium
- ays pro popup boxWordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- flippingbookWordPress FlippingBook plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shamalli web directory freeWordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…