CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- minidvblinuxMiniDVBLinux 5.4 Remote Root Command Execution via commands.sh9.3 Critical
- madrasthemes mas videosWordPress MAS Videos plugin <= 1.3.4 - Local File Inclusion vulnerability7.5 High
- newbee-ltd newbee-mall-plusnewbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload5.1 Medium
- d-link di-7400g+, dlink di-7400g\+ firmware +1 moreD-Link DI-7400G+ msp_info.htm command injection5.3 Medium
- tenda ac20, ac20 firmware +1 moreTenda AC20 PowerSaveSet sscanf buffer overflow8.7 High
- temporalExecuteMultiOperation Namespace Policy Bypass1.3 Low
- temporalCross Namespace Commands Authorization Bypass5.3 Medium
- angeljudesuarez society management systemitsourcecode Society Management System add_admin.php sql injection6.9 Medium
- linuxfoundation wasmedgeWasmEdge integer wrap in MemoryInstance::getSpan()'s memory size check5.5 Medium
yourls/yourlsPackagistYOURLS is vulnerable to XSS through JSONP and Callback request parameters7.1 High- angeljudesuarez society management systemitsourcecode Society Management System edit_admin_query.php edit_admin_query sql injection6.9 Medium
psitransfernpmPsiTransfer has Zip Slip Path Traversal via TAR Archive Download8.1 High- facturascriptsFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload1.2 Low
- serverlessserverless MCP Server vulnerable to command injection in list-projects tool7.5 High
- feehi feehicmsFeehiCMS TimThumb timthumb.php server-side request forgery6.9 Medium
- biggidroid simple php cmsBiggiDroid Simple PHP CMS Admin Login login.php sql injection6.9 Medium
- biggidroid simple php cmsBiggiDroid Simple PHP CMS Site Logo edit.php unrestricted upload5.1 Medium
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC Web-based Configuration formALGSetup redirect5.1 Medium
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC Web-based Configuration formRoute command injection6.9 Medium
- rustfsRustFS has a gRPC Hardcoded Token Authentication Bypass9.8 Critical
- imagemagickImageMagick converting a malicious MVG file to SVG caused an integer overflow.5.3 Medium
- appointifyWordPress Appointify plugin <= 1.0.8 - SQL Injection vulnerability7.6 High
- imagemagickMagick's failure to limit MVG mutual references forming a loop4.0 Medium
- conoha by gmo wing wordpress migratorWordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- revmakx wpcal.ioWordPress WPCal.io plugin <= 0.9.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC Web-based Configuration formStaDrvSetup command injection6.9 Medium
- sitelock security – wp hardening, login security & malware scansWordPress SiteLock Security plugin <= 5.0.1 - Broken Access Control vulnerability4.3 Medium
- merv barrett import into easy property listingsWordPress Import into Easy Property Listings plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- dmccan yada wikiWordPress Yada Wiki plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- imagemagickMagick's failure to limit the depth of SVG file reads caused a DoS attack.5.3 Medium
- codeflavors featured video for wordpress – videographywpWordPress Featured Video for WordPress – VideographyWP plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- composerComposer vulnerable to ANSI sequence injection1.3 Low
- wp legal pages cookie notice for gdpr, ccpa & eprivacy consentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability5.3 Medium
- discourseUsers are able to find users by name even when `enable_names` is off6.3 Medium
- webcreations907 wbc907 coreWordPress WBC907 Core plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tenda w6-s, w6-s firmware +1 moreTenda W6-S R7websSsecurityHandler httpd stack-based overflow9.3 Critical
- 8theme xstore coreWordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tenda w6-s, w6-s firmware +1 moreTenda W6-S ATE Service ate TendaAte os command injection5.3 Medium
- mmaitre314 picklescanpicklescan - Remote Code Execution via _operator.attrgetter Detection Bypass7.6 High
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via _operator.methodcaller7.6 High
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length Gadget7.6 High
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget7.6 High
pterodactyl/panelPackagistPterodactyl has a Reflected XSS vulnerability in “Create New Database Host”2.0 Low- tenda m3, m3 firmware +1 moreTenda M3 exeCommand stack-based overflow8.7 High
- tenda m3, m3 firmware +1 moreTenda M3 setDhcpAP formSetRemoteDhcpForAp stack-based overflow8.7 High
- beecue fastbeebeecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference6.3 Medium
- 08cms novel system08CMS Novel System Template mtpls.inc.php code injection5.1 Medium
- zhujunliang3 work platformzhujunliang3 work_platform Content cross site scripting5.1 Medium
- linuxremoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()No score
- linuxregulator: core: fix unbalanced of node refcount in regulator_dev_lookup()No score
- Show moreLoading…