CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- mindstien technologies recent posts from each categoryWordPress Recent Posts From Each Category plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- socialprofilr social profilrWordPress Social Profilr plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- rene ade sensitivetagcloudWordPress SensitiveTagCloud plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- mg12 wp-easyarchivesWordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- eyoucmsEyouCMS arcpagelist Ajax.php unserialize deserialization5.3 Medium
- peterwsterling simple archive generatorWordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- eleopard behance portfolio managerWordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- eyoucmsEyouCMS Ask Module Ask.php cross site scripting5.1 Medium
- eyoucmsEyouCMS function.php saveRemote server-side request forgery5.3 Medium
- philipinho simple-php-blogPhilipinho Simple-PHP-Blog login.php cross site scripting5.3 Medium
- youlai vue3-element-adminyoulaitech vue3-element-admin Notice index.vue cross site scripting4.8 Medium
- agronholm cbor2CBORDecoder reuse can leak shareable values across decode calls5.5 Medium
- tenda 4g03 pro, 4g05, 4g08 +4 more +6 moreTenda i24 Shadow File hard-coded credentials8.5 High
- the tcpdump group libpcapOOBW in utf_16le_to_utf_8_truncated() in libpcap1.9 Low
- the tcpdump group libpcapOOBR and OOBW in pcap_ether_aton() in libpcap1.9 Low
pcapplusplusOSS-FuzzHeap-buffer-overflow in unsigned char* std::__1::vector<unsigned char, std::__1::allocator<unsigned charNo score- sevencs ec2007 kernel, orca g2 +1 moreAn incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The...7.8 High
- sevencs ec2007 kernel, orca g2 +1 moreA local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5...7.0 High
- hoernerfranz wp-caldav2icsWordPress WP-CalDav2ICS plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- etap lighting international nv safety manager, etaplighting etap safety manager +1 moreETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter5.1 Medium
- ksenia security s.p.a. lares, kseniasecurity lares firmware +1 moreKsenia Security lares Home Automation 1.6 PIN Exposure Vulnerability9.3 Critical
- ksenia security s.p.a. lares, kseniasecurity lares firmware +1 moreKsenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload9.3 Critical
- ksenia security s.p.a. lares, kseniasecurity lares firmware +1 moreKsenia Security lares Home Automation 1.6 URL Redirection Vulnerability5.1 Medium
- ksenia security s.p.a. lares, kseniasecurity lares firmware +1 moreKsenia Security lares Home Automation 1.6 Default Credentials Vulnerability9.3 Critical
- ateme flamingo xl, flamingo xl firmware +1 moreAnevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command8.6 High
- the akuvox company akuvox smart intercom, akuvox c313w-2 firmware, e16c firmware +12 more +14 moreAkuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI8.7 High
- the akuvox company akuvox smart intercom, akuvox c313w-2 firmware, nc-2 firmware +11 more +13 moreAkuvox Smart Intercom S539 Unauthenticated Video Stream Disclosure8.7 High
- tosi tosibox key, tosibox oy key service +1 moreTosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path8.5 High
- tinycontrol lan controller, lan controller firmware +1 moreTinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change9.3 Critical
- nlb mklik makedonijaNLB mKlik Macedonia 3.3.12 SQL Injection via International Transfer Parameters8.8 High
- ateme anevia flamingo xl/xs, flamingo xl firmware, flamingo xs firmware +2 more +4 moreAnevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass9.3 Critical
- jm-data onu jf511-tv, jm-data onu jf511-tv firmware +1 moreJM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) Vulnerability5.1 Medium
- jm-data onu jf511-tvJM-DATA ONU JF511-TV 1.0.67 Default Credentials Vulnerability9.3 Critical
- jm-data onu jf511-tvJM-DATA ONU JF511-TV 1.0.67 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability5.1 Medium
- hangzhou h3c technologies h3c ssl vpnH3C SSL VPN n/a Username Enumeration via Login Script Credential Verification6.9 Medium
- fetch softworks fetch ftp clientFetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of Service7.1 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php8.5 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.php8.7 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated File Disclosure Vulnerability8.7 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.php8.5 High
- sound4 ltd. stream, kantar media wm2, sound4 big voice2 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure6.9 Medium
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php8.5 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log Directory6.9 Medium
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Stored Cross-Site Scripting5.3 Medium
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network Commands8.7 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username Parameter8.8 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerability6.9 Medium
- Show moreLoading…