Latest Security Vulnerabilities
Saturday December 27, 2025
Unclassified
CVE-2025-68948 SiYuan Pre-3.5.1 Session Store Hardcoded Crypto SecretCVE-2025-15106 Improper Auth in getmaxun <=0.0.28 via router.get (CVE-2025-15106)
CVE-2025-15107 actiontech sqle 4.2511.0 JWT Secret Handler Hardcoded Key
CVE-2025-68927 LibreDesk 0.8.6-beta: Stored HTML Injection in Contact Notes
CVE-2025-59946 Heap UAF in NanoMQ MQTT Broker <0.24.2
CVE-2025-54322 Root RCE via Base64-encoded Py in Xspeeder SXZOS chkid param
CVE-2025-68952 Eigent 0.0.60 RCE via 1click exec
CVE-2025-15105 Getmaxun maxun <0.0.28: Hardcoded crypto key via api_key
CVE-2025-66737 Directory Traversal in Yealink T21P_E2 Phone 52.84.0.15 Diagnostic Function
And others...
Friday December 26, 2025
Gitea
CVE-2025-68940 Gitea 1.22.5: Branch Deletion Permissions Not Properly EnforcedCVE-2025-68939 Gitea <1.23.0: Attachment API Bypasses Forbidden Extension Check
CVE-2025-68941 Gitea <1.22.3: Limited-API-token can read private resources
CVE-2025-68942 Gitea <1.22.2 XSS: search box uses v-html (v-text missing)
CVE-2025-68943 Gitea <=1.21.7: Login Time Disclosure via explore/users Order
CVE-2025-68945 Gitea <1.21.2: Anonymous View of Private Projects
CVE-2025-68944 Token Scope Propagation Flaw in Gitea <1.22.2 (Package Registry Access Control)
CVE-2025-68946 Gitea <1.20.1 XSS via forbidden URL Scheme
CVE-2025-68938 Gitea <1.25.2 Release deletion auth bypass
N8n
CVE-2025-68668 n8n Pyodide Sandbox Bypass Python Code Node (<=1.99)CVE-2025-68697 n8n 2.0.0 File System Access Bypass in Code Node Pre2.0.0 Auth Escalation
CVE-2025-61914 n8n 1.114.0: Stored XSS in Respond to Webhook node
Eaton
CVE-2025-59887 Eaton UPS Companion Improper Auth of Lib Files Leading to Code ExecCVE-2025-59888 Eaton UPS Companion Installer Quotation Flaw Allows RCE
CVE-2025-67450 Eaton UPS Companion insecure lib loading leads to RCE
Unclassified
CVE-2025-68948 SiYuan Pre-3.5.1 Session Store Hardcoded Crypto SecretCVE-2025-15106 Improper Auth in getmaxun <=0.0.28 via router.get (CVE-2025-15106)
CVE-2025-15107 actiontech sqle 4.2511.0 JWT Secret Handler Hardcoded Key
CVE-2025-68927 LibreDesk 0.8.6-beta: Stored HTML Injection in Contact Notes
CVE-2025-59946 Heap UAF in NanoMQ MQTT Broker <0.24.2
CVE-2025-54322 Root RCE via Base64-encoded Py in Xspeeder SXZOS chkid param
CVE-2025-68952 Eigent 0.0.60 RCE via 1click exec
CVE-2025-15105 Getmaxun maxun <0.0.28: Hardcoded crypto key via api_key
CVE-2025-66737 Directory Traversal in Yealink T21P_E2 Phone 52.84.0.15 Diagnostic Function
And others...
Freshrss
CVE-2025-68148 FreshRSS DoS via 429 Retry-After in Proxy (v1.27.x fixed 1.28.0)CVE-2025-68932 FreshRSS Token Leakage via Weak RNG before v1.28.0
Thursday December 25, 2025
Pexip Infinity
CVE-2025-32095 Pexip Infinity <37.0: Signaling Input Validation DoSCVE-2025-32096 Pexip Infinity 33.0-37.0 Improper Input Val via Signaling DoS
CVE-2025-66378 Pexip Infinity RTMP Access Control Bypass v38.x (fixed v39.0)
CVE-2025-49088 Pexip Infinity OTJ Service DoS via Crafted Invite (32.0-37.1)
CVE-2025-66377 Pexip Infinity 39.0 Missing Auth on Internal API Enables Node Downtime
CVE-2025-66379 Pexip Infinity <39.0 Improper Input Validation in Media Impl. Causing Remote DoS
CVE-2025-66443 Pexip Infinity 35.038.1 Improper Input Validation (Pre-39.0) SIG Abort DoS
CVE-2025-48704 Pexip Infinity 35.0-37.2 Improper Input Val'd in Signalling DoS
CVE-2025-59683 Pexip Infinity 15.038.0 Secure Scheduler IAC Unauthenticated Read & DoS
Unclassified
CVE-2025-68948 SiYuan Pre-3.5.1 Session Store Hardcoded Crypto SecretCVE-2025-15106 Improper Auth in getmaxun <=0.0.28 via router.get (CVE-2025-15106)
CVE-2025-15107 actiontech sqle 4.2511.0 JWT Secret Handler Hardcoded Key
CVE-2025-68927 LibreDesk 0.8.6-beta: Stored HTML Injection in Contact Notes
CVE-2025-59946 Heap UAF in NanoMQ MQTT Broker <0.24.2
CVE-2025-54322 Root RCE via Base64-encoded Py in Xspeeder SXZOS chkid param
CVE-2025-68952 Eigent 0.0.60 RCE via 1click exec
CVE-2025-15105 Getmaxun maxun <0.0.28: Hardcoded crypto key via api_key
CVE-2025-66737 Directory Traversal in Yealink T21P_E2 Phone 52.84.0.15 Diagnostic Function
And others...
Itsourcecode
CVE-2025-15078 SQLi in itsourcecode Student Management System 1.0 via /list_report.phpCVE-2025-15077 itsourcecode Student Management System 1.0 SQLi via /form137.php
CVE-2025-15075 SQLi in itsourcecode Student Management Sys v1.0 via /student_p.php
CVE-2025-15074 SQLi in itsourcecode OFFOS 1.0 via /customer_details.php
Wednesday December 24, 2025
Linux Kernel
CVE-2025-68355 Linux Kernel BPF Map Memory Leak (CVE-2025-68355)CVE-2025-68361 ERofs stack overflow vulnerability in Linux kernel (CVE-2025-68361)
CVE-2025-68363 Linux kernel BPF helper misuses skb->transport_header
CVE-2025-68365 Linux Kernel ntfs3: Uninitialized Memory Before Use (KMSAN)
CVE-2025-68367 Linux Kernel mac_hid_toggle_emumouse Race Cond. CVE-2025-68367
CVE-2025-68371 Linux Kernel smartpqi Use-After-Free via LUN Reset Race
CVE-2025-68373 Linux Kernel md UAF: Race via repeated del_gendisk calls
CVE-2025-68374 Linux Kernel: RCU misuse in md_wakeup_thread leads to UAF
CVE-2025-68375 Linux Kernel perf/x86: NULL Event Deref via PEBS Interrupt Throttle
And others...
