Latest Security Vulnerabilities

Sunday December 21, 2025

Woocommerce

CVE-2025-12398 WooCommerce <=5.0.8 Reflected XSS via search_key

Themeisle

CVE-2025-14800 Arbitrary File Upload in Contact Form 7 <=3.2.7 via move_file_to_upload

Tenda

CVE-2025-14995 Stack Buffer Overflow in Tenda FH1201 1.2.0.14 via SetIpBind
CVE-2025-14994 Tenda FH1201/FH1206 Remote Stack-Buffer Overflow in HTTP Req Handler v1.2.x

Hasthemes

CVE-2025-14054 WC Builder WPBakery XSS via style params in v1.2.0 (ShopMgr)
 

Unclassified

CVE-2025-14071 PHP Object Injection in Live Composer WP Plugin up to 2.0.2
CVE-2025-14080 FPMS Lite <=1.2.5 Missing Auth: Unauth Post Mod via Guest form
CVE-2025-12654 WPvivid Backup & Migration <0.9.120 Authenticated Arbitrary Dir Creation
CVE-2025-13361 WP Web-to-SugarCRM Lead Plugin <1.0.0 CSRF deletion (no nonce)
CVE-2025-13838 WordPress WishSuite <=1.5.1 Stored XSS via button_text
CVE-2025-9343 Stored XSS in ELEX WP HelpDesk & Customer Ticketing System 3.3.4
CVE-2023-25446 Missing Auth in HappyFiles Pro (<=1.8.1)
CVE-2023-25445 Missing Auth in HappyFiles Pro 1.8.1 Incorrect Access Control
CVE-2025-14633 F70 Lead Document Download WP plugin: Authless file download until 1.4.4
And others...

Rustaurius

CVE-2025-11496 5SRR WP Plugin 2.7.5 Stored XSS via rtb-name

Ultimatemember Ultimate Member

CVE-2025-13220 Ultimate Member WP Plugin 2.11.x Stored XSS via shortcode attributes
CVE-2025-12492 Ultimate Member v2.11.0 Sensitive Info Exposure via low-entropy token

Wpxpo Postx

CVE-2025-12980 PostX Plugin 5.0.3 REST '/ultp/v2/get_dynamic_content/' Unauthorized Access
CVE-2025-54751 Missing Auth Vulnerability in PostX <=4.1.36 WP Plugin

Wpchill

CVE-2025-13693 Image Photo Gallery Final Tiles Grid <=3.6.8 XSS via Custom scripts
CVE-2025-14455 WP IPGF Final Tiles Grid v3.6.7 Authorization Bypass (contributor+)

Tenda Ac18

CVE-2025-14992 Tenda AC18 15.03.05.05: Stack Buffer Overflow in HTTP Req Handler strcpy
CVE-2025-14993 Stack Buffer Overflow in Tenda AC18 HTTP Handler (sprintf) Pre 15.03.05.05

Tainacan

CVE-2025-14043 Tainacan wpplugin create_item_permissions_check() bypass REST API <1.0.1

Brainstormforce Sureforms

CVE-2025-14855 WP SureForms <=2.2.0 Stored XSS via Form Fields

Yealink

CVE-2025-68644 Unauthorized Access via RPS in Yealink Devices (CVE-2025-68644)

Mojofywp Wp Affiliate Disclosure

CVE-2023-47232 WP Affiliate Disclosure <1.2.6 (MojofyWP) Remote XSS

Campcodes Complete Online Beauty Parlor Management System

CVE-2025-14991 Campcodes Parlor Mgt Sys 1.0 XSS via fromdate bwdates-reports-details.php
CVE-2025-14990 SQLi in Campcodes Parlor Mgmt 1.0 /admin/view-appointment.php via viewid
CVE-2025-14989 Campcodes Beauty PM 1.0 SQLi via /admin/search-invoices.php

Saturday December 20, 2025

 

Unclassified

CVE-2025-14071 PHP Object Injection in Live Composer WP Plugin up to 2.0.2
CVE-2025-14080 FPMS Lite <=1.2.5 Missing Auth: Unauth Post Mod via Guest form
CVE-2025-12654 WPvivid Backup & Migration <0.9.120 Authenticated Arbitrary Dir Creation
CVE-2025-13361 WP Web-to-SugarCRM Lead Plugin <1.0.0 CSRF deletion (no nonce)
CVE-2025-13838 WordPress WishSuite <=1.5.1 Stored XSS via button_text
CVE-2025-9343 Stored XSS in ELEX WP HelpDesk & Customer Ticketing System 3.3.4
CVE-2023-25446 Missing Auth in HappyFiles Pro (<=1.8.1)
CVE-2023-25445 Missing Auth in HappyFiles Pro 1.8.1 Incorrect Access Control
CVE-2025-14633 F70 Lead Document Download WP plugin: Authless file download until 1.4.4
And others...

Ultimatemember Ultimate Member

CVE-2025-13220 Ultimate Member WP Plugin 2.11.x Stored XSS via shortcode attributes
CVE-2025-12492 Ultimate Member v2.11.0 Sensitive Info Exposure via low-entropy token

Tp Link Tapo

CVE-2025-8065 Buffer Overflow in Tapo C200 V3 ONVIF XML Parser Enables DoS
CVE-2025-14300 Tapo C200 V3 HTTPS ConnectAP Unauth Enables WiFi Config Tampering
CVE-2025-14299 Tapo C200 V3 HTTPS Content-Length Integer Overflow DoS

Kaizencoders

CVE-2025-12581 Reflected XSS via URL in Attachments Handler Plugin <=1.1.7

Versa Networks

CVE-2025-34290 LPEx in Versa SASE Client 7.8.77.9.4 Audit Export via UserControlled Paths

Perforce

CVE-2025-14591 CSV Parser EOR Misconfiguration Exposes PII

Campcodes Complete Online Beauty Parlor Management System

CVE-2025-14991 Campcodes Parlor Mgt Sys 1.0 XSS via fromdate bwdates-reports-details.php
CVE-2025-14990 SQLi in Campcodes Parlor Mgmt 1.0 /admin/view-appointment.php via viewid
CVE-2025-14989 Campcodes Beauty PM 1.0 SQLi via /admin/search-invoices.php

Friday December 19, 2025

Hikvision

CVE-2025-66173 Hikvision DVR Priv Esc via Serial Port Auth
CVE-2025-66174 Hikvision DVR Serial Port Authentication Bypass
 

Unclassified

CVE-2025-14071 PHP Object Injection in Live Composer WP Plugin up to 2.0.2
CVE-2025-14080 FPMS Lite <=1.2.5 Missing Auth: Unauth Post Mod via Guest form
CVE-2025-12654 WPvivid Backup & Migration <0.9.120 Authenticated Arbitrary Dir Creation
CVE-2025-13361 WP Web-to-SugarCRM Lead Plugin <1.0.0 CSRF deletion (no nonce)
CVE-2025-13838 WordPress WishSuite <=1.5.1 Stored XSS via button_text
CVE-2025-9343 Stored XSS in ELEX WP HelpDesk & Customer Ticketing System 3.3.4
CVE-2023-25446 Missing Auth in HappyFiles Pro (<=1.8.1)
CVE-2023-25445 Missing Auth in HappyFiles Pro 1.8.1 Incorrect Access Control
CVE-2025-14633 F70 Lead Document Download WP plugin: Authless file download until 1.4.4
And others...

Filezilla Project Filezilla Client

CVE-2023-53959 FileZilla Client 3.63.1 DLL Hijacking Enables Remote Code Exec

Watchguard Fireware Os

CVE-2025-14733 WatchGuard Fireware OS OOB Write CVE-2025-14733 (2025.1.3)

MongoDB

CVE-2025-14847 MongoDB Server Uninit Heap Read via Zlib Header Len Mismatch <4.2.0

Esri Arcgis

CVE-2025-67712 HTML Injection via Unsanitized Input in Esri ArcGIS WB Dev Ed <2.30

Eve Ng

CVE-2025-67442 Directory Traversal in EVE-NG 6.4.0-13-PRO /api/export API

Foxit Pdf Reader

CVE-2025-66493 Foxit PDF Reader/Editor <=2025.2.1 vulnerable to AcroForm JS useafterfree

Apache NiFi

CVE-2025-66524 Apache NiFi GetAsanaObject: Unfiltered Java Object Deserialization (pre2.7.0)

Mycred

CVE-2025-12361 Missing Auth in myCred WP Plugin 2.9.7.1 get_bank_accounts AJAX

Extendthemes Colibri Page Builder

CVE-2025-11747 WordPress Colibri Page Builder <1.0.345 Stored XSS via colibri_blog_posts

Webassembly Binaryen

CVE-2025-14956 Binaryen Heap Buffer Overflow via WasmBinaryReader::readExport
CVE-2025-14957 Binaryen IRBuilder Null Pointer Deref in makeLocalGet/Set/Tee

Wpchill

CVE-2025-13693 Image Photo Gallery Final Tiles Grid <=3.6.8 XSS via Custom scripts
CVE-2025-14455 WP IPGF Final Tiles Grid v3.6.7 Authorization Bypass (contributor+)

Bplugins Html5 Audio Player

CVE-2025-13999 SRSF via getIcyMetadata() in Ultimate NoCode Podcast WP plugin 2.4.02.5.1

Open5gs

CVE-2025-14954 Open5GS 2.7.5 PFCP Reassertion Exploit
CVE-2025-14955 Open5GS PFCP Improper Init Remote RCE Before 2.7.5
CVE-2025-14953 Open5GS 2.7.5 FAR-ID Handler Null Pointer Deref Vulnerability (CVE-2025-14953)

Veronalabs

CVE-2025-14151 WP SlimStat Analytics 5.3.2 XSS via outbound_resource

Langflow

CVE-2025-68477 Langflow API Request SSRF via Unsafe URL Before v1.7.0
CVE-2025-68478 Langflow <1.7.0 Request fs_path Arbitrary Path File Upload

N8n

CVE-2025-68613 n8n RCE via expression eval system (0.211.0+ <1.120.4)

Galette

CVE-2025-53922 Galette 1.1.4-1.2.0 Fix: RB bypass on Contributions & Txns
CVE-2025-58053 Galette < 1.2.0 Elevates Privileges via POST Forgery
CVE-2025-58052 Galette <=1.2.0 RBA Bypass via Group Manager Role

Mitsubishielectric Genesis64

CVE-2025-11774 OS Command Injection in Mitsubishi Electric GENESIS64 10.97.2 CFR3

Quest Software Coexistence Manager For Notes

CVE-2025-12874 Quest Coexistence Manager for Notes 3.8.2045: HTTP Request Smuggling via CL/TE

M Files Server

CVE-2025-14267 M-Files Server Data Leak Before 25.12.15491.7

Palantir Gotham

CVE-2024-49587 Unauthenticated Glutton V1 endpoints on Gotham stacks

Kimai

CVE-2023-53957 Kimai 1.30.10 SameSite cookie vulnerability enables session hijacking

Code Projects

CVE-2025-14968 Simple Stock System 1.0 PHP /market/update.php SQLi via email
CVE-2025-14962 Simple Stock System 1.0 XSS Remote via /market/chatuser.php
CVE-2025-14960 Simple Blood Donor Management System 1.0 SQLi via Name in editeddonor.php
CVE-2025-14939 Online Appointment Booking System 1.0 Remote SQLi via deletmanager.php
CVE-2025-14961 SQLi in Simple Blood Donor Mgmt Sys 1.0 via campaignname in /editedcampaign.php
CVE-2025-14959 SQLi in Simple Stock System 1.0 /market/signup.php

Totolink T10 Firmware

CVE-2025-14964 Stack Buffer Overrun via loginAuthUrl in TOTOLINK T10 4.1.8cu.5083_B20200521

Codeastro Real Estate Management System

CVE-2025-14899 CodeAstro Real Estate Mgmt 1.0 SQLi via /admin/stateadd.php
CVE-2025-14900 CodeAstro Real Estate MS 1.0 SQLi in Admin/UserDelete.php ID param

Red Hat Enterprise Linux (RHEL)

CVE-2025-14946 libnbd URI Injection Enables Code Execution via Malicious SSH Args

Code Projects Scholars Tracking System

CVE-2025-14940 SQLi via /admin/delete_user.php in Scholars Tracking System 1.0
CVE-2025-14951 SQL Injection via post_content in Code Projects Scholars Tracking System 1.0
CVE-2025-14950 SQLi via ID param in Scholars Tracking Sys 1.0 delete_post.php

Linksys

CVE-2025-52692 Unauthenticated Admin Access via Crafted URL (Local Net)

Wwbn Avideo

CVE-2025-34433 AVideo <14.3.1> RCE via salt bruteforce (PHP uniqid)

Palantir

CVE-2023-30971 Gotham Gaia unauthenticated endpoint exposure

Itsourcecode

CVE-2025-14967 itsrc Student Mgt Sys 1.0 remote SQLi via /candidates_report.php

Campcodes Supplier Management System

CVE-2025-14952 SQLi in Campcodes Supplier Mgmt Sys 1.0 via txtCategoryName in add_category.php

Edimax

CVE-2025-14910 Edimax BR-6208AC 1.02 FTP Daemon Path Traversal RCE

Dotclear

CVE-2023-53952 Dotclear 2.25.3 RCE via .phar upload

Thursday December 18, 2025

Qualcomm Snapdragon

CVE-2025-47350 Linux Kernel Concurrent mmap/unmap Memory Corruption CVE-2025-47350

Nozominetworks Guardian

CVE-2025-40891 Stored HTML Injection in Time Machine Snapshot Diff via Network Packet Injection

Mozilla Firefox

CVE-2025-14860 Firefox UAF in Disability Access APIs (pre146.0.1)
CVE-2025-14861 Memory safety bugs in Mozilla Firefox <146.0.1 (Arbitrary code exec)
CVE-2025-14744 Firefox iOS RTLO Spoof in Downloads UI <144.0

Tp Link

CVE-2025-14739 TP-Link WR940N/WR941ND Uninitialized Pointer DoS/Code Exec
CVE-2025-14738 TP-Link WA850RE: Unauth Auth Flaw in httpd Modules Exposes Config File

Apache Log4j

CVE-2025-68161 Log4j Core 2.0-2.25.2 Socket Appender TLS Hostname Verification Bypass

Anton Vanyukov Cf Images

CVE-2025-66104 Missing Auth in Offload AI&Optimize Cloudflare Images v<=1.9.5

Crm Perks Gf Zoho

CVE-2025-60091 WP Gravity Forms GF-ZOHO Object Injection via Deserialization before 1.2.9

FFmpeg

CVE-2025-63757 Integer Overflow in FFmpeg 8.0 libswscale yuv2ya16_X_c_template

Google Android

CVE-2025-47319 Info Disclosure via Android TA-to-TA APIs Exposed to HLOS

Linux Kernel

CVE-2025-68323 Linux kernel UCsi Driver UAF via delayed work in gaokun_ucsi
CVE-2025-68324 Linux Kernel SCSI IMM UAF via Delayed Work
CVE-2025-68325 Linux Kernel sch_cake qlen Accounting Inconsistency: NULL Deref Risk

Elastic

CVE-2025-68382 NFS OOB Read Causing DoS (CVE-2025-68382)
CVE-2025-68383 Filebeat Syslog/Dissect BUF Overflow via Malformed Msg/Tokenizer

Elasticsearch

CVE-2025-68384 Elasticsearch OOM DoS: Unrestricted User Settings Allocation
CVE-2025-68390 Elasticsearch Excessive Memory Allocation via Snapshot Restore (DoS)

Elastic Kibana

CVE-2025-68386 Kibana: Improper Auth Enables Global Document Sharing (CWE-285)
CVE-2025-68389 Kibana Resource Leak: Authenticated DoS via Crafted HTTP (CVE-2025-68389)
CVE-2025-68422 Kibana Privilege Escalation via AuthBypass HTTP Request (CVE-2025-68422)

Microsoft Azure Cognitive Service Language

CVE-2025-64663 Dec 2025: Custom Question Answering Elevation of Privilege Vulnerability

Microsoft Cosmos Db

CVE-2025-64675 Dec 2025: Azure Cosmos DB Spoofing Vulnerability

Microsoft Office Purview

CVE-2025-64676 Dec 2025: Microsoft Purview eDiscovery Remote Code Execution Vulnerability

Microsoft Office Out Of Box Experience

CVE-2025-64677 Dec 2025: Office Out-of-Box Experience Spoofing Vulnerability

Arduino

CVE-2025-64723 Arduino IDE 2.3.7 MacOS Entitlement Bypass

Microsoft Edge Browser

CVE-2025-65046 Dec 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Partner Center

CVE-2025-65041 Dec 2025: Microsoft Partner Center Elevation of Privilege Vulnerability

Microsoft Azure Container Apps

CVE-2025-65037 Dec 2025: Azure Container Apps Remote Code Execution Vulnerability

Red Hat Acm

CVE-2025-14874 Nodemailer DoS via crafted email header triggers infinite recursion

Smub

CVE-2025-13641 Local File Inclusion in NextGEN Gallery 3.59.12 via template shortcode

Google

CVE-2025-13427 Auth Bypass in Google Cloud Dialogflow CX Messenger via init params

Inductiveautomation Ignition

CVE-2025-13911 Ignition SCADA Unrestricted Python Imports Allow SYSTEMLevel Code Execution

ImageMagick

CVE-2025-68469 ImageMagick <=7.1.1-13 Crashes on Crafted TIFF (Fixed in 7.1.1-14)

Kentico Xperience

CVE-2019-25230 Kentico Xperience: Authenticated Info Disclosure via Live Site Widget Properties
CVE-2022-50686 Kentico Xperience: Form Control Stack Trace Disclosure

Wpxpo Postx

CVE-2025-12980 PostX Plugin 5.0.3 REST '/ultp/v2/get_dynamic_content/' Unauthorized Access
CVE-2025-54751 Missing Auth Vulnerability in PostX <=4.1.36 WP Plugin

Ni Labview

CVE-2025-64465 OOB Read in NI LabVIEW 25.3 via lvre!DataSizeTDR(): Info Disclosure & Code Exec
CVE-2025-64461 NI LabVIEW OOBV in mgocre_SH_25_3!RevBL() pre-25.3

Getresponse Official

CVE-2025-64272 CVE-2025-64272: Email-Mktg WP by GetResponse Sensitive Data Exposure <=1.5.3