Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2025

216 records · 23 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2025-13796
    8Monitor

    deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

    LowCVSS 2.1Proof of conceptEPSS 0%

    deco-cx · appsDec 1, 2025

  • CVE-2025-8045
    16Monitor

    Mali GPU Kernel Driver allows improper GPU processing operations

    MediumCVSS 4.0Proof of conceptEPSS 0%

    arm · 5th gen gpu architecture kernel driverDec 1, 2025

  • CVE-2025-3500
    39Monitor

    Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    avast · antivirusDec 1, 2025

  • CVE-2025-57489
    32Monitor

    Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to t

    HighCVSS 8.1Proof of conceptEPSS 0%

    shirt-pocket · superduper\!Dec 1, 2025

  • CVE-2025-61228
    31Monitor

    An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism

    HighCVSS 7.8Proof of conceptEPSS 0%

    shirt-pocket · superduper\!Dec 1, 2025

  • CVE-2025-61229
    31Monitor

    An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p

    HighCVSS 7.8Proof of conceptEPSS 0%

    shirt-pocket · superduper\!Dec 1, 2025

  • CVE-2025-51683
    40Plan

    A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a cr

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    mjobtime · mjobtimeDec 1, 2025

  • CVE-2025-55749
    34Monitor

    The XWiki Jetty package (XJetty) allows accessing any application file through URL

    HighCVSS 8.7Proof of conceptEPSS 1%

    xwiki · xwikiDec 1, 2025

  • CVE-2025-58044
    22Monitor

    JumpServer has an Open Redirect Vulnerability

    MediumCVSS 5.5Proof of conceptEPSS 0%

    fit2cloud · jumpserverDec 1, 2025

  • CVE-2025-66294
    40Plan

    Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

    HighCVSS 8.7WeaponizedEPSS 2%

    getgrav · gravDec 1, 2025

  • CVE-2025-66301
    40Plan

    Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

    HighCVSS 8.6WeaponizedEPSS 1%

    getgrav · gravDec 1, 2025

  • CVE-2025-65858
    14Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'

    LowCVSS 3.5Proof of conceptEPSS 0%

    janeczku · calibre-webDec 2, 2025

  • CVE-2025-60854
    39Monitor

    A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    dlink · r15 firmwareDec 2, 2025

  • CVE-2025-60736
    39Monitor

    code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    anisha · online medicine guideDec 2, 2025

  • CVE-2025-66399
    32Monitor

    SNMP Command Injection leads to RCE in Cacti

    HighCVSS 7.4No exploitEPSS 10%

    cacti · cactiDec 2, 2025

  • CVE-2025-12585
    21Monitor

    MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    mxchat · mxchat – ai chatbot & content generation for wordpressDec 3, 2025

  • CVE-2025-13486
    60This week

    Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

    CriticalCVSS 9.8WeaponizedEPSS 67%

    hwk-fr · advanced custom fields: extendedDec 3, 2025

  • CVE-2025-12744
    35Monitor

    Abrt: command-injection in abrt leading to local privilege escalation

    HighCVSS 8.8Proof of conceptEPSS 0%

    red hat · red hat enterprise linux 6Dec 3, 2025

  • CVE-2025-13947
    29Monitor

    Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

    HighCVSS 7.4Proof of conceptEPSS 0%

    the webkitgtk team · webkitgtkDec 3, 2025

  • CVE-2025-57199
    36Monitor

    AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i

    HighCVSS 8.8Proof of conceptEPSS 3%

    avtech · dgm1104 firmwareDec 3, 2025

  • CVE-2025-57201
    40Plan

    AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i

    HighCVSS 8.8No exploitEPSS 17%

    avtech · dgm1104 firmwareDec 3, 2025

  • CVE-2025-65320
    30Monitor

    Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory.

    HighCVSS 7.5Proof of conceptEPSS 0%

    abacre · restaurant point of saleDec 3, 2025

  • CVE-2024-32641
    43Plan

    Masa CMS Vulnerable to Pre-Auth RCE via JSON API

    CriticalCVSS 9.8No exploitEPSS 12%

    masacms · masacmsDec 3, 2025

  • CVE-2025-20384
    21Monitor

    Unauthenticated Log Injection in Splunk Enterprise

    MediumCVSS 5.3Proof of conceptEPSS 0%

    splunk · splunkDec 3, 2025

  • CVE-2025-13342
    40Plan

    Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    shabti · frontend admin by dynamiappsDec 3, 2025

  • CVE-2025-13390
    40Plan

    WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    wpdirectorykit · wp directory kitDec 3, 2025

  • CVE-2025-13401
    25Monitor

    Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 6.4Proof of conceptEPSS 0%

    optimizingmatters · autoptimizeDec 3, 2025

  • CVE-2025-50360
    33Monitor

    A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.

    HighCVSS 8.4Proof of conceptEPSS 0%

    dannyvankooten · pepperDec 3, 2025

  • CVE-2025-55182
    100Now

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    facebook · reactDec 3, 2025

  • CVE-2025-50361
    20Monitor

    Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe

    MediumCVSS 5.1Proof of conceptEPSS 0%

    smallbasic · smallbasicDec 3, 2025

  • CVE-2025-65027
    30Monitor

    RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover

    HighCVSS 7.6Proof of conceptEPSS 0%

    romm.app · rommDec 3, 2025

  • CVE-2025-65345
    26Monitor

    alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    alexusmai · laravel file managerDec 3, 2025

  • CVE-2025-65346
    36Monitor

    alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    alexusmai · laravel file managerDec 4, 2025

  • CVE-2025-61148
    26Monitor

    An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access

    MediumCVSS 6.5Proof of conceptEPSS 0%

    edupluscampus · edupluscampusDec 4, 2025

  • CVE-2025-66516
    66This week

    Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

    CriticalCVSS 9.8WeaponizedEPSS 88%

    apache · tikaDec 4, 2025

  • CVE-2025-65637
    30Monitor

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64

    HighCVSS 7.5Proof of conceptEPSS 0%

    turbopuffer · logrusDec 4, 2025

  • CVE-2025-63499
    24Monitor

    Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    alinto · sogoDec 4, 2025

  • CVE-2025-1910
    25Monitor

    WatchGuard Mobile VPN with SSL Local Privilege Escalation via Update Package

    MediumCVSS 6.3Proof of conceptEPSS 0%

    watchguard · mobile vpn with ssl clientDec 4, 2025

  • CVE-2025-65899
    21Monitor

    Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    difuse · kalmiaDec 4, 2025

  • CVE-2025-65900
    26Monitor

    Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    difuse · kalmiaDec 4, 2025

  • CVE-2025-65945
    30Monitor

    auth0/node-jws improper HMAC signature verification vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    auth0 · node-jwsDec 4, 2025

  • CVE-2025-12097
    34Monitor

    Relative Path Traversal Vulnerability in NI System Web Server

    HighCVSS 8.7Proof of conceptEPSS 0%

    ni · labviewDec 4, 2025

  • CVE-2025-13543
    35Monitor

    PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 0%

    rtowebsites · postgalleryDec 4, 2025

  • CVE-2025-12163
    25Monitor

    Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting

    MediumCVSS 6.4Proof of conceptEPSS 0%

    omnipressteam · omnipressDec 5, 2025

  • CVE-2025-12189
    35Monitor

    Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upl

    HighCVSS 8.8Proof of conceptEPSS 0%

    breadbutter · bread & butterDec 5, 2025

  • CVE-2025-13528
    21Monitor

    Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter

    MediumCVSS 5.3Proof of conceptEPSS 0%

    nedwp · feedback modal for websiteDec 5, 2025

  • CVE-2025-58098
    33Monitor

    Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

    HighCVSS 8.3Proof of conceptEPSS 1%

    apache · http serverDec 5, 2025

  • CVE-2025-66644
    70This week

    Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

    CriticalCVSS 9.8KEVWeaponizedEPSS 3%

    arraynetworks · arrayos agDec 5, 2025

  • CVE-2025-14092
    13Monitor

    Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection

    LowCVSS 2.0No exploitEPSS 16%

    edimax · br-6478ac v3 firmwareDec 5, 2025

  • CVE-2025-14093
    14Monitor

    Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection

    LowCVSS 2.0No exploitEPSS 19%

    edimax · br-6478ac v3 firmwareDec 5, 2025

  • CVE-2025-14094
    14Monitor

    Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection

    LowCVSS 2.0No exploitEPSS 20%

    edimax · br-6478ac v3 firmwareDec 5, 2025

  • CVE-2025-14106
    33Monitor

    ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection

    HighCVSS 7.4No exploitEPSS 12%

    zspace · q2c nas firmwareDec 5, 2025

  • CVE-2025-14107
    33Monitor

    ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection

    HighCVSS 7.4No exploitEPSS 12%

    zspace · q2c nas firmwareDec 5, 2025

  • CVE-2025-14108
    32Monitor

    ZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injection

    HighCVSS 7.4No exploitEPSS 10%

    zspace · q2c nas firmwareDec 5, 2025

  • CVE-2025-34291
    95Now

    Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

    CriticalCVSS 9.4KEVWeaponizedEPSS 92%

    langflow · langflowDec 5, 2025

  • CVE-2025-12673
    39Monitor

    Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    ajitdas · flex qr code generatorDec 6, 2025

  • CVE-2025-12720
    21Monitor

    g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion

    MediumCVSS 5.3Proof of conceptEPSS 0%

    garidium · g-ffl cockpitDec 6, 2025

  • CVE-2025-12721
    21Monitor

    g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    garidium · g-ffl cockpitDec 6, 2025

  • CVE-2025-13065
    39Monitor

    Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

    HighCVSS 8.8No exploitEPSS 13%

    brainstormforce · starter templates – ai-powered templates for elementor & gutenbergDec 6, 2025

  • CVE-2025-40271
    31Monitor

    fs/proc: fix uaf in proc_readdir_de()

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linuxDec 6, 2025

  • CVE-2025-14221
    8Monitor

    SourceCodester Online Banking System page cross site scripting

    LowCVSS 2.0Proof of conceptEPSS 0%

    oretnom23 · banking systemDec 8, 2025

  • CVE-2025-48572
    61This week

    In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    google · androidDec 8, 2025

  • CVE-2025-48633
    52Plan

    In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    google · androidDec 8, 2025

  • CVE-2025-65271
    35Monitor

    Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the c

    HighCVSS 8.8Proof of conceptEPSS 0%

    azuriom · azuriomDec 8, 2025

  • CVE-2025-65964
    37Monitor

    n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    n8n · n8nDec 9, 2025

  • CVE-2025-66204
    25Monitor

    WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

    MediumCVSS 6.3Proof of conceptEPSS 0%

    wbce · wbce cmsDec 9, 2025

  • CVE-2025-66470
    24Monitor

    NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

    MediumCVSS 6.1Proof of conceptEPSS 0%

    zauberzeug · niceguiDec 9, 2025

  • CVE-2025-59718
    89Now

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti

    CriticalCVSS 9.8KEVWeaponizedEPSS 68%

    fortinet · fortiproxyDec 9, 2025

  • CVE-2025-59719
    48Plan

    An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t

    CriticalCVSS 9.8No exploitEPSS 29%

    fortinet · fortiwebDec 9, 2025

  • CVE-2025-62221
    62This week

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · windows 10 1809Dec 9, 2025

  • CVE-2025-62454
    32Monitor

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 2%

    microsoft · windows 10 1809Dec 9, 2025

  • CVE-2025-65300
    21Monitor

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Set

    MediumCVSS 5.4Proof of conceptEPSS 0%

    coohom · coohomDec 9, 2025

  • CVE-2025-65741
    39Monitor

    Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    sublimetext · sublime text 3Dec 9, 2025

  • CVE-2025-10573
    34Monitor

    Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript

    MediumCVSS 6.1No exploitEPSS 33%

    ivanti · endpoint managerDec 9, 2025

  • CVE-2025-14321
    39Monitor

    Use-after-free in the WebRTC: Signaling component

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mozilla · firefoxDec 9, 2025

  • CVE-2025-14325
    29Monitor

    JIT miscompilation in the JavaScript Engine: JIT component

    HighCVSS 7.3Proof of conceptEPSS 0%

    mozilla · firefoxDec 9, 2025

  • CVE-2025-67586
    18Monitor

    WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

    MediumCVSS 4.7Proof of conceptEPSS 0%

    ronald huereca · highlight and shareDec 9, 2025

  • CVE-2025-67588
    17Monitor

    WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    elementor · elementor website builderDec 9, 2025

  • CVE-2025-34401
    21Monitor

    MailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspx

    MediumCVSS 5.3No exploitEPSS 0%

    mailenable · mailenableDec 9, 2025

  • CVE-2025-53679
    32Monitor

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    HighCVSS 7.2No exploitEPSS 12%

    fortinet · fortisandboxDec 9, 2025

  • CVE-2025-53949
    40Plan

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    HighCVSS 8.8No exploitEPSS 17%

    fortinet · fortisandboxDec 9, 2025

  • CVE-2025-54100
    32Monitor

    PowerShell Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 2%

    microsoft · windows 10 1607Dec 9, 2025

  • CVE-2025-62470
    31Monitor

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · windows 10 1607Dec 9, 2025

  • CVE-2025-66039
    60This week

    FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

    CriticalCVSS 9.3WeaponizedEPSS 3%

    sangoma · freepbxDec 9, 2025

  • CVE-2025-61808
    39Monitor

    ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

    CriticalCVSS 9.1No exploitEPSS 10%

    adobe · coldfusionDec 9, 2025

  • CVE-2025-66645
    30Monitor

    NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

    HighCVSS 7.5Proof of conceptEPSS 1%

    zauberzeug · niceguiDec 9, 2025

  • CVE-2025-67494
    34Monitor

    ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

    HighCVSS 8.6Proof of conceptEPSS 0%

    zitadel · zitadelDec 9, 2025

  • CVE-2025-13339
    31Monitor

    Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

    HighCVSS 7.5Proof of conceptEPSS 2%

    hippooo · hippoo mobile app for woocommerceDec 10, 2025

  • CVE-2025-13184
    42Plan

    Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password

    CriticalCVSS 9.8No exploitEPSS 11%

    totolink · x5000r firmwareDec 10, 2025

  • CVE-2025-8110
    90Now

    File overwrite in file update API in Gogs

    HighCVSS 8.7KEVWeaponizedEPSS 85%

    gogs · gogsDec 10, 2025

  • CVE-2025-65754
    24Monitor

    Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a fil

    MediumCVSS 6.1Proof of conceptEPSS 0%

    algernon project · algernonDec 10, 2025

  • CVE-2025-63895
    30Monitor

    An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (

    HighCVSS 7.5Proof of conceptEPSS 0%

    jxlindia · jxl 9 inch car android double din player firmwareDec 10, 2025

  • CVE-2025-34392
    47Plan

    Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

    CriticalCVSS 10.0No exploitEPSS 24%

    barracuda · rmmDec 10, 2025

  • CVE-2020-36884
    27Monitor

    BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF

    MediumCVSS 6.9Proof of conceptEPSS 1%

    brightsign, llc · brightsign digital signage diagnostic web serverDec 10, 2025

  • CVE-2025-65950
    37Monitor

    WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    wbce · wbce cmsDec 10, 2025

  • CVE-2025-66472
    26Monitor

    XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

    MediumCVSS 6.5Proof of conceptEPSS 0%

    xwiki · xwikiDec 10, 2025

  • CVE-2025-66628
    30Monitor

    ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

    HighCVSS 7.5Proof of conceptEPSS 0%

    imagemagick · imagemagickDec 10, 2025

  • CVE-2025-67511
    39Monitor

    Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool

    CriticalCVSS 9.6Proof of conceptEPSS 2%

    aliasrobotics · cybersecurity aiDec 11, 2025

  • CVE-2025-67644
    32Monitor

    LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method

    HighCVSS 7.8Proof of conceptEPSS 2%

    langchain · langgraph-checkpoint-sqliteDec 11, 2025

  • CVE-2025-14528
    23Monitor

    D-Link DIR-803 Configuration getcfg.php information disclosure

    MediumCVSS 5.5Proof of conceptEPSS 3%

    dlink · dir-803 firmwareDec 11, 2025