По дате публикации
Эксплуатируемые и новые серьёзные CVE: декабрь 2025 г.
217 записей · 23 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
8Наблюдать | CVE-2025-13796Proof of concept | deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgerydeco-cx · apps · CWE-918 | Низкая2,1 | — | 0,3 % | 1 дек. 2025 г. |
16Наблюдать | CVE-2025-8045Proof of concept | Mali GPU Kernel Driver allows improper GPU processing operationsarm · 5th gen gpu architecture kernel driver · CWE-416 | Средняя4,0 | — | 0,1 % | 1 дек. 2025 г. |
39Наблюдать | CVE-2025-3500Proof of concept | Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalationavast · antivirus · CWE-190 | Критическая9,8 | — | 0,4 % | 1 дек. 2025 г. |
32Наблюдать | CVE-2025-57489Proof of concept | Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to tshirt-pocket · superduper\! · CWE-284 | Высокая8,1 | — | 0,2 % | 1 дек. 2025 г. |
31Наблюдать | CVE-2025-61228Proof of concept | An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanismshirt-pocket · superduper\! · CWE-494 | Высокая7,8 | — | 0,1 % | 1 дек. 2025 г. |
31Наблюдать | CVE-2025-61229Proof of concept | An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary pshirt-pocket · superduper\! · CWE-276 | Высокая7,8 | — | 0,1 % | 1 дек. 2025 г. |
40В плане | CVE-2025-51683Proof of concept | A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crmjobtime · mjobtime · CWE-89 | Критическая9,8 | — | 2,0 % | 1 дек. 2025 г. |
34Наблюдать | CVE-2025-55749Proof of concept | The XWiki Jetty package (XJetty) allows accessing any application file through URLxwiki · xwiki · CWE-284 | Высокая8,7 | — | 1,4 % | 1 дек. 2025 г. |
40В плане | CVE-2025-66294Готовый эксплойт | Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypassgetgrav · grav · CWE-94 | Высокая8,7 | — | 2,8 % | 1 дек. 2025 г. |
40В плане | CVE-2025-66301Готовый эксплойт | Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsgetgrav · grav · CWE-285 | Высокая8,6 | — | 1,3 % | 1 дек. 2025 г. |
22Наблюдать | CVE-2025-58044Proof of concept | JumpServer has an Open Redirect Vulnerabilityfit2cloud · jumpserver · CWE-601 | Средняя5,5 | — | 0,4 % | 1 дек. 2025 г. |
14Наблюдать | CVE-2025-65858Proof of concept | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'janeczku · calibre-web · CWE-79 | Низкая3,5 | — | 0,2 % | 2 дек. 2025 г. |
39Наблюдать | CVE-2025-60854Proof of concept | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below.dlink · r15 firmware · CWE-77 | Критическая9,8 | — | 1,2 % | 2 дек. 2025 г. |
39Наблюдать | CVE-2025-60736Proof of concept | code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.anisha · online medicine guide · CWE-89 | Критическая9,8 | — | 0,4 % | 2 дек. 2025 г. |
32Наблюдать | CVE-2025-66399Эксплойта нет | SNMP Command Injection leads to RCE in Cacticacti · cacti · CWE-77 | Высокая7,4 | — | 10,8 % | 2 дек. 2025 г. |
21Наблюдать | CVE-2025-12585Proof of concept | MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposuremxchat · mxchat – ai chatbot & content generation for wordpress · CWE-200 | Средняя5,3 | — | 0,3 % | 3 дек. 2025 г. |
60На этой неделе | CVE-2025-13486Готовый эксплойт | Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formhwk-fr · advanced custom fields: extended · CWE-94 | Критическая9,8 | — | 67,6 % | 3 дек. 2025 г. |
35Наблюдать | CVE-2025-12744Proof of concept | Abrt: command-injection in abrt leading to local privilege escalationred hat · red hat enterprise linux 6 · CWE-78 | Высокая8,8 | — | 0,6 % | 3 дек. 2025 г. |
29Наблюдать | CVE-2025-13947Proof of concept | Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-dropthe webkitgtk team · webkitgtk · CWE-346 | Высокая7,4 | — | 0,3 % | 3 дек. 2025 г. |
36Наблюдать | CVE-2025-57199Proof of concept | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iavtech · dgm1104 firmware · CWE-77 | Высокая8,8 | — | 3,3 % | 3 дек. 2025 г. |
40В плане | CVE-2025-57201Эксплойта нет | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iavtech · dgm1104 firmware · CWE-77 | Высокая8,8 | — | 17,1 % | 3 дек. 2025 г. |
30Наблюдать | CVE-2025-65320Proof of concept | Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory.abacre · restaurant point of sale · CWE-312 | Высокая7,5 | — | 0,2 % | 3 дек. 2025 г. |
43В плане | CVE-2024-32641Эксплойта нет | Masa CMS Vulnerable to Pre-Auth RCE via JSON APImasacms · masacms · CWE-94 | Критическая9,8 | — | 12,2 % | 3 дек. 2025 г. |
21Наблюдать | CVE-2025-20384Proof of concept | Unauthenticated Log Injection in Splunk Enterprisesplunk · splunk · CWE-117 | Средняя5,3 | — | 0,3 % | 3 дек. 2025 г. |
40В плане | CVE-2025-13342Proof of concept | Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Updateshabti · frontend admin by dynamiapps · CWE-862 | Критическая9,8 | — | 2,1 % | 3 дек. 2025 г. |
40В плане | CVE-2025-13390Proof of concept | WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeoverwpdirectorykit · wp directory kit · CWE-303 | Критическая9,8 | — | 4,5 % | 3 дек. 2025 г. |
25Наблюдать | CVE-2025-13401Proof of concept | Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scriptingoptimizingmatters · autoptimize · CWE-79 | Средняя6,4 | — | 0,2 % | 3 дек. 2025 г. |
33Наблюдать | CVE-2025-50360Proof of concept | A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.dannyvankooten · pepper · CWE-122 | Высокая8,4 | — | 0,2 % | 3 дек. 2025 г. |
100Срочно | CVE-2025-55182Готовый эксплойт | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclufacebook · react · CWE-502 | Критическая10,0 | KEV | 99,8 % | 3 дек. 2025 г. |
20Наблюдать | CVE-2025-50361Proof of concept | Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fesmallbasic · smallbasic · CWE-120 | Средняя5,1 | — | 0,2 % | 3 дек. 2025 г. |
30Наблюдать | CVE-2025-65027Proof of concept | RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeoverromm.app · romm · CWE-79 | Высокая7,6 | — | 0,3 % | 3 дек. 2025 г. |
26Наблюдать | CVE-2025-65345Proof of concept | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.alexusmai · laravel file manager · CWE-22 | Средняя6,5 | — | 0,5 % | 3 дек. 2025 г. |
36Наблюдать | CVE-2025-65346Proof of concept | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.alexusmai · laravel file manager · CWE-22 | Критическая9,1 | — | 0,9 % | 4 дек. 2025 г. |
26Наблюдать | CVE-2025-61148Proof of concept | An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to accessedupluscampus · edupluscampus · CWE-639 | Средняя6,5 | — | 0,3 % | 4 дек. 2025 г. |
66На этой неделе | CVE-2025-66516Готовый эксплойт | Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affectedapache · tika · CWE-611 | Критическая9,8 | — | 88,9 % | 4 дек. 2025 г. |
30Наблюдать | CVE-2025-65637Proof of concept | A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64turbopuffer · logrus · CWE-400 | Высокая7,5 | — | 0,6 % | 4 дек. 2025 г. |
24Наблюдать | CVE-2025-63499Proof of concept | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.alinto · sogo · CWE-79 | Средняя6,1 | — | 0,2 % | 4 дек. 2025 г. |
25Наблюдать | CVE-2025-1910Proof of concept | WatchGuard Mobile VPN with SSL Local Privilege Escalation via Update Packagewatchguard · mobile vpn with ssl client · CWE-77 | Средняя6,3 | — | 0,2 % | 4 дек. 2025 г. |
21Наблюдать | CVE-2025-65899Proof of concept | Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism.difuse · kalmia · CWE-204 | Средняя5,3 | — | 0,3 % | 4 дек. 2025 г. |
26Наблюдать | CVE-2025-65900Proof of concept | Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint.difuse · kalmia · CWE-863 | Средняя6,5 | — | 0,3 % | 4 дек. 2025 г. |
30Наблюдать | CVE-2025-65945Proof of concept | auth0/node-jws improper HMAC signature verification vulnerabilityauth0 · node-jws · CWE-347 | Высокая7,5 | — | 0,2 % | 4 дек. 2025 г. |
34Наблюдать | CVE-2025-12097Proof of concept | Relative Path Traversal Vulnerability in NI System Web Serverni · labview · CWE-23 | Высокая8,7 | — | 0,6 % | 4 дек. 2025 г. |
35Наблюдать | CVE-2025-13543Proof of concept | PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Uploadrtowebsites · postgallery · CWE-434 | Высокая8,8 | — | 0,7 % | 4 дек. 2025 г. |
25Наблюдать | CVE-2025-12163Proof of concept | Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scriptingomnipressteam · omnipress · CWE-79 | Средняя6,4 | — | 0,3 % | 5 дек. 2025 г. |
35Наблюдать | CVE-2025-12189Proof of concept | Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Uplbreadbutter · bread & butter · CWE-352 | Высокая8,8 | — | 0,3 % | 5 дек. 2025 г. |
21Наблюдать | CVE-2025-13528Proof of concept | Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameternedwp · feedback modal for website · CWE-862 | Средняя5,3 | — | 0,8 % | 5 дек. 2025 г. |
33Наблюдать | CVE-2025-58098Proof of concept | Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...apache · http server · CWE-201 | Высокая8,3 | — | 1,4 % | 5 дек. 2025 г. |
70На этой неделе | CVE-2025-66644Готовый эксплойт | Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.arraynetworks · arrayos ag · CWE-78 | Критическая9,8 | KEV | 3,4 % | 5 дек. 2025 г. |
13Наблюдать | CVE-2025-14092Эксплойта нет | Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injectionedimax · br-6478ac v3 firmware · CWE-77 | Низкая2,0 | — | 16,9 % | 5 дек. 2025 г. |
14Наблюдать | CVE-2025-14093Эксплойта нет | Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injectionedimax · br-6478ac v3 firmware · CWE-77 | Низкая2,0 | — | 19,5 % | 5 дек. 2025 г. |
14Наблюдать | CVE-2025-14094Эксплойта нет | Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injectionedimax · br-6478ac v3 firmware · CWE-77 | Низкая2,0 | — | 20,3 % | 5 дек. 2025 г. |
33Наблюдать | CVE-2025-14106Эксплойта нет | ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injectionzspace · q2c nas firmware · CWE-74 | Высокая7,4 | — | 12,0 % | 5 дек. 2025 г. |
33Наблюдать | CVE-2025-14107Эксплойта нет | ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injectionzspace · q2c nas firmware · CWE-74 | Высокая7,4 | — | 12,2 % | 5 дек. 2025 г. |
32Наблюдать | CVE-2025-14108Эксплойта нет | ZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injectionzspace · q2c nas firmware · CWE-74 | Высокая7,4 | — | 10,4 % | 5 дек. 2025 г. |
95Срочно | CVE-2025-34291Готовый эксплойт | Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCElangflow · langflow · CWE-346 | Критическая9,4 | KEV | 92,8 % | 5 дек. 2025 г. |
39Наблюдать | CVE-2025-12673Proof of concept | Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Uploadajitdas · flex qr code generator · CWE-434 | Критическая9,8 | — | 0,7 % | 6 дек. 2025 г. |
21Наблюдать | CVE-2025-12720Proof of concept | g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletiongaridium · g-ffl cockpit · CWE-285 | Средняя5,3 | — | 0,2 % | 6 дек. 2025 г. |
21Наблюдать | CVE-2025-12721Proof of concept | g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposuregaridium · g-ffl cockpit · CWE-862 | Средняя5,3 | — | 0,2 % | 6 дек. 2025 г. |
39Наблюдать | CVE-2025-13065Эксплойта нет | Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypassbrainstormforce · starter templates – ai-powered templates for elementor & gutenberg · CWE-434 | Высокая8,8 | — | 13,5 % | 6 дек. 2025 г. |
31Наблюдать | CVE-2025-40271Proof of concept | fs/proc: fix uaf in proc_readdir_de()linux · linux | Высокая7,8 | — | 0,4 % | 6 дек. 2025 г. |
8Наблюдать | CVE-2025-14221Proof of concept | SourceCodester Online Banking System page cross site scriptingoretnom23 · banking system · CWE-79 | Низкая2,0 | — | 0,2 % | 8 дек. 2025 г. |
61На этой неделе | CVE-2025-48572Готовый эксплойт | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.google · android · CWE-306 | Высокая7,8 | KEV | 0,2 % | 8 дек. 2025 г. |
52В плане | CVE-2025-48633Готовый эксплойт | In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic google · android | Средняя5,5 | KEV | 0,2 % | 8 дек. 2025 г. |
35Наблюдать | CVE-2025-65271Proof of concept | Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the cazuriom · azuriom · CWE-94 | Высокая8,8 | — | 0,4 % | 8 дек. 2025 г. |
37Наблюдать | CVE-2025-65964Proof of concept | n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hookn8n · n8n · CWE-829 | Критическая9,4 | — | 0,6 % | 9 дек. 2025 г. |
25Наблюдать | CVE-2025-66204Proof of concept | WBCE CMS allows brute-force protection bypass using X-Forwarded-For headerwbce · wbce cms · CWE-307 | Средняя6,3 | — | 0,4 % | 9 дек. 2025 г. |
24Наблюдать | CVE-2025-66470Proof of concept | NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentzauberzeug · nicegui · CWE-79 | Средняя6,1 | — | 0,2 % | 9 дек. 2025 г. |
89Срочно | CVE-2025-59718Готовый эксплойт | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Fortifortinet · fortiproxy · CWE-347 | Критическая9,8 | KEV | 68,2 % | 9 дек. 2025 г. |
48В плане | CVE-2025-59719Эксплойта нет | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 tfortinet · fortiweb · CWE-347 | Критическая9,8 | — | 29,2 % | 9 дек. 2025 г. |
62На этой неделе | CVE-2025-62221Готовый эксплойт | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-416 | Высокая7,8 | KEV | 2,5 % | 9 дек. 2025 г. |
32Наблюдать | CVE-2025-62454Proof of concept | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-122 | Высокая7,8 | — | 2,2 % | 9 дек. 2025 г. |
21Наблюдать | CVE-2025-65300Proof of concept | A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Setcoohom · coohom · CWE-79 | Средняя5,4 | — | 0,1 % | 9 дек. 2025 г. |
39Наблюдать | CVE-2025-65741Proof of concept | Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection.sublimetext · sublime text 3 · CWE-427 | Критическая9,8 | — | 0,5 % | 9 дек. 2025 г. |
34Наблюдать | CVE-2025-10573Эксплойта нет | Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptivanti · endpoint manager · CWE-79 | Средняя6,1 | — | 33,4 % | 9 дек. 2025 г. |
39Наблюдать | CVE-2025-14321Proof of concept | Use-after-free in the WebRTC: Signaling componentmozilla · firefox · CWE-416 | Критическая9,8 | — | 0,5 % | 9 дек. 2025 г. |
29Наблюдать | CVE-2025-14325Proof of concept | JIT miscompilation in the JavaScript Engine: JIT componentmozilla · firefox · CWE-843 | Высокая7,3 | — | 0,3 % | 9 дек. 2025 г. |
18Наблюдать | CVE-2025-67586Proof of concept | WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerabilityronald huereca · highlight and share · CWE-862 | Средняя4,7 | — | 0,4 % | 9 дек. 2025 г. |
17Наблюдать | CVE-2025-67588Эксплойта нет | WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerabilityelementor · elementor website builder · CWE-862 | Средняя4,3 | — | 0,1 % | 9 дек. 2025 г. |
21Наблюдать | CVE-2025-34401Эксплойта нет | MailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspxmailenable · mailenable · CWE-79 | Средняя5,3 | — | 0,3 % | 9 дек. 2025 г. |
32Наблюдать | CVE-2025-53679Эксплойта нет | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinfortinet · fortisandbox · CWE-78 | Высокая7,2 | — | 12,2 % | 9 дек. 2025 г. |
40В плане | CVE-2025-53949Эксплойта нет | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinfortinet · fortisandbox · CWE-78 | Высокая8,8 | — | 17,1 % | 9 дек. 2025 г. |
32Наблюдать | CVE-2025-54100Proof of concept | PowerShell Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-77 | Высокая7,8 | — | 2,2 % | 9 дек. 2025 г. |
31Наблюдать | CVE-2025-62470Proof of concept | Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 | Высокая7,8 | — | 0,5 % | 9 дек. 2025 г. |
60На этой неделе | CVE-2025-66039Готовый эксплойт | FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Headersangoma · freepbx · CWE-287 | Критическая9,3 | — | 3,2 % | 9 дек. 2025 г. |
39Наблюдать | CVE-2025-61808Эксплойта нет | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)adobe · coldfusion · CWE-434 | Критическая9,1 | — | 10,5 % | 9 дек. 2025 г. |
30Наблюдать | CVE-2025-66645Proof of concept | NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Readingzauberzeug · nicegui · CWE-22 | Высокая7,5 | — | 1,1 % | 9 дек. 2025 г. |
34Наблюдать | CVE-2025-67494Proof of concept | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Loginzitadel · zitadel · CWE-918 | Высокая8,6 | — | 0,4 % | 9 дек. 2025 г. |
31Наблюдать | CVE-2025-13339Proof of concept | Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Readhippooo · hippoo mobile app for woocommerce · CWE-22 | Высокая7,5 | — | 2,2 % | 10 дек. 2025 г. |
42В плане | CVE-2025-13184Эксплойта нет | Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank passwordtotolink · x5000r firmware · CWE-863 | Критическая9,8 | — | 11,2 % | 10 дек. 2025 г. |
90Срочно | CVE-2025-8110Готовый эксплойт | File overwrite in file update API in Gogsgogs · gogs · CWE-22 | Высокая8,7 | KEV | 85,2 % | 10 дек. 2025 г. |
24Наблюдать | CVE-2025-65754Proof of concept | Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filalgernon project · algernon · CWE-79 | Средняя6,1 | — | 0,4 % | 10 дек. 2025 г. |
30Наблюдать | CVE-2025-63895Proof of concept | An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (jxlindia · jxl 9 inch car android double din player firmware · CWE-404 | Высокая7,5 | — | 0,3 % | 10 дек. 2025 г. |
47В плане | CVE-2025-34392Эксплойта нет | Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCEbarracuda · rmm · CWE-36 | Критическая10,0 | — | 24,7 % | 10 дек. 2025 г. |
27Наблюдать | CVE-2020-36884Proof of concept | BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRFbrightsign, llc · brightsign digital signage diagnostic web server · CWE-918 | Средняя6,9 | — | 1,1 % | 10 дек. 2025 г. |
37Наблюдать | CVE-2025-65950Proof of concept | WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameterwbce · wbce cms · CWE-89 | Критическая9,4 | — | 0,5 % | 10 дек. 2025 г. |
26Наблюдать | CVE-2025-66472Proof of concept | XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationxwiki · xwiki · CWE-79 | Средняя6,5 | — | 0,5 % | 10 дек. 2025 г. |
30Наблюдать | CVE-2025-66628Proof of concept | ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)imagemagick · imagemagick · CWE-125 | Высокая7,5 | — | 0,5 % | 10 дек. 2025 г. |
39Наблюдать | CVE-2025-67511Proof of concept | Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolaliasrobotics · cybersecurity ai · CWE-77 | Критическая9,6 | — | 2,0 % | 11 дек. 2025 г. |
32Наблюдать | CVE-2025-67644Proof of concept | LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodlangchain · langgraph-checkpoint-sqlite · CWE-89 | Высокая7,8 | — | 2,3 % | 11 дек. 2025 г. |
23Наблюдать | CVE-2025-14528Proof of concept | D-Link DIR-803 Configuration getcfg.php information disclosuredlink · dir-803 firmware · CWE-200 | Средняя5,5 | — | 3,9 % | 11 дек. 2025 г. |
- CVE-2025-137968Наблюдать
deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery
НизкаяCVSS 2,1Proof of conceptEPSS 0 %deco-cx · apps1 дек. 2025 г.
- CVE-2025-804516Наблюдать
Mali GPU Kernel Driver allows improper GPU processing operations
СредняяCVSS 4,0Proof of conceptEPSS 0 %arm · 5th gen gpu architecture kernel driver1 дек. 2025 г.
- CVE-2025-350039Наблюдать
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
КритическаяCVSS 9,8Proof of conceptEPSS 0 %avast · antivirus1 дек. 2025 г.
- CVE-2025-5748932Наблюдать
Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to t
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %shirt-pocket · superduper\!1 дек. 2025 г.
- CVE-2025-6122831Наблюдать
An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %shirt-pocket · superduper\!1 дек. 2025 г.
- CVE-2025-6122931Наблюдать
An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %shirt-pocket · superduper\!1 дек. 2025 г.
- CVE-2025-5168340В плане
A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a cr
КритическаяCVSS 9,8Proof of conceptEPSS 2 %mjobtime · mjobtime1 дек. 2025 г.
- CVE-2025-5574934Наблюдать
The XWiki Jetty package (XJetty) allows accessing any application file through URL
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %xwiki · xwiki1 дек. 2025 г.
- CVE-2025-6629440В плане
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
ВысокаяCVSS 8,7Готовый эксплойтEPSS 2 %getgrav · grav1 дек. 2025 г.
- CVE-2025-6630140В плане
Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
ВысокаяCVSS 8,6Готовый эксплойтEPSS 1 %getgrav · grav1 дек. 2025 г.
- CVE-2025-5804422Наблюдать
JumpServer has an Open Redirect Vulnerability
СредняяCVSS 5,5Proof of conceptEPSS 0 %fit2cloud · jumpserver1 дек. 2025 г.
- CVE-2025-6585814Наблюдать
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'
НизкаяCVSS 3,5Proof of conceptEPSS 0 %janeczku · calibre-web2 дек. 2025 г.
- CVE-2025-6085439Наблюдать
A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %dlink · r15 firmware2 дек. 2025 г.
- CVE-2025-6073639Наблюдать
code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %anisha · online medicine guide2 дек. 2025 г.
- CVE-2025-6639932Наблюдать
SNMP Command Injection leads to RCE in Cacti
ВысокаяCVSS 7,4Эксплойта нетEPSS 10 %cacti · cacti2 дек. 2025 г.
- CVE-2025-1258521Наблюдать
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
СредняяCVSS 5,3Proof of conceptEPSS 0 %mxchat · mxchat – ai chatbot & content generation for wordpress3 дек. 2025 г.
- CVE-2025-1348660На этой неделе
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
КритическаяCVSS 9,8Готовый эксплойтEPSS 67 %hwk-fr · advanced custom fields: extended3 дек. 2025 г.
- CVE-2025-1274435Наблюдать
Abrt: command-injection in abrt leading to local privilege escalation
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %red hat · red hat enterprise linux 63 дек. 2025 г.
- CVE-2025-1394729Наблюдать
Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop
ВысокаяCVSS 7,4Proof of conceptEPSS 0 %the webkitgtk team · webkitgtk3 дек. 2025 г.
- CVE-2025-5719936Наблюдать
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i
ВысокаяCVSS 8,8Proof of conceptEPSS 3 %avtech · dgm1104 firmware3 дек. 2025 г.
- CVE-2025-5720140В плане
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i
ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %avtech · dgm1104 firmware3 дек. 2025 г.
- CVE-2025-6532030Наблюдать
Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %abacre · restaurant point of sale3 дек. 2025 г.
- CVE-2024-3264143В плане
Masa CMS Vulnerable to Pre-Auth RCE via JSON API
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %masacms · masacms3 дек. 2025 г.
- CVE-2025-2038421Наблюдать
Unauthenticated Log Injection in Splunk Enterprise
СредняяCVSS 5,3Proof of conceptEPSS 0 %splunk · splunk3 дек. 2025 г.
- CVE-2025-1334240В плане
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
КритическаяCVSS 9,8Proof of conceptEPSS 2 %shabti · frontend admin by dynamiapps3 дек. 2025 г.
- CVE-2025-1339040В плане
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
КритическаяCVSS 9,8Proof of conceptEPSS 4 %wpdirectorykit · wp directory kit3 дек. 2025 г.
- CVE-2025-1340125Наблюдать
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
СредняяCVSS 6,4Proof of conceptEPSS 0 %optimizingmatters · autoptimize3 дек. 2025 г.
- CVE-2025-5036033Наблюдать
A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %dannyvankooten · pepper3 дек. 2025 г.
- CVE-2025-55182100Срочно
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 99 %facebook · react3 дек. 2025 г.
- CVE-2025-5036120Наблюдать
Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe
СредняяCVSS 5,1Proof of conceptEPSS 0 %smallbasic · smallbasic3 дек. 2025 г.
- CVE-2025-6502730Наблюдать
RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %romm.app · romm3 дек. 2025 г.
- CVE-2025-6534526Наблюдать
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.
СредняяCVSS 6,5Proof of conceptEPSS 0 %alexusmai · laravel file manager3 дек. 2025 г.
- CVE-2025-6534636Наблюдать
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.
КритическаяCVSS 9,1Proof of conceptEPSS 0 %alexusmai · laravel file manager4 дек. 2025 г.
- CVE-2025-6114826Наблюдать
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access
СредняяCVSS 6,5Proof of conceptEPSS 0 %edupluscampus · edupluscampus4 дек. 2025 г.
- CVE-2025-6651666На этой неделе
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
КритическаяCVSS 9,8Готовый эксплойтEPSS 88 %apache · tika4 дек. 2025 г.
- CVE-2025-6563730Наблюдать
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %turbopuffer · logrus4 дек. 2025 г.
- CVE-2025-6349924Наблюдать
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
СредняяCVSS 6,1Proof of conceptEPSS 0 %alinto · sogo4 дек. 2025 г.
- CVE-2025-191025Наблюдать
WatchGuard Mobile VPN with SSL Local Privilege Escalation via Update Package
СредняяCVSS 6,3Proof of conceptEPSS 0 %watchguard · mobile vpn with ssl client4 дек. 2025 г.
- CVE-2025-6589921Наблюдать
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism.
СредняяCVSS 5,3Proof of conceptEPSS 0 %difuse · kalmia4 дек. 2025 г.
- CVE-2025-6590026Наблюдать
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint.
СредняяCVSS 6,5Proof of conceptEPSS 0 %difuse · kalmia4 дек. 2025 г.
- CVE-2025-6594530Наблюдать
auth0/node-jws improper HMAC signature verification vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %auth0 · node-jws4 дек. 2025 г.
- CVE-2025-1209734Наблюдать
Relative Path Traversal Vulnerability in NI System Web Server
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %ni · labview4 дек. 2025 г.
- CVE-2025-1354335Наблюдать
PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %rtowebsites · postgallery4 дек. 2025 г.
- CVE-2025-1216325Наблюдать
Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting
СредняяCVSS 6,4Proof of conceptEPSS 0 %omnipressteam · omnipress5 дек. 2025 г.
- CVE-2025-1218935Наблюдать
Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upl
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %breadbutter · bread & butter5 дек. 2025 г.
- CVE-2025-1352821Наблюдать
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
СредняяCVSS 5,3Proof of conceptEPSS 0 %nedwp · feedback modal for website5 дек. 2025 г.
- CVE-2025-5809833Наблюдать
Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
ВысокаяCVSS 8,3Proof of conceptEPSS 1 %apache · http server5 дек. 2025 г.
- CVE-2025-6664470На этой неделе
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 3 %arraynetworks · arrayos ag5 дек. 2025 г.
- CVE-2025-1409213Наблюдать
Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 16 %edimax · br-6478ac v3 firmware5 дек. 2025 г.
- CVE-2025-1409314Наблюдать
Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 19 %edimax · br-6478ac v3 firmware5 дек. 2025 г.
- CVE-2025-1409414Наблюдать
Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 20 %edimax · br-6478ac v3 firmware5 дек. 2025 г.
- CVE-2025-1410633Наблюдать
ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection
ВысокаяCVSS 7,4Эксплойта нетEPSS 12 %zspace · q2c nas firmware5 дек. 2025 г.
- CVE-2025-1410733Наблюдать
ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection
ВысокаяCVSS 7,4Эксплойта нетEPSS 12 %zspace · q2c nas firmware5 дек. 2025 г.
- CVE-2025-1410832Наблюдать
ZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injection
ВысокаяCVSS 7,4Эксплойта нетEPSS 10 %zspace · q2c nas firmware5 дек. 2025 г.
- CVE-2025-3429195Срочно
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
КритическаяCVSS 9,4KEVГотовый эксплойтEPSS 92 %langflow · langflow5 дек. 2025 г.
- CVE-2025-1267339Наблюдать
Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 0 %ajitdas · flex qr code generator6 дек. 2025 г.
- CVE-2025-1272021Наблюдать
g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion
СредняяCVSS 5,3Proof of conceptEPSS 0 %garidium · g-ffl cockpit6 дек. 2025 г.
- CVE-2025-1272121Наблюдать
g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure
СредняяCVSS 5,3Proof of conceptEPSS 0 %garidium · g-ffl cockpit6 дек. 2025 г.
- CVE-2025-1306539Наблюдать
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %brainstormforce · starter templates – ai-powered templates for elementor & gutenberg6 дек. 2025 г.
- CVE-2025-4027131Наблюдать
fs/proc: fix uaf in proc_readdir_de()
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux6 дек. 2025 г.
- CVE-2025-142218Наблюдать
SourceCodester Online Banking System page cross site scripting
НизкаяCVSS 2,0Proof of conceptEPSS 0 %oretnom23 · banking system8 дек. 2025 г.
- CVE-2025-4857261На этой неделе
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %google · android8 дек. 2025 г.
- CVE-2025-4863352В плане
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 0 %google · android8 дек. 2025 г.
- CVE-2025-6527135Наблюдать
Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the c
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %azuriom · azuriom8 дек. 2025 г.
- CVE-2025-6596437Наблюдать
n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
КритическаяCVSS 9,4Proof of conceptEPSS 0 %n8n · n8n9 дек. 2025 г.
- CVE-2025-6620425Наблюдать
WBCE CMS allows brute-force protection bypass using X-Forwarded-For header
СредняяCVSS 6,3Proof of conceptEPSS 0 %wbce · wbce cms9 дек. 2025 г.
- CVE-2025-6647024Наблюдать
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
СредняяCVSS 6,1Proof of conceptEPSS 0 %zauberzeug · nicegui9 дек. 2025 г.
- CVE-2025-5971889Срочно
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 68 %fortinet · fortiproxy9 дек. 2025 г.
- CVE-2025-5971948В плане
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t
КритическаяCVSS 9,8Эксплойта нетEPSS 29 %fortinet · fortiweb9 дек. 2025 г.
- CVE-2025-6222162На этой неделе
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 2 %microsoft · windows 10 18099 дек. 2025 г.
- CVE-2025-6245432Наблюдать
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 2 %microsoft · windows 10 18099 дек. 2025 г.
- CVE-2025-6530021Наблюдать
A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Set
СредняяCVSS 5,4Proof of conceptEPSS 0 %coohom · coohom9 дек. 2025 г.
- CVE-2025-6574139Наблюдать
Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %sublimetext · sublime text 39 дек. 2025 г.
- CVE-2025-1057334Наблюдать
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript
СредняяCVSS 6,1Эксплойта нетEPSS 33 %ivanti · endpoint manager9 дек. 2025 г.
- CVE-2025-1432139Наблюдать
Use-after-free in the WebRTC: Signaling component
КритическаяCVSS 9,8Proof of conceptEPSS 0 %mozilla · firefox9 дек. 2025 г.
- CVE-2025-1432529Наблюдать
JIT miscompilation in the JavaScript Engine: JIT component
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %mozilla · firefox9 дек. 2025 г.
- CVE-2025-6758618Наблюдать
WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability
СредняяCVSS 4,7Proof of conceptEPSS 0 %ronald huereca · highlight and share9 дек. 2025 г.
- CVE-2025-6758817Наблюдать
WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability
СредняяCVSS 4,3Эксплойта нетEPSS 0 %elementor · elementor website builder9 дек. 2025 г.
- CVE-2025-3440121Наблюдать
MailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspx
СредняяCVSS 5,3Эксплойта нетEPSS 0 %mailenable · mailenable9 дек. 2025 г.
- CVE-2025-5367932Наблюдать
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin
ВысокаяCVSS 7,2Эксплойта нетEPSS 12 %fortinet · fortisandbox9 дек. 2025 г.
- CVE-2025-5394940В плане
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin
ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %fortinet · fortisandbox9 дек. 2025 г.
- CVE-2025-5410032Наблюдать
PowerShell Remote Code Execution Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 2 %microsoft · windows 10 16079 дек. 2025 г.
- CVE-2025-6247031Наблюдать
Windows Common Log File System Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %microsoft · windows 10 16079 дек. 2025 г.
- CVE-2025-6603960На этой неделе
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
КритическаяCVSS 9,3Готовый эксплойтEPSS 3 %sangoma · freepbx9 дек. 2025 г.
- CVE-2025-6180839Наблюдать
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
КритическаяCVSS 9,1Эксплойта нетEPSS 10 %adobe · coldfusion9 дек. 2025 г.
- CVE-2025-6664530Наблюдать
NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %zauberzeug · nicegui9 дек. 2025 г.
- CVE-2025-6749434Наблюдать
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %zitadel · zitadel9 дек. 2025 г.
- CVE-2025-1333931Наблюдать
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %hippooo · hippoo mobile app for woocommerce10 дек. 2025 г.
- CVE-2025-1318442В плане
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %totolink · x5000r firmware10 дек. 2025 г.
- CVE-2025-811090Срочно
File overwrite in file update API in Gogs
ВысокаяCVSS 8,7KEVГотовый эксплойтEPSS 85 %gogs · gogs10 дек. 2025 г.
- CVE-2025-6575424Наблюдать
Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a fil
СредняяCVSS 6,1Proof of conceptEPSS 0 %algernon project · algernon10 дек. 2025 г.
- CVE-2025-6389530Наблюдать
An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %jxlindia · jxl 9 inch car android double din player firmware10 дек. 2025 г.
- CVE-2025-3439247В плане
Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE
КритическаяCVSS 10,0Эксплойта нетEPSS 24 %barracuda · rmm10 дек. 2025 г.
- CVE-2020-3688427Наблюдать
BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF
СредняяCVSS 6,9Proof of conceptEPSS 1 %brightsign, llc · brightsign digital signage diagnostic web server10 дек. 2025 г.
- CVE-2025-6595037Наблюдать
WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter
КритическаяCVSS 9,4Proof of conceptEPSS 0 %wbce · wbce cms10 дек. 2025 г.
- CVE-2025-6647226Наблюдать
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
СредняяCVSS 6,5Proof of conceptEPSS 0 %xwiki · xwiki10 дек. 2025 г.
- CVE-2025-6662830Наблюдать
ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %imagemagick · imagemagick10 дек. 2025 г.
- CVE-2025-6751139Наблюдать
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
КритическаяCVSS 9,6Proof of conceptEPSS 2 %aliasrobotics · cybersecurity ai11 дек. 2025 г.
- CVE-2025-6764432Наблюдать
LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method
ВысокаяCVSS 7,8Proof of conceptEPSS 2 %langchain · langgraph-checkpoint-sqlite11 дек. 2025 г.
- CVE-2025-1452823Наблюдать
D-Link DIR-803 Configuration getcfg.php information disclosure
СредняяCVSS 5,5Proof of conceptEPSS 3 %dlink · dir-803 firmware11 дек. 2025 г.