По дате публикации
Эксплуатируемые и новые серьёзные CVE: декабрь 2025 г.
217 записей · 23 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
35Наблюдать | CVE-2025-13780Proof of concept | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)pgadmin · pgadmin 4 · CWE-94 | Высокая8,8 | — | 0,9 % | 11 дек. 2025 г. |
40В плане | CVE-2025-55183Proof of concept | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.vercel · next.js · CWE-502 | Средняя5,3 | — | 64,2 % | 11 дек. 2025 г. |
50В плане | CVE-2025-55184Proof of concept | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.facebook · react · CWE-502 | Высокая7,5 | — | 66,8 % | 11 дек. 2025 г. |
24Наблюдать | CVE-2025-55816Proof of concept | HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.digitaldruid · hoteldruid · CWE-79 | Средняя6,1 | — | 0,2 % | 11 дек. 2025 г. |
60На этой неделе | CVE-2024-58286Готовый эксплойт | dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Pathvexorian · dizquetv · CWE-78 | Критическая9,3 | — | 1,3 % | 11 дек. 2025 г. |
37Наблюдать | CVE-2024-58290Proof of concept | Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpointelements · xhibiter nft marketplace · CWE-89 | Критическая9,3 | — | 0,3 % | 11 дек. 2025 г. |
16Наблюдать | CVE-2025-67780Proof of concept | SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRspacex · starlink dish · CWE-306 | Средняя4,2 | — | 0,1 % | 11 дек. 2025 г. |
36Наблюдать | CVE-2025-67779Эксплойта нет | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attacfacebook · react · CWE-502 | Высокая7,5 | — | 19,9 % | 12 дек. 2025 г. |
30Наблюдать | CVE-2025-67725Эксплойта нет | Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescingtornadoweb · tornado · CWE-400 | Высокая7,5 | — | 0,5 % | 12 дек. 2025 г. |
27Наблюдать | CVE-2025-67727Proof of concept | Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Managementparseplatform · parse-server · CWE-94 | Средняя6,9 | — | 0,4 % | 12 дек. 2025 г. |
20Наблюдать | CVE-2025-67730Proof of concept | Frappe authenticated users can execute XSS through form description fieldsfrappe · learning · CWE-79 | Средняя5,1 | — | 0,1 % | 12 дек. 2025 г. |
21Наблюдать | CVE-2025-12841Proof of concept | Bookit < 2.5.1 – Unauthenticated Settings Updateunknown · bookit · CWE-862 | Средняя5,3 | — | 0,7 % | 12 дек. 2025 г. |
37Наблюдать | CVE-2024-58299Proof of concept | PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Commandpcman · ftp server · CWE-121 | Критическая9,3 | — | 0,8 % | 12 дек. 2025 г. |
72На этой неделе | CVE-2025-14174Готовый эксплойт | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memogoogle · chrome · CWE-787 | Высокая8,8 | KEV | 22,3 % | 12 дек. 2025 г. |
74На этой неделе | CVE-2025-14611Готовый эксплойт | Gladinet CentreStack and TrioFox Hard Coded AES Keysgladinet · centrestack · CWE-798 | Высокая7,1 | KEV | 53,3 % | 12 дек. 2025 г. |
61На этой неделе | CVE-2025-43510Готовый эксплойт | A memory corruption issue was addressed with improved lock state checking.apple · ipados · CWE-667 | Высокая7,8 | KEV | 0,3 % | 12 дек. 2025 г. |
52В плане | CVE-2025-43520Готовый эксплойт | A memory corruption issue was addressed with improved memory handling.apple · ipados · CWE-120 | Средняя5,5 | KEV | 0,4 % | 12 дек. 2025 г. |
40В плане | CVE-2025-11693Proof of concept | Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log Filerecorp · export wordpress pages to static html & pdf — static site export · CWE-200 | Критическая9,8 | — | 2,0 % | 13 дек. 2025 г. |
39Наблюдать | CVE-2025-14440Proof of concept | JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookiejayarsiech · jay login & register · CWE-565 | Критическая9,8 | — | 0,7 % | 13 дек. 2025 г. |
30Наблюдать | CVE-2025-14659Proof of concept | D-Link DIR-860LB1/DIR-868LB1 DHCP command injectiondlink · dir-868l b1 firmware · CWE-74 | Высокая7,4 | — | 3,7 % | 14 дек. 2025 г. |
36Наблюдать | CVE-2025-67906Proof of concept | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.misp-project · misp · CWE-79 | Критическая9,0 | — | 0,3 % | 15 дек. 2025 г. |
26Наблюдать | CVE-2025-14704Эксплойта нет | Shiguangwu sgwbox N3 API eshell path traversalsgwbox · n3 firmware · CWE-22 | Средняя5,5 | — | 12,4 % | 15 дек. 2025 г. |
40В плане | CVE-2025-14705Эксплойта нет | Shiguangwu sgwbox N3 SHARESERVER Feature command injectionsgwbox · n3 firmware · CWE-74 | Высокая8,9 | — | 16,5 % | 15 дек. 2025 г. |
41В плане | CVE-2025-14706Эксплойта нет | Shiguangwu sgwbox N3 NETREBOOT http_eshell_server command injectionsgwbox · n3 firmware · CWE-74 | Высокая8,9 | — | 18,6 % | 15 дек. 2025 г. |
41В плане | CVE-2025-14707Эксплойта нет | Shiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injectionsgwbox · n3 firmware · CWE-74 | Высокая8,9 | — | 18,6 % | 15 дек. 2025 г. |
41В плане | CVE-2025-14156Proof of concept | Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'ays-pro · fox lms – wordpress lms plugin · CWE-20 | Критическая9,8 | — | 6,8 % | 15 дек. 2025 г. |
32Наблюдать | CVE-2025-65742Proof of concept | An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive innewgensoft · omnidocs · CWE-862 | Высокая8,2 | — | 0,2 % | 15 дек. 2025 г. |
21Наблюдать | CVE-2025-64634Эксплойта нет | WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerabilitytheme-fusion · avada · CWE-862 | Средняя5,3 | — | 0,2 % | 16 дек. 2025 г. |
34Наблюдать | CVE-2025-68055Proof of concept | WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerabilitythemefic · hydra booking · CWE-89 | Высокая8,5 | — | 0,3 % | 16 дек. 2025 г. |
21Наблюдать | CVE-2025-13956Proof of concept | LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposurethimpress · learnpress – wordpress lms plugin for create and sell online courses · CWE-862 | Средняя5,3 | — | 0,8 % | 16 дек. 2025 г. |
36Наблюдать | CVE-2025-65318Proof of concept | When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Webcanarymail · canary mail · CWE-693 | Критическая9,1 | — | 0,5 % | 16 дек. 2025 г. |
96Срочно | CVE-2025-37164Готовый эксплойт | A remote code execution issue exists in HPE OneView.hpe · oneview · CWE-94 | Критическая9,8 | KEV | 90,1 % | 16 дек. 2025 г. |
21Наблюдать | CVE-2025-68116Proof of concept | FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handlingfilerise · filerise · CWE-79 | Средняя5,4 | — | 0,2 % | 16 дек. 2025 г. |
36Наблюдать | CVE-2025-33210Proof of concept | NVIDIA Isaac Lab contains a deserialization vulnerability.nvidia · isaac lab · CWE-502 | Критическая9,0 | — | 0,6 % | 16 дек. 2025 г. |
39Наблюдать | CVE-2025-46295Proof of concept | Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input iclaris · filemaker server · CWE-94 | Критическая9,8 | — | 1,0 % | 16 дек. 2025 г. |
26Наблюдать | CVE-2025-65427Proof of concept | An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to dbitnet · dbit n300 t1 pro firmware · CWE-307 | Средняя6,5 | — | 0,2 % | 16 дек. 2025 г. |
36Наблюдать | CVE-2025-68154Эксплойта нет | Command Injection in fsSize() on Windowssysteminformation · systeminformation · CWE-78 | Высокая8,1 | — | 12,9 % | 16 дек. 2025 г. |
41В плане | CVE-2025-14700Proof of concept | Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controllercraftycontrol · crafty controller · CWE-1336 | Критическая9,9 | — | 6,5 % | 16 дек. 2025 г. |
36Наблюдать | CVE-2025-14765Proof of concept | Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a cragoogle · chrome · CWE-416 | Высокая8,8 | — | 2,9 % | 16 дек. 2025 г. |
67На этой неделе | CVE-2025-59374Готовый эксплойт | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced throasus · live update · CWE-506 | Критическая9,3 | KEV | 1,1 % | 17 дек. 2025 г. |
80Срочно | CVE-2025-20393Готовый эксплойт | Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerabilitycisco · asyncos · CWE-20 | Критическая10,0 | KEV | 32,3 % | 17 дек. 2025 г. |
60На этой неделе | CVE-2025-62521Готовый эксплойт | ChurchCRM has unauthenticated RCE in its Install Wizardchurchcrm · churchcrm · CWE-94 | Критическая9,8 | — | 4,5 % | 17 дек. 2025 г. |
60На этой неделе | CVE-2025-34441Готовый эксплойт | AVideo < 20.1 User Information Disclosure via Public APIwwbn · avideo · CWE-359 | Средняя6,9 | — | 0,8 % | 17 дек. 2025 г. |
60На этой неделе | CVE-2025-34442Готовый эксплойт | AVideo < 20.1 System Path Disclosure via Public APIwwbn · avideo · CWE-497 | Средняя6,9 | — | 0,8 % | 17 дек. 2025 г. |
26Наблюдать | CVE-2025-65855Proof of concept | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentianetun · helpflash iot firmware · CWE-319 | Средняя6,6 | — | 0,1 % | 17 дек. 2025 г. |
37Наблюдать | CVE-2025-67876Proof of concept | ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijackingchurchcrm · churchcrm · CWE-79 | Критическая9,3 | — | 0,1 % | 17 дек. 2025 г. |
37Наблюдать | CVE-2025-68400Proof of concept | ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.phpchurchcrm · churchcrm · CWE-89 | Критическая9,3 | — | 0,3 % | 17 дек. 2025 г. |
68На этой неделе | CVE-2025-43529Готовый эксплойт | A use-after-free issue was addressed with improved memory management.apple · safari · CWE-416 | Высокая8,8 | KEV | 8,7 % | 17 дек. 2025 г. |
27Наблюдать | CVE-2025-43541Proof of concept | A type confusion issue was addressed with improved state handling.apple · safari · CWE-843 | Средняя4,3 | — | 34,1 % | 17 дек. 2025 г. |
34Наблюдать | CVE-2025-67875Proof of concept | ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijackingchurchcrm · churchcrm · CWE-79 | Высокая8,5 | — | 0,1 % | 17 дек. 2025 г. |
40В плане | CVE-2025-68109Готовый эксплойт | ChurchCRM vulnerable to RCE with database restore functionalitychurchcrm · churchcrm · CWE-78 | Высокая7,2 | — | 1,5 % | 17 дек. 2025 г. |
32Наблюдать | CVE-2025-68147Proof of concept | opensourcepos has a Cross-site Scripting vulnerabilityopensourcepos · open source point of sale · CWE-79 | Высокая8,1 | — | 0,3 % | 17 дек. 2025 г. |
35Наблюдать | CVE-2025-68434Proof of concept | opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creationopensourcepos · open source point of sale · CWE-352 | Высокая8,8 | — | 0,2 % | 17 дек. 2025 г. |
62На этой неделе | CVE-2025-68461Готовый эксплойт | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG droundcube · webmail · CWE-79 | Средняя6,1 | KEV | 26,8 % | 18 дек. 2025 г. |
35Наблюдать | CVE-2025-14364Proof of concept | Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalationkraftplugins · demo importer plus · CWE-862 | Высокая8,8 | — | 0,3 % | 18 дек. 2025 г. |
57В плане | CVE-2025-40602Готовый эксплойт | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).sonicwall · sma6200 firmware · CWE-250 | Средняя6,6 | KEV | 2,7 % | 18 дек. 2025 г. |
31Наблюдать | CVE-2025-14437Proof of concept | Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log Filewpmudev · hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdn · CWE-532 | Высокая7,5 | — | 1,9 % | 18 дек. 2025 г. |
0Наблюдать | CVE-2025-68325Proof of concept | net/sched: sch_cake: Fix incorrect qlen reduction in cake_droplinux · linux | — | — | 0,1 % | 18 дек. 2025 г. |
32Наблюдать | CVE-2025-14884Эксплойта нет | D-Link DIR-605 Firmware Update Service command injectiondlink · dir-605 firmware · CWE-74 | Высокая7,3 | — | 10,9 % | 18 дек. 2025 г. |
39Наблюдать | CVE-2025-56157Эксплойта нет | Default credentials in Dify thru 1.5.1.langgenius · dify · CWE-798 | Критическая9,8 | — | 0,8 % | 18 дек. 2025 г. |
39Наблюдать | CVE-2025-63387Proof of concept | Dify v1.9.1 is vulnerable to Insecure Permissions.langgenius · dify · CWE-284 | Высокая7,5 | — | 29,9 % | 18 дек. 2025 г. |
75На этой неделе | CVE-2025-14733Готовый эксплойт | WatchGuard Firebox iked Out of Bounds Write Vulnerabilitywatchguard · fireware · CWE-787 | Критическая9,3 | KEV | 26,5 % | 18 дек. 2025 г. |
89Срочно | CVE-2025-14847Готовый эксплойт | Zlib compressed protocol header length confusion may allow memory readmongodb · mongodb · CWE-130 | Высокая8,7 | KEV | 83,2 % | 19 дек. 2025 г. |
60На этой неделе | CVE-2025-34433Готовый эксплойт | AVideo < 20.1 Unauthenticated RCE via Predictable Installation Saltworld wide broadcast network · avideo · CWE-94 | Критическая9,3 | — | 1,4 % | 19 дек. 2025 г. |
95Срочно | CVE-2025-68613Готовый эксплойт | n8n Vulnerable to Remote Code Execution via Expression Injectionn8n · n8n · CWE-913 | Высокая8,8 | KEV | 98,9 % | 19 дек. 2025 г. |
21Наблюдать | CVE-2023-25445Эксплойта нет | WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerabilityhappyfiles · happyfiles pro · CWE-862 | Средняя5,4 | — | 0,2 % | 20 дек. 2025 г. |
28Наблюдать | CVE-2025-14855Proof of concept | SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scriptingbrainstormforce · sureforms – contact form, payment form & other custom form builder · CWE-79 | Высокая7,2 | — | 0,3 % | 21 дек. 2025 г. |
29Наблюдать | CVE-2025-14018Proof of concept | Unquoted Service Path in NetBT Consultancy's e-Faturanetbt consulting services inc. · e-fatura · CWE-428 | Высокая7,3 | — | 0,4 % | 22 дек. 2025 г. |
24Наблюдать | CVE-2025-65270Proof of concept | Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute clincapture · captivate electronic data capture · CWE-79 | Средняя6,1 | — | 0,2 % | 22 дек. 2025 г. |
80Срочно | CVE-2025-68645Готовый эксплойт | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper synacor · zimbra collaboration suite · CWE-98 | Высокая8,8 | KEV | 48,8 % | 22 дек. 2025 г. |
24Наблюдать | CVE-2025-65790Proof of concept | A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface.realtimelogic · fuguhub · CWE-79 | Средняя6,1 | — | 0,2 % | 22 дек. 2025 г. |
35Наблюдать | CVE-2025-65817Proof of concept | LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.lsc · smart connect indoor ip camera firmware · CWE-94 | Высокая8,8 | — | 0,3 % | 22 дек. 2025 г. |
39Наблюдать | CVE-2025-65856Proof of concept | Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthentixiongmaitech · xm530v200 x6-weq 8m firmware · CWE-306 | Критическая9,8 | — | 0,7 % | 22 дек. 2025 г. |
30Наблюдать | CVE-2025-65857Proof of concept | An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.xiongmaitech · xm530v200 x6-weq 8m firmware · CWE-359 | Высокая7,5 | — | 0,4 % | 22 дек. 2025 г. |
52В плане | CVE-2025-68615Эксплойта нет | Net-SNMP snmptrapd crashnet-snmp · net-snmp · CWE-119 | Критическая9,8 | — | 42,3 % | 23 дек. 2025 г. |
21Наблюдать | CVE-2025-14155Proof of concept | Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'leap13 · premium addons for elementor · CWE-862 | Средняя5,3 | — | 0,7 % | 23 дек. 2025 г. |
35Наблюдать | CVE-2025-59886Proof of concept | Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access teaton · xcomfort ethernet communication interface · CWE-20 | Высокая8,8 | — | 0,3 % | 23 дек. 2025 г. |
40В плане | CVE-2024-57521Proof of concept | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in Sruoyi · ruoyi · CWE-89 | Критическая10,0 | — | 0,6 % | 23 дек. 2025 г. |
39Наблюдать | CVE-2025-65354Proof of concept | Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_nampuneethreddyhc · event management · CWE-89 | Критическая9,8 | — | 0,5 % | 23 дек. 2025 г. |
36Наблюдать | CVE-2025-66209Proof of concept | Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backupcoollabs · coolify · CWE-78 | Высокая8,8 | — | 3,8 % | 23 дек. 2025 г. |
38Наблюдать | CVE-2025-66210Эксплойта нет | Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Importcoollabs · coolify · CWE-78 | Критическая9,4 | — | 2,7 % | 23 дек. 2025 г. |
26Наблюдать | CVE-2025-15048Эксплойта нет | Tenda WH450 HTTP Request CheckTools command injectiontenda · wh450 firmware · CWE-74 | Средняя5,5 | — | 12,2 % | 23 дек. 2025 г. |
45В плане | CVE-2025-68664Proof of concept | LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIslangchain · langchain core · CWE-502 | Высокая8,2 | — | 42,9 % | 23 дек. 2025 г. |
40В плане | CVE-2025-13773Proof of concept | Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Executiontychesoftwares · print invoice & delivery notes for woocommerce · CWE-94 | Критическая9,8 | — | 3,7 % | 24 дек. 2025 г. |
27Наблюдать | CVE-2025-13407Proof of concept | GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Uploadunknown · gravity forms · CWE-434 | Средняя6,8 | — | 0,3 % | 24 дек. 2025 г. |
18Наблюдать | CVE-2025-68509Proof of concept | WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerabilityjeff starr · user submitted posts · CWE-601 | Средняя4,7 | — | 0,5 % | 24 дек. 2025 г. |
18Наблюдать | CVE-2025-68602Proof of concept | WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerabilityscott paterson · accept donations with paypal & stripe · CWE-601 | Средняя4,7 | — | 0,4 % | 24 дек. 2025 г. |
34Наблюдать | CVE-2019-25246Proof of concept | Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosurebeward r&d co., ltd · n100 h.264 vga ip camera · CWE-22 | Высокая7,1 | — | 18,9 % | 24 дек. 2025 г. |
38Наблюдать | CVE-2025-68937Proof of concept | Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-forgejo · forgejo · CWE-61 | Критическая9,5 | — | 0,5 % | 26 дек. 2025 г. |
26Наблюдать | CVE-2025-66947Proof of concept | SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.krishanmurariji · student management system · CWE-89 | Средняя6,5 | — | 0,2 % | 26 дек. 2025 г. |
43В плане | CVE-2025-68668Эксплойта нет | n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Noden8n · n8n · CWE-693 | Критическая9,9 | — | 13,1 % | 26 дек. 2025 г. |
44В плане | CVE-2025-54322Proof of concept | Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.xspeeder · sxzos · CWE-95 | Критическая9,8 | — | 15,1 % | 27 дек. 2025 г. |
25Наблюдать | CVE-2025-14177Proof of concept | Information Leak of Memory in getimagesizephp · php · CWE-125 | Средняя6,3 | — | 0,5 % | 27 дек. 2025 г. |
32Наблюдать | CVE-2025-15136Эксплойта нет | TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injectiontrendnet · tew-800mb firmware · CWE-74 | Высокая7,4 | — | 10,7 % | 28 дек. 2025 г. |
32Наблюдать | CVE-2025-15137Эксплойта нет | TRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934 command injectiontrendnet · tew-800mb firmware · CWE-74 | Высокая7,4 | — | 11,3 % | 28 дек. 2025 г. |
12Наблюдать | CVE-2025-15139Эксплойта нет | TRENDnet TEW-822DRE formWsc sub_43ACF4 command injectiontrendnet · tew-822dre firmware · CWE-74 | Низкая2,1 | — | 13,3 % | 28 дек. 2025 г. |
96Срочно | CVE-2025-52691Готовый эксплойт | Upload Arbitrary Filessmartertools · smartermail · CWE-434 | Критическая10,0 | KEV | 85,6 % | 29 дек. 2025 г. |
39Наблюдать | CVE-2025-57460Proof of concept | File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.machsol · machpanel · CWE-434 | Критическая9,8 | — | 0,4 % | 29 дек. 2025 г. |
24Наблюдать | CVE-2025-57462Proof of concept | Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fimachsol · machpanel · CWE-79 | Средняя6,1 | — | 0,1 % | 29 дек. 2025 г. |
26Наблюдать | CVE-2025-60458Proof of concept | UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.antimof · uxplay · CWE-400 | Средняя6,5 | — | 0,3 % | 29 дек. 2025 г. |
- CVE-2025-1378035Наблюдать
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %pgadmin · pgadmin 411 дек. 2025 г.
- CVE-2025-5518340В плане
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.
СредняяCVSS 5,3Proof of conceptEPSS 64 %vercel · next.js11 дек. 2025 г.
- CVE-2025-5518450В плане
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.
ВысокаяCVSS 7,5Proof of conceptEPSS 66 %facebook · react11 дек. 2025 г.
- CVE-2025-5581624Наблюдать
HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.
СредняяCVSS 6,1Proof of conceptEPSS 0 %digitaldruid · hoteldruid11 дек. 2025 г.
- CVE-2024-5828660На этой неделе
dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path
КритическаяCVSS 9,3Готовый эксплойтEPSS 1 %vexorian · dizquetv11 дек. 2025 г.
- CVE-2024-5829037Наблюдать
Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint
КритическаяCVSS 9,3Proof of conceptEPSS 0 %elements · xhibiter nft marketplace11 дек. 2025 г.
- CVE-2025-6778016Наблюдать
SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gR
СредняяCVSS 4,2Proof of conceptEPSS 0 %spacex · starlink dish11 дек. 2025 г.
- CVE-2025-6777936Наблюдать
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attac
ВысокаяCVSS 7,5Эксплойта нетEPSS 19 %facebook · react12 дек. 2025 г.
- CVE-2025-6772530Наблюдать
Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
ВысокаяCVSS 7,5Эксплойта нетEPSS 0 %tornadoweb · tornado12 дек. 2025 г.
- CVE-2025-6772727Наблюдать
Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
СредняяCVSS 6,9Proof of conceptEPSS 0 %parseplatform · parse-server12 дек. 2025 г.
- CVE-2025-6773020Наблюдать
Frappe authenticated users can execute XSS through form description fields
СредняяCVSS 5,1Proof of conceptEPSS 0 %frappe · learning12 дек. 2025 г.
- CVE-2025-1284121Наблюдать
Bookit < 2.5.1 – Unauthenticated Settings Update
СредняяCVSS 5,3Proof of conceptEPSS 0 %unknown · bookit12 дек. 2025 г.
- CVE-2024-5829937Наблюдать
PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command
КритическаяCVSS 9,3Proof of conceptEPSS 0 %pcman · ftp server12 дек. 2025 г.
- CVE-2025-1417472На этой неделе
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memo
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 22 %google · chrome12 дек. 2025 г.
- CVE-2025-1461174На этой неделе
Gladinet CentreStack and TrioFox Hard Coded AES Keys
ВысокаяCVSS 7,1KEVГотовый эксплойтEPSS 53 %gladinet · centrestack12 дек. 2025 г.
- CVE-2025-4351061На этой неделе
A memory corruption issue was addressed with improved lock state checking.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %apple · ipados12 дек. 2025 г.
- CVE-2025-4352052В плане
A memory corruption issue was addressed with improved memory handling.
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 0 %apple · ipados12 дек. 2025 г.
- CVE-2025-1169340В плане
Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File
КритическаяCVSS 9,8Proof of conceptEPSS 2 %recorp · export wordpress pages to static html & pdf — static site export13 дек. 2025 г.
- CVE-2025-1444039Наблюдать
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
КритическаяCVSS 9,8Proof of conceptEPSS 0 %jayarsiech · jay login & register13 дек. 2025 г.
- CVE-2025-1465930Наблюдать
D-Link DIR-860LB1/DIR-868LB1 DHCP command injection
ВысокаяCVSS 7,4Proof of conceptEPSS 3 %dlink · dir-868l b1 firmware14 дек. 2025 г.
- CVE-2025-6790636Наблюдать
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.
КритическаяCVSS 9,0Proof of conceptEPSS 0 %misp-project · misp15 дек. 2025 г.
- CVE-2025-1470426Наблюдать
Shiguangwu sgwbox N3 API eshell path traversal
СредняяCVSS 5,5Эксплойта нетEPSS 12 %sgwbox · n3 firmware15 дек. 2025 г.
- CVE-2025-1470540В плане
Shiguangwu sgwbox N3 SHARESERVER Feature command injection
ВысокаяCVSS 8,9Эксплойта нетEPSS 16 %sgwbox · n3 firmware15 дек. 2025 г.
- CVE-2025-1470641В плане
Shiguangwu sgwbox N3 NETREBOOT http_eshell_server command injection
ВысокаяCVSS 8,9Эксплойта нетEPSS 18 %sgwbox · n3 firmware15 дек. 2025 г.
- CVE-2025-1470741В плане
Shiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injection
ВысокаяCVSS 8,9Эксплойта нетEPSS 18 %sgwbox · n3 firmware15 дек. 2025 г.
- CVE-2025-1415641В плане
Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
КритическаяCVSS 9,8Proof of conceptEPSS 6 %ays-pro · fox lms – wordpress lms plugin15 дек. 2025 г.
- CVE-2025-6574232Наблюдать
An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive in
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %newgensoft · omnidocs15 дек. 2025 г.
- CVE-2025-6463421Наблюдать
WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability
СредняяCVSS 5,3Эксплойта нетEPSS 0 %theme-fusion · avada16 дек. 2025 г.
- CVE-2025-6805534Наблюдать
WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %themefic · hydra booking16 дек. 2025 г.
- CVE-2025-1395621Наблюдать
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
СредняяCVSS 5,3Proof of conceptEPSS 0 %thimpress · learnpress – wordpress lms plugin for create and sell online courses16 дек. 2025 г.
- CVE-2025-6531836Наблюдать
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web
КритическаяCVSS 9,1Proof of conceptEPSS 0 %canarymail · canary mail16 дек. 2025 г.
- CVE-2025-3716496Срочно
A remote code execution issue exists in HPE OneView.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 90 %hpe · oneview16 дек. 2025 г.
- CVE-2025-6811621Наблюдать
FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
СредняяCVSS 5,4Proof of conceptEPSS 0 %filerise · filerise16 дек. 2025 г.
- CVE-2025-3321036Наблюдать
NVIDIA Isaac Lab contains a deserialization vulnerability.
КритическаяCVSS 9,0Proof of conceptEPSS 0 %nvidia · isaac lab16 дек. 2025 г.
- CVE-2025-4629539Наблюдать
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input i
КритическаяCVSS 9,8Proof of conceptEPSS 1 %claris · filemaker server16 дек. 2025 г.
- CVE-2025-6542726Наблюдать
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to
СредняяCVSS 6,5Proof of conceptEPSS 0 %dbitnet · dbit n300 t1 pro firmware16 дек. 2025 г.
- CVE-2025-6815436Наблюдать
Command Injection in fsSize() on Windows
ВысокаяCVSS 8,1Эксплойта нетEPSS 12 %systeminformation · systeminformation16 дек. 2025 г.
- CVE-2025-1470041В плане
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
КритическаяCVSS 9,9Proof of conceptEPSS 6 %craftycontrol · crafty controller16 дек. 2025 г.
- CVE-2025-1476536Наблюдать
Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a cra
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %google · chrome16 дек. 2025 г.
- CVE-2025-5937467На этой неделе
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 1 %asus · live update17 дек. 2025 г.
- CVE-2025-2039380Срочно
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 32 %cisco · asyncos17 дек. 2025 г.
- CVE-2025-6252160На этой неделе
ChurchCRM has unauthenticated RCE in its Install Wizard
КритическаяCVSS 9,8Готовый эксплойтEPSS 4 %churchcrm · churchcrm17 дек. 2025 г.
- CVE-2025-3444160На этой неделе
AVideo < 20.1 User Information Disclosure via Public API
СредняяCVSS 6,9Готовый эксплойтEPSS 0 %wwbn · avideo17 дек. 2025 г.
- CVE-2025-3444260На этой неделе
AVideo < 20.1 System Path Disclosure via Public API
СредняяCVSS 6,9Готовый эксплойтEPSS 0 %wwbn · avideo17 дек. 2025 г.
- CVE-2025-6585526Наблюдать
The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentia
СредняяCVSS 6,6Proof of conceptEPSS 0 %netun · helpflash iot firmware17 дек. 2025 г.
- CVE-2025-6787637Наблюдать
ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking
КритическаяCVSS 9,3Proof of conceptEPSS 0 %churchcrm · churchcrm17 дек. 2025 г.
- CVE-2025-6840037Наблюдать
ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php
КритическаяCVSS 9,3Proof of conceptEPSS 0 %churchcrm · churchcrm17 дек. 2025 г.
- CVE-2025-4352968На этой неделе
A use-after-free issue was addressed with improved memory management.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 8 %apple · safari17 дек. 2025 г.
- CVE-2025-4354127Наблюдать
A type confusion issue was addressed with improved state handling.
СредняяCVSS 4,3Proof of conceptEPSS 34 %apple · safari17 дек. 2025 г.
- CVE-2025-6787534Наблюдать
ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %churchcrm · churchcrm17 дек. 2025 г.
- CVE-2025-6810940В плане
ChurchCRM vulnerable to RCE with database restore functionality
ВысокаяCVSS 7,2Готовый эксплойтEPSS 1 %churchcrm · churchcrm17 дек. 2025 г.
- CVE-2025-6814732Наблюдать
opensourcepos has a Cross-site Scripting vulnerability
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %opensourcepos · open source point of sale17 дек. 2025 г.
- CVE-2025-6843435Наблюдать
opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %opensourcepos · open source point of sale17 дек. 2025 г.
- CVE-2025-6846162На этой неделе
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d
СредняяCVSS 6,1KEVГотовый эксплойтEPSS 26 %roundcube · webmail18 дек. 2025 г.
- CVE-2025-1436435Наблюдать
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %kraftplugins · demo importer plus18 дек. 2025 г.
- CVE-2025-4060257В плане
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
СредняяCVSS 6,6KEVГотовый эксплойтEPSS 2 %sonicwall · sma6200 firmware18 дек. 2025 г.
- CVE-2025-1443731Наблюдать
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %wpmudev · hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdn18 дек. 2025 г.
- CVE-2025-683250Наблюдать
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
Proof of conceptEPSS 0 %linux · linux18 дек. 2025 г.
- CVE-2025-1488432Наблюдать
D-Link DIR-605 Firmware Update Service command injection
ВысокаяCVSS 7,3Эксплойта нетEPSS 10 %dlink · dir-605 firmware18 дек. 2025 г.
- CVE-2025-5615739Наблюдать
Default credentials in Dify thru 1.5.1.
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %langgenius · dify18 дек. 2025 г.
- CVE-2025-6338739Наблюдать
Dify v1.9.1 is vulnerable to Insecure Permissions.
ВысокаяCVSS 7,5Proof of conceptEPSS 29 %langgenius · dify18 дек. 2025 г.
- CVE-2025-1473375На этой неделе
WatchGuard Firebox iked Out of Bounds Write Vulnerability
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 26 %watchguard · fireware18 дек. 2025 г.
- CVE-2025-1484789Срочно
Zlib compressed protocol header length confusion may allow memory read
ВысокаяCVSS 8,7KEVГотовый эксплойтEPSS 83 %mongodb · mongodb19 дек. 2025 г.
- CVE-2025-3443360На этой неделе
AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
КритическаяCVSS 9,3Готовый эксплойтEPSS 1 %world wide broadcast network · avideo19 дек. 2025 г.
- CVE-2025-6861395Срочно
n8n Vulnerable to Remote Code Execution via Expression Injection
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 98 %n8n · n8n19 дек. 2025 г.
- CVE-2023-2544521Наблюдать
WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability
СредняяCVSS 5,4Эксплойта нетEPSS 0 %happyfiles · happyfiles pro20 дек. 2025 г.
- CVE-2025-1485528Наблюдать
SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %brainstormforce · sureforms – contact form, payment form & other custom form builder21 дек. 2025 г.
- CVE-2025-1401829Наблюдать
Unquoted Service Path in NetBT Consultancy's e-Fatura
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %netbt consulting services inc. · e-fatura22 дек. 2025 г.
- CVE-2025-6527024Наблюдать
Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute
СредняяCVSS 6,1Proof of conceptEPSS 0 %clincapture · captivate electronic data capture22 дек. 2025 г.
- CVE-2025-6864580Срочно
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 48 %synacor · zimbra collaboration suite22 дек. 2025 г.
- CVE-2025-6579024Наблюдать
A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface.
СредняяCVSS 6,1Proof of conceptEPSS 0 %realtimelogic · fuguhub22 дек. 2025 г.
- CVE-2025-6581735Наблюдать
LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %lsc · smart connect indoor ip camera firmware22 дек. 2025 г.
- CVE-2025-6585639Наблюдать
Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti
КритическаяCVSS 9,8Proof of conceptEPSS 0 %xiongmaitech · xm530v200 x6-weq 8m firmware22 дек. 2025 г.
- CVE-2025-6585730Наблюдать
An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %xiongmaitech · xm530v200 x6-weq 8m firmware22 дек. 2025 г.
- CVE-2025-6861552В плане
Net-SNMP snmptrapd crash
КритическаяCVSS 9,8Эксплойта нетEPSS 42 %net-snmp · net-snmp23 дек. 2025 г.
- CVE-2025-1415521Наблюдать
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
СредняяCVSS 5,3Proof of conceptEPSS 0 %leap13 · premium addons for elementor23 дек. 2025 г.
- CVE-2025-5988635Наблюдать
Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %eaton · xcomfort ethernet communication interface23 дек. 2025 г.
- CVE-2024-5752140В плане
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in S
КритическаяCVSS 10,0Proof of conceptEPSS 0 %ruoyi · ruoyi23 дек. 2025 г.
- CVE-2025-6535439Наблюдать
Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_nam
КритическаяCVSS 9,8Proof of conceptEPSS 0 %puneethreddyhc · event management23 дек. 2025 г.
- CVE-2025-6620936Наблюдать
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
ВысокаяCVSS 8,8Proof of conceptEPSS 3 %coollabs · coolify23 дек. 2025 г.
- CVE-2025-6621038Наблюдать
Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import
КритическаяCVSS 9,4Эксплойта нетEPSS 2 %coollabs · coolify23 дек. 2025 г.
- CVE-2025-1504826Наблюдать
Tenda WH450 HTTP Request CheckTools command injection
СредняяCVSS 5,5Эксплойта нетEPSS 12 %tenda · wh450 firmware23 дек. 2025 г.
- CVE-2025-6866445В плане
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
ВысокаяCVSS 8,2Proof of conceptEPSS 42 %langchain · langchain core23 дек. 2025 г.
- CVE-2025-1377340В плане
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
КритическаяCVSS 9,8Proof of conceptEPSS 3 %tychesoftwares · print invoice & delivery notes for woocommerce24 дек. 2025 г.
- CVE-2025-1340727Наблюдать
GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
СредняяCVSS 6,8Proof of conceptEPSS 0 %unknown · gravity forms24 дек. 2025 г.
- CVE-2025-6850918Наблюдать
WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability
СредняяCVSS 4,7Proof of conceptEPSS 0 %jeff starr · user submitted posts24 дек. 2025 г.
- CVE-2025-6860218Наблюдать
WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability
СредняяCVSS 4,7Proof of conceptEPSS 0 %scott paterson · accept donations with paypal & stripe24 дек. 2025 г.
- CVE-2019-2524634Наблюдать
Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure
ВысокаяCVSS 7,1Proof of conceptEPSS 18 %beward r&d co., ltd · n100 h.264 vga ip camera24 дек. 2025 г.
- CVE-2025-6893738Наблюдать
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-
КритическаяCVSS 9,5Proof of conceptEPSS 0 %forgejo · forgejo26 дек. 2025 г.
- CVE-2025-6694726Наблюдать
SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.
СредняяCVSS 6,5Proof of conceptEPSS 0 %krishanmurariji · student management system26 дек. 2025 г.
- CVE-2025-6866843В плане
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
КритическаяCVSS 9,9Эксплойта нетEPSS 13 %n8n · n8n26 дек. 2025 г.
- CVE-2025-5432244В плане
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.
КритическаяCVSS 9,8Proof of conceptEPSS 15 %xspeeder · sxzos27 дек. 2025 г.
- CVE-2025-1417725Наблюдать
Information Leak of Memory in getimagesize
СредняяCVSS 6,3Proof of conceptEPSS 0 %php · php27 дек. 2025 г.
- CVE-2025-1513632Наблюдать
TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injection
ВысокаяCVSS 7,4Эксплойта нетEPSS 10 %trendnet · tew-800mb firmware28 дек. 2025 г.
- CVE-2025-1513732Наблюдать
TRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934 command injection
ВысокаяCVSS 7,4Эксплойта нетEPSS 11 %trendnet · tew-800mb firmware28 дек. 2025 г.
- CVE-2025-1513912Наблюдать
TRENDnet TEW-822DRE formWsc sub_43ACF4 command injection
НизкаяCVSS 2,1Эксплойта нетEPSS 13 %trendnet · tew-822dre firmware28 дек. 2025 г.
- CVE-2025-5269196Срочно
Upload Arbitrary Files
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 85 %smartertools · smartermail29 дек. 2025 г.
- CVE-2025-5746039Наблюдать
File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %machsol · machpanel29 дек. 2025 г.
- CVE-2025-5746224Наблюдать
Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fi
СредняяCVSS 6,1Proof of conceptEPSS 0 %machsol · machpanel29 дек. 2025 г.
- CVE-2025-6045826Наблюдать
UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.
СредняяCVSS 6,5Proof of conceptEPSS 0 %antimof · uxplay29 дек. 2025 г.