CVEs published December 23, 2025
154 CVEs were published on December 23, 2025: 28 critical, 90 high. Browse them by severity, product and exploitation status.
- Published
- 154
- Critical
- 28
- High
- 90
- Medium
- 27
- Low
- 5
- Unrated
- 4
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- RealDefense SUPERAntiSpyware
- 10
- Soda PDF Desktop
- 10
- Hugging Face Transformers · transformers
- 8
- Linux
- 6
- pdfforge PDF Architect
- 6
- coollabsio coolify
- 5
- NSF Unidata NetCDF-C
- 5
- PDFsam Enhanced
- 5
- Tenda WH450
- 5
- GIMP
- 4
Critical 28
- CVE-2025-686695ire vulnerable to Remote Code Execution (RCE) via mermaidnanbingxyz 5ire
- CVE-2025-68664LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIslangchain-ai langchain · langchain-core
- CVE-2025-68667Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issuecontinuwuity
- CVE-2025-66213Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Pathcoollabsio coolify
- CVE-2025-66212Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filenamecoollabsio coolify
- CVE-2025-15047Tenda WH450 HTTP Request PPTPDClient stack-based overflowTenda WH450
- CVE-2025-66211Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filenamecoollabsio coolify
- CVE-2025-66210Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Importcoollabsio coolify
- CVE-2025-66209Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backupcoollabsio coolify
- CVE-2025-15046Tenda WH450 HTTP Request PPTPClient stack-based overflowTenda WH450
- CVE-2025-14500IceWarp14 X-File-Operation Command Injection Remote Code Execution VulnerabilityIceWarp
- CVE-2025-14931Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face smolagents · smolagents
- CVE-2025-15045Tenda WH450 HTTP Request Natlimit stack-based overflowTenda WH450
- CVE-2025-15044Tenda WH450 NatStaticSetting stack-based overflowTenda WH450
- CVE-2023-53982PMB 7.4.6 SQL Injection Vulnerability via Unsanitized id ParameterSigb PMB
- CVE-2025-33222NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue.NVIDIA Isaac Launchable
- CVE-2025-33223NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges.NVIDIA Isaac Launchable
- CVE-2025-33224NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges.NVIDIA Isaac Launchable
- CVE-2025-68341veth: reduce XDP no_direct return section to fix raceLinux
- CVE-2025-14388PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injectionkiboit PhastPress
- CVE-2024-57521SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in…
- CVE-2025-29228Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter.
- CVE-2025-29229linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.
- CVE-2025-50526Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function.
- CVE-2025-51511Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.cadmium-org/cadmium-cms
Show all 28 entriesShow fewer entries
- CVE-2025-65354Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the…
- CVE-2025-67108eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and…
- CVE-2025-67109Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and…
High 90
- CVE-2025-68696httparty Has Potential SSRF Vulnerability That Leads to API Key Leakagejnunemaker httparty · httparty
- CVE-2025-68665LangChain serialization injection vulnerability enables secret extractionlangchain-ai langchainjs · @langchain/core +1
- CVE-2025-68617Use after free in fluidsynthfluidsynth
- CVE-2025-12491Senstar Symphony FetchStoredLicense Information Disclosure VulnerabilitySenstar Symphony
- CVE-2025-13700DreamFactory saveZipFile Command Injection Remote Code Execution VulnerabilityDreamFactory
- CVE-2025-12840Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAcademy Software Foundation OpenEXR
- CVE-2025-12839Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAcademy Software Foundation OpenEXR
- CVE-2025-12495Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAcademy Software Foundation OpenEXR
- CVE-2025-12838MSP360 Free Backup Link Following Local Privilege Escalation VulnerabilityMSP360 Free Backup
- CVE-2025-13699MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution VulnerabilityMariaDB
- CVE-2025-13715Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent FaceDetection-DSFD
- CVE-2025-13709Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent TFace
- CVE-2025-13711Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent TFace
- CVE-2025-13706Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent PatrickStar
- CVE-2025-13708Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent NeuralNLP-NeuralClassifier
- CVE-2025-13716Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent MimicMotion
- CVE-2025-13714Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent MedicalNet
- CVE-2025-13710Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent HunyuanVideo
- CVE-2025-13707Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent HunyuanDiT
- CVE-2025-13712Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent HunyuanDiT
- CVE-2025-13713Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution VulnerabilityTencent Hunyuan3D-1
- CVE-2025-14425GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-14424GIMP XCF File Parsing Use-After-Free Remote Code Execution VulnerabilityGIMP
- CVE-2025-14423GIMP LBM File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-14422GIMP PNM File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
Show all 90 entriesShow fewer entries
- CVE-2025-13703VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation VulnerabilityVIPRE Advanced Security
- CVE-2025-14414Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution VulnerabilitySoda PDF Desktop
- CVE-2025-14415Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution VulnerabilitySoda PDF Desktop
- CVE-2025-14413Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution VulnerabilitySoda PDF Desktop
- CVE-2025-14412Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution VulnerabilitySoda PDF Desktop
- CVE-2025-14409Soda PDF Desktop PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilitySoda PDF Desktop
- CVE-2025-14406Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation VulnerabilitySoda PDF Desktop
- CVE-2025-14420pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerabilitypdfforge PDF Architect
- CVE-2025-14419pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerabilitypdfforge PDF Architect
- CVE-2025-14418pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerabilitypdfforge PDF Architect
- CVE-2025-14417pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerabilitypdfforge PDF Architect
- CVE-2025-14416pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerabilitypdfforge PDF Architect
- CVE-2025-14404PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution VulnerabilityPDFsam Enhanced
- CVE-2025-14403PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution VulnerabilityPDFsam Enhanced
- CVE-2025-14402PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution VulnerabilityPDFsam Enhanced
- CVE-2025-14401PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution VulnerabilityPDFsam Enhanced
- CVE-2025-14499IceWarp gmaps Cross-Site Scripting Authentication Bypass VulnerabilityIceWarp
- CVE-2025-14501Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service VulnerabilitySante PACS Server
- CVE-2025-14498TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation VulnerabilityTradingView Desktop
- CVE-2025-14494RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14491RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14489RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14490RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14488RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14497RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14495RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14493RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14496RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14492RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation VulnerabilityRealDefense SUPERAntiSpyware
- CVE-2025-14932NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution VulnerabilityNSF Unidata NetCDF-C
- CVE-2025-14933NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution VulnerabilityNSF Unidata NetCDF-C
- CVE-2025-14934NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution VulnerabilityNSF Unidata NetCDF-C
- CVE-2025-14935NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution VulnerabilityNSF Unidata NetCDF-C
- CVE-2025-14936NSF Unidata NetCDF-C Attribute Name Stack-based Buffer Overflow Remote Code Execution VulnerabilityNSF Unidata NetCDF-C
- CVE-2025-14925Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Accelerate
- CVE-2025-14922Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Diffusers
- CVE-2025-14930Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14928Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14924Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14920Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14926Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14927Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14921Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-14929Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face Transformers · transformers
- CVE-2025-11419Keycloak: keycloak tls client-initiated renegotiation denial of servicekeycloak · Red Hat build of Keycloak +1
- CVE-2021-47739Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service PathEpic Games Easy Anti-Cheat
- CVE-2021-47736CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content EditingCmsimple-Xh CMSimple_XH
- CVE-2021-47735CMSimple 5.4 Authenticated Remote Code Execution via Template EditingCmsimple
- CVE-2021-47734CMSimple 5.4 Authenticated Local File Inclusion Remote Code ExecutionCMSimple
- CVE-2021-47721Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulationorangescrum
- CVE-2021-47720Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parametersorangescrum
- CVE-2024-9684FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences.FreyrSCADA IEC-60870-5-104
- CVE-2025-68340team: Move team device type change at the end of team_port_addLinux
- CVE-2025-13183Stored XSS in Hotech's OtelloHotech Software Otello
- CVE-2024-24844WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerabilityIdeaBox Creations PowerPack Pro for Elementor
- CVE-2025-68546WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerabilitythembay Nika
- CVE-2025-68544WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerabilitythembay Diza
- CVE-2025-68550WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerabilityVillaTheme WPBulky
- CVE-2025-68560WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2025-68561WordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerabilityRuben Garcia AutomatorWP
- CVE-2025-59886Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access…Eaton xComfort ECI
- CVE-2025-12934Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Updatebeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2025-25364A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to…
- CVE-2025-65865An integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-67111An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS)…
Medium, low and unrated 36
- CVE-2025-15049code-projects Online Farm System addProduct.php sql injectioncode-projects Online Farm System
- CVE-2025-15048Tenda WH450 HTTP Request CheckTools command injectionTenda WH450
- CVE-2025-13698Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation VulnerabilityDeciso OPNsense
- CVE-2025-14411Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilitySoda PDF Desktop
- CVE-2025-14410Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilitySoda PDF Desktop
- CVE-2025-14408Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilitySoda PDF Desktop
- CVE-2025-14407Soda PDF Desktop PDF File Parsing Memory Corruption Information Disclosure VulnerabilitySoda PDF Desktop
- CVE-2025-14421pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerabilitypdfforge PDF Architect
- CVE-2025-14405PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityPDFsam Enhanced
- CVE-2021-47737CSZ CMS 1.2.7 HTML Injection Vulnerability via Member DashboardCszcms CSZ CMS
- CVE-2021-47733CMSimple 5.4 Cross-Site Scripting via HTML Unicode EncodingCMSimple
- CVE-2021-47716Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpointsorangescrum
- CVE-2021-47738CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private MessagingCszcms CSZ CMS
- CVE-2021-47732CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External InputCMSimple
- CVE-2021-47722Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request ForgeryAxesstmc Zucchetti Axess CLOKI Access Control
- CVE-2025-68343can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing headerLinux
- CVE-2025-68342can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing dataLinux
- CVE-2025-68339atm/fore200e: Fix possible data race in fore200e_open()Linux
- CVE-2025-68338net: dsa: microchip: Don't free uninitialized ksz_irqLinux
- CVE-2023-52210WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.0 - Broken Access Control vulnerabilityTyche softwares Product Delivery Date for WooCommerce – Lite
- CVE-2025-68548WordPress Responsive Posts Carousel Pro plugin <= 15.2 - Cross Site Scripting (XSS) vulnerabilityWebCodingPlace Responsive Posts Carousel Pro
- CVE-2025-68551WordPress VPSUForm plugin <= 3.2.24 - Sensitive Data Exposure vulnerabilityVikas Ratudi VPSUForm
- CVE-2025-68556WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerabilityVillaTheme HAPPY
- CVE-2025-68557WordPress Chakra test plugin <= 1.0.1 - Broken Access Control vulnerabilityVikas Ratudi Chakra test
- CVE-2025-68559WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem Theme Elements
Show all 36 entriesShow fewer entries
- CVE-2025-14635Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSthehappymonster Happy Addons for Elementor
- CVE-2025-14000Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesstellarwp Membership Plugin – Restrict Content
- CVE-2025-14163Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'leap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2025-14548Calendar <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc'kieranoshea Calendar
- CVE-2025-14155Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'leap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2025-15034itsourcecode Student Management System record.php sql injectionitsourcecode Student Management System
- CVE-2025-67743Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download ServiceLearningCircuit local-deep-research · local-deep-research
- CVE-2025-45493Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function.
- CVE-2025-65410A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a…
- CVE-2025-65713Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal.homeassistant
- CVE-2025-66845A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0.