CVEs published December 1, 2025
143 CVEs were published on December 1, 2025: 10 critical, 61 high.
- Published
- 143
- Critical
- 10
- High
- 61
- Medium
- 71
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- getgrav grav · getgrav/grav
- 19
- Socomec DIRIS Digiware M-70
- 13
- Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- 11
- moxi159753 Mogu Blog
- 4
- ADSLR NBR1005GPEV2
- 3
- Arm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- 3
- feehi/feehicms
- 3
- nutzam NutzBoot · org.nutz:nutzboot-parent
- 3
- orionsec orion-ops
- 3
- Zabbix
- 3
Critical 10
- CVE-2025-66401MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URLkapilduraphe mcp-watch · mcp-watch
- CVE-2025-3500Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalationAvast Antivirus
- CVE-2025-12106Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IPOpenVPN
- CVE-2025-51682mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to adminis
- CVE-2025-51683A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a cr
- CVE-2025-63525An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges vi
- CVE-2025-63531A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component.
- CVE-2025-63532A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component.
- CVE-2025-63535A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component.
- CVE-2025-65836PublicCMS V5.202506.b is vulnerable to SSRF.
High 61
- CVE-2025-66448vLLM vulnerable to remote code execution via transformers_utils/get_configvllm-project vllm · vllm
- CVE-2025-66412Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributesangular · @angular/compiler
- CVE-2025-66410Gin-vue-admin has an arbitrary file deletion vulnerabilityflipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…
- CVE-2025-66301Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsgetgrav grav · getgrav/grav
- CVE-2025-66300Grav is vulnerable to Arbitrary File Readgetgrav grav · getgrav/grav
- CVE-2025-66299Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMSgetgrav grav · getgrav/grav
- CVE-2025-66298Grav is vulnerable to Server-Side Template Injection (SSTI) via Formsgetgrav grav · getgrav/grav
- CVE-2025-66297Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injectiongetgrav grav · getgrav/grav
- CVE-2025-66296Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeovergetgrav grav · getgrav/grav
- CVE-2025-66294Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypassgetgrav grav · getgrav/grav
- CVE-2025-66295Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruptiongetgrav grav · getgrav/grav
- CVE-2025-66205Frappe has the possibility of SQL Injection due to improper validationsfrappe
- CVE-2025-55749The XWiki Jetty package (XJetty) allows accessing any application file through URLxwiki-platform · org.xwiki.platform:xwiki-platform-tool-jet…
- CVE-2025-34297KissFFT Integer Overflow Heap Buffer Overflow via kiss_fft_allocmborgerding/kissfft
- CVE-2025-7007Null pointer dereference in Avast Antivirus on macOS (16.0.0) or Linux (3.0.3)Avast Antivirus · Avast Anitvirus
- CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2025-8351Avira antivirus engine heap buffer OOB read when scanning a malformed fileGen Digital Avira Antivirus
- CVE-2025-13829Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any Data Illusion Zumbrunn NGSurvey
- CVE-2025-10101Avast antivirus heap buffer OOB read when scanning a malformed Mach-O fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2024-53684A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2024-45370An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0.Socomec Easy Config System
- CVE-2024-49572A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2024-48882A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-20085A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-23417A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-26858A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-54851A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-54850A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-54849A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-54848A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-55222A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70Socomec DIRIS Digiware M-70
- CVE-2025-55221A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70Socomec DIRIS Digiware M-70
- CVE-2025-11699CVE-2025-11699nopSolutions nopCommerce
- CVE-2025-59789Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON ParserApache Software Foundation Apache bRPC
- CVE-2025-41700CODESYS Development System - Deserialization of Untrusted DataCODESYS Development System
- CVE-2025-41738CODESYS Control - Invalid type usage in visualizationCODESYS Control RTE · CODESYS Control Win +14
- CVE-2025-61610In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61609In modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61608In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61607In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61619In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61618In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-61617In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-3012In dpc modem, there is a possible system crash due to null pointer dereference.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-11133In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-11132In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-11131In nr modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2025-64772The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic LiSony INZONE Hub
- CVE-2024-39148The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to e
- CVE-2024-56089An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake responses by reviving the b
- CVE-2025-57489Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to t
- CVE-2025-61228An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism
- CVE-2025-61229An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p
- CVE-2025-63365SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal.
- CVE-2025-63526A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component.
- CVE-2025-63527A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php comp
- CVE-2025-63528A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component.
- CVE-2025-63533A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php comp
- CVE-2025-63534A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component.
- CVE-2025-65838PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.
- CVE-2025-65840PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.
Medium, low and unrated 72
- CVE-2025-66415fastify-reply-from bypass of reply forwardingfastify-reply-from · @fastify/reply-from
- CVE-2025-66405Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom HostPortkey-AI gateway · @portkey-ai/gateway
- CVE-2025-66403FileRise Vulnerable to Stored XSS via SVG Uploaderror311 FileRise
- CVE-2025-66400mdast-util-to-hast unsanitized class attributesyntax-tree mdast-util-to-hast · mdast-util-to-hast
- CVE-2025-66313ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameterChurchCRM CRM
- CVE-2025-66312Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`getgrav grav · getgrav/grav
- CVE-2025-66311Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parametersgetgrav grav · getgrav/grav
- CVE-2025-66310Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tabgetgrav grav · getgrav/grav
- CVE-2025-66309Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tabgetgrav grav · getgrav/grav
- CVE-2025-66308Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`getgrav grav · getgrav/grav
- CVE-2025-66307Grav Admin Plugin vulnerable to User Enumeration & Email Disclosuregetgrav grav · getgrav/grav
- CVE-2025-66306Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panelgetgrav grav · getgrav/grav
- CVE-2025-66305Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parametergetgrav grav · getgrav/grav
- CVE-2025-66304Grav Exposes Password Hashes Leading to privilege escalationgetgrav grav · getgrav/grav
- CVE-2025-66303Grav is vulnerable to a DOS on the admin panelgetgrav grav · getgrav/grav
- CVE-2025-66302Grav vulnerable to Path Traversal allowing server files backupgetgrav grav · getgrav/grav
- CVE-2025-66206Frappe vulnerable to a path traversal allowing reading certain filesfrappe
- CVE-2025-58044JumpServer has an Open Redirect Vulnerabilityjumpserver
- CVE-2025-12756Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment DeletionMattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2025-11772Co-Installer Privilege EscalationSynaptics Fingerprint Driver
- CVE-2025-13837Out-of-memory when loading PlistPython Software Foundation CPython
- CVE-2025-13836Excessive read buffering DoS in http.clientPython Software Foundation CPython
- CVE-2025-13653Unauthorized access to documents in data streams with specially crafted requestsfloragunn Search Guard FLX
- CVE-2025-13835WordPress Arconix Shortcodes plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerabilitytychesoftwares Arconix Shortcodes
- CVE-2024-48894A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9.Socomec DIRIS Digiware M-70
- CVE-2025-13129Business Logic Error in Seneka Software's OnaylarımSeneka Software Hardware Information Technology Trade Contr…
- CVE-2025-49643Frontend DoS vulnerability due to asymmetric resource consumptionZabbix
- CVE-2025-49642Agent builds for AIX vulnerable to library loading hijackingZabbix
- CVE-2025-27232Frontend arbitrary file read in oauth.authorize actionZabbix
- CVE-2025-13296CSRF in Tekrom Technology's T-Soft E-CommerceTekrom Technology T-Soft E-Commerce
- CVE-2025-58408GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling codeImagination Technologies Graphics DDK
- CVE-2025-41070Reflected Cross-site Scripting (XSS) in Sanoma's ClickeduSanoma Clickedu
- CVE-2025-6349Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- CVE-2025-8045Mali GPU Kernel Driver allows improper GPU processing operationsArm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- CVE-2025-2879Mali GPU Kernel Driver allows improper GPU processing operationsArm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- CVE-2025-41739CODESYS Control - Linux/QNX SysSocket flawCODESYS PLCHandler · CODESYS Remote Target Visu +14
- CVE-2025-13819Open redirect in web server of MiR robots and MiR fleetMiR Robot · MiR Fleet
- CVE-2025-13816moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversalmoxi159753 Mogu Blog
- CVE-2025-13815moxi159753 Mogu Blog v2 pictures unrestricted uploadmoxi159753 Mogu Blog
- CVE-2025-13814moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgerymoxi159753 Mogu Blog
- CVE-2025-13813moxi159753 Mogu Blog v2 Storage Management Endpoint storage authorizationmoxi159753 Mogu Blog
- CVE-2025-13811jsnjfz WebStack-Guns PageFactory.java sql injectionjsnjfz WebStack-Guns
- CVE-2025-13810jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversaljsnjfz WebStack-Guns
- CVE-2025-13809orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgeryorionsec orion-ops
- CVE-2025-13808orionsec orion-ops User Profile UserController.java update improper authorizationorionsec orion-ops
- CVE-2025-13807orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorizationorionsec orion-ops
- CVE-2025-13806nutzam NutzBoot Transaction API EthModule.java improper authorizationnutzam NutzBoot · org.nutz:nutzboot-parent
- CVE-2025-13805nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserializationnutzam NutzBoot · org.nutz:nutzboot-parent
- CVE-2025-13804nutzam NutzBoot Ethereum Wallet EthModule.java information disclosurenutzam NutzBoot · org.nutz:nutzboot-parent
- CVE-2025-13803MediaCrush Header paths.py http headers for scripting syntaxMediaCrush
- CVE-2025-13802jairiidriss RestaurantWebsite Make a Reservation cross site scriptingjairiidriss RestaurantWebsite
- CVE-2025-13800ADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injectionADSLR NBR1005GPEV2
- CVE-2025-13799ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injectionADSLR NBR1005GPEV2
- CVE-2025-13798ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injectionADSLR NBR1005GPEV2
- CVE-2025-13797ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injectionADSLR B-QE2W401
- CVE-2024-32384Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support.
- CVE-2024-32388Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets.
- CVE-2025-63095Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a De
- CVE-2025-63317Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads.
- CVE-2025-63520Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).feehi/feehicms
- CVE-2025-63522Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management functionfeehi/feehicms
- CVE-2025-63523FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticatfeehi/feehicms
- CVE-2025-63529A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's
- CVE-2025-64030Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/se
- CVE-2025-65403A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-65404A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS)
- CVE-2025-65405A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a
- CVE-2025-65406A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause
- CVE-2025-65407A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Den
- CVE-2025-65408A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 all
- CVE-2025-65621Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administratorsnipe/snipe-it
- CVE-2025-65622Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScriptsnipe/snipe-it