# CVEs published 2025-12-06

66 CVEs were published on December 6, 2025: 2 critical, 25 high. Days are UTC.

- [CVE-2025-40289](https://cve.now/CVE-2025-40289.md): drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (no CVSS, Linux)
- [CVE-2025-40288](https://cve.now/CVE-2025-40288.md): drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (no CVSS, Linux)
- [CVE-2025-40287](https://cve.now/CVE-2025-40287.md): exfat: fix improper check of dentry.stream.valid\_size (no CVSS, Linux)
- [CVE-2025-40286](https://cve.now/CVE-2025-40286.md): smb/server: fix possible memory leak in smb2\_read() (no CVSS, Linux)
- [CVE-2025-40285](https://cve.now/CVE-2025-40285.md): smb/server: fix possible refcount leak in smb2\_sess\_setup() (CVSS 7.5, Linux)
- [CVE-2025-40284](https://cve.now/CVE-2025-40284.md): Bluetooth: MGMT: cancel mesh send timer when hdev removed (CVSS 7.8, Linux)
- [CVE-2025-40283](https://cve.now/CVE-2025-40283.md): Bluetooth: btusb: reorder cleanup in btusb\_disconnect to avoid UAF (CVSS 7.8, Linux)
- [CVE-2025-40282](https://cve.now/CVE-2025-40282.md): Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (CVSS 8.8, Linux)
- [CVE-2025-40281](https://cve.now/CVE-2025-40281.md): sctp: prevent possible shift-out-of-bounds in sctp\_transport\_update\_rto (no CVSS, Linux)
- [CVE-2025-40280](https://cve.now/CVE-2025-40280.md): tipc: Fix use-after-free in tipc\_mon\_reinit\_self(). (CVSS 7.8, Linux)
- [CVE-2025-40279](https://cve.now/CVE-2025-40279.md): net: sched: act\_connmark: initialize struct tc\_ife to fix kernel leak (no CVSS, Linux)
- [CVE-2025-40278](https://cve.now/CVE-2025-40278.md): net: sched: act\_ife: initialize struct tc\_ife to fix KMSAN kernel-infoleak (no CVSS, Linux)
- [CVE-2025-40277](https://cve.now/CVE-2025-40277.md): drm/vmwgfx: Validate command header size against SVGA\_CMD\_MAX\_DATASIZE (CVSS 7.8, Linux)
- [CVE-2025-40276](https://cve.now/CVE-2025-40276.md): drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (CVSS 7.3, Linux)
- [CVE-2025-40275](https://cve.now/CVE-2025-40275.md): ALSA: usb-audio: Fix NULL pointer dereference in snd\_usb\_mixer\_controls\_badd (no CVSS, Linux)
- [CVE-2025-40274](https://cve.now/CVE-2025-40274.md): KVM: guest\_memfd: Remove bindings on memslot deletion when gmem is dying (CVSS 7.8, Linux)
- [CVE-2025-40273](https://cve.now/CVE-2025-40273.md): NFSD: free copynotify stateid in nfs4\_free\_ol\_stateid() (CVSS 8.8, Linux)
- [CVE-2025-40272](https://cve.now/CVE-2025-40272.md): mm/secretmem: fix use-after-free race in fault handler (CVSS 7.8, Linux)
- [CVE-2025-40271](https://cve.now/CVE-2025-40271.md): fs/proc: fix uaf in proc\_readdir\_de() (CVSS 7.8, Linux)
- [CVE-2025-40270](https://cve.now/CVE-2025-40270.md): mm, swap: fix potential UAF issue for VMA readahead (CVSS 7.8, Linux)
- [CVE-2025-40269](https://cve.now/CVE-2025-40269.md): ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CVSS 7.8, Linux)
- [CVE-2025-40268](https://cve.now/CVE-2025-40268.md): cifs: client: fix memory leak in smb3\_fs\_context\_parse\_param (no CVSS, Linux)
- [CVE-2025-40267](https://cve.now/CVE-2025-40267.md): io\_uring/rw: ensure allocated iovec gets cleared for early failure (no CVSS, Linux)
- [CVE-2025-14141](https://cve.now/CVE-2025-14141.md): UTT 进取 520W formArpBindConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-14140](https://cve.now/CVE-2025-14140.md): UTT 进取 520W websHostFilter strcpy buffer overflow (CVSS 7.1, UTT 进取)
- [CVE-2025-14139](https://cve.now/CVE-2025-14139.md): UTT 进取 520W formConfigDnsFilterGlobal strcpy buffer overflow (CVSS 6.9, UTT 进取)
- [CVE-2025-14136](https://cve.now/CVE-2025-14136.md): Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod\_form.so stack-based overflow (CVSS 8.7, Linksys RE6500 · Linksys RE6250 +4)
- [CVE-2025-14135](https://cve.now/CVE-2025-14135.md): Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod\_form.so AP\_get\_wired\_clientlist\_setClientsName stack-based overflow (CVSS 8.7, Linksys RE6500 · Linksys RE6250 +4)
- [CVE-2025-14134](https://cve.now/CVE-2025-14134.md): Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod\_form.so stack-based overflow (CVSS 8.7, Linksys RE6500 · Linksys RE6250 +4)
- [CVE-2025-14133](https://cve.now/CVE-2025-14133.md): Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod\_form.so AP\_get\_wireless\_clientlist\_setClientsName stack-based overflow (CVSS 8.7, Linksys RE6500 · Linksys RE6250 +4)
- [CVE-2025-14126](https://cve.now/CVE-2025-14126.md): TOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentials (CVSS 8.7, TOZED ZLT M30S)
- [CVE-2025-13065](https://cve.now/CVE-2025-13065.md): Starter Templates \<= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass (CVSS 8.8, brainstormforce Starter Templates – AI-Powered Templates fo…)
- [CVE-2025-12966](https://cve.now/CVE-2025-12966.md): All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP (CVSS 8.8, plugins360 All-in-One Video Gallery)
- [CVE-2025-12499](https://cve.now/CVE-2025-12499.md): Rich Shortcodes for Google Reviews \<= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review (CVSS 7.2, widgetpack Rich Showcase for Google Reviews)
- [CVE-2025-13377](https://cve.now/CVE-2025-13377.md): 10Web Booster \<= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two\_clear\_page\_cache (CVSS 9.6, 10Web Booster – Website speed optimization, Cache & Page Sp…)
- [CVE-2025-13748](https://cve.now/CVE-2025-13748.md): Fluent Forms \<= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission\_id (CVSS 5.3, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2025-13358](https://cve.now/CVE-2025-13358.md): Accessiy By CodeConfig Accessibility \<= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation (CVSS 5.3, Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA…)
- [CVE-2025-13309](https://cve.now/CVE-2025-13309.md): Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters \<= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings (CVSS 4.3, Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA…)
- [CVE-2025-13894](https://cve.now/CVE-2025-13894.md): CSV Sumotto \<= 1.0 - Reflected Cross-Site Scripting (CVSS 6.1, CSV Sumotto)
- [CVE-2025-12091](https://cve.now/CVE-2025-12091.md): Search, Filters & Merchandising for WooCommerce \<= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation (CVSS 4.3, instantsearchplus Search, Filters & Merchandising for WooCo…)
- [CVE-2025-13857](https://cve.now/CVE-2025-13857.md): Yet Another WebClap for WordPress \<= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ksakai Yet Another WebClap for WordPress)
- [CVE-2025-13856](https://cve.now/CVE-2025-13856.md): Extra Post Images \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, michaelcole1991 Extra Post Images)
- [CVE-2025-13863](https://cve.now/CVE-2025-13863.md): RevInsite \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, krupenik RevInsite)
- [CVE-2025-13907](https://cve.now/CVE-2025-13907.md): CSS3 Buttons \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, tunilame CSS3 Buttons)
- [CVE-2025-12717](https://cve.now/CVE-2025-12717.md): List Attachments Shortcode \<= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode (CVSS 6.4, cgrymala List Attachments Shortcode)
- [CVE-2025-12577](https://cve.now/CVE-2025-12577.md): Listar – Directory Listing & Classifieds WordPress Plugin \<= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update (CVSS 4.3, passionui Listar – Directory Listing & Classifieds WordPres…)
- [CVE-2025-12715](https://cve.now/CVE-2025-12715.md): Canadian Nutrition Facts Label \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type (CVSS 6.4, emaude Canadian Nutrition Facts Label)
- [CVE-2025-13656](https://cve.now/CVE-2025-13656.md): Cute News Ticker \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (CVSS 6.4, arnabkumar Cute News Ticker)
- [CVE-2025-13899](https://cve.now/CVE-2025-13899.md): TR Timthumb \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, pntrinh TR Timthumb)
- [CVE-2025-13308](https://cve.now/CVE-2025-13308.md): Application Passwords \<= 0.1.3 - Reflected Cross-Site Scripting via reject\_url (CVSS 5.4, georgestephanis Application Passwords)
- [CVE-2025-13666](https://cve.now/CVE-2025-13666.md): Helloprint \<= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification (CVSS 5.3, Plug your WooCommerce into the largest catalog of customize…)
- [CVE-2025-13629](https://cve.now/CVE-2025-13629.md): WP Landing Page \<= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update (CVSS 4.3, xbenx WP Landing Page)
- [CVE-2025-12673](https://cve.now/CVE-2025-12673.md): Flex QR Code Generator \<= 1.2.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, ajitdas Flex QR Code Generator)
- [CVE-2025-12720](https://cve.now/CVE-2025-12720.md): g-FFL Cockpit \<= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion (CVSS 5.3, garidium g-FFL Cockpit)
- [CVE-2025-12574](https://cve.now/CVE-2025-12574.md): Listar – Directory Listing & Classifieds WordPress Plugin \<= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 4.3, passionui Listar – Directory Listing & Classifieds WordPres…)
- [CVE-2025-12721](https://cve.now/CVE-2025-12721.md): g-FFL Cockpit \<= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3, garidium g-FFL Cockpit)
- [CVE-2025-13896](https://cve.now/CVE-2025-13896.md): Social Feed Gallery Portfolio \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, wpdiscover Social Feed Gallery Portfolio)
- [CVE-2025-13898](https://cve.now/CVE-2025-13898.md): Ultra Skype Button \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn\_id' Shortcode Attribute (CVSS 6.4, sozan45 Ultra Skype Button)
- [CVE-2025-13137](https://cve.now/CVE-2025-13137.md): Live Sales Notification for Woocommerce – Woomotiv \<= 3.6.3 - Reflected Cross-Site Scripting (CVSS 6.1, delabon Live Sales Notification for Woocommerce – Woomotiv)
- [CVE-2025-13626](https://cve.now/CVE-2025-13626.md): myLCO \<= 0.8.1 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, realloc myLCO)
- [CVE-2025-14117](https://cve.now/CVE-2025-14117.md): fit2cloud Halo cross-site request forgery (CVSS 5.3, fit2cloud Halo)
- [CVE-2025-13292](https://cve.now/CVE-2025-13292.md): Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access. (CVSS 7.6, Google Cloud Apigee-X)
- [CVE-2025-13922](https://cve.now/CVE-2025-13922.md): Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI \<= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause (CVSS 6.5, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2025-12505](https://cve.now/CVE-2025-12505.md): weDocs \<= 2.1.14 - Missing Authorization to Settings Update (CVSS 5.4, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)
- [CVE-2025-11263](https://cve.now/CVE-2025-11263.md): Link Whisper Free \<= 0.8.8 - Reflected Cross-Site Scripting (CVSS 6.1, linkwhspr Link Whisper Free)
- [CVE-2025-12510](https://cve.now/CVE-2025-12510.md): Widgets for Google Reviews \<= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews (CVSS 7.2, trustindex Widgets for Google Reviews)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.