CVEs published December 19, 2025
110 CVEs were published on December 19, 2025: 11 critical, 33 high. 3 are now in CISA KEV.
- Published
- 110
- Critical
- 11
- High
- 33
- Medium
- 60
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 37
Most affected products
- Foxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- 7
- Foxit Software pdfonline.foxit.com
- 6
- Mintlify Platform
- 5
- code-projects Scholars Tracking System
- 3
- code-projects Simple Stock System
- 3
- galette
- 3
- Open5GS
- 3
- Restajet Information Technologies Online Food Delivery Syst…
- 3
- code-projects Simple Blood Donor Management System
- 2
- CodeAstro Real Estate Management System
- 2
Critical 11
- CVE-2025-68613n8n Vulnerable to Remote Code Execution via Expression Injectionn8n-io n8n · n8n
- CVE-2023-53950InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulationinnovastudio WYSIWYG Editor
- CVE-2023-53951Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secretever gauzy
- CVE-2023-53948Lilac-Reloaded for Nagios 2.0.8 Remote Code Execution via Autodiscoverycat03 Lilac-Reloaded
- CVE-2025-14964TOTOLINK T10 cstecgi.cgi sprintf stack-based overflowTOTOLINK T10
- CVE-2025-66580Dive has Cross-Site Scripting vulnerability that can escalate to Remote Code ExecutionOpenAgentPlatform Dive
- CVE-2024-49587Glutton V1 endpoints missing authenticationcom.palantir.gotham:glutton
- CVE-2025-34433AVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltWorld Wide Broadcast Network AVideo
- CVE-2025-1928Improper Authentication in Restajet's Online Food Delivery SystemRestajet Information Technologies Online Food Delivery Syst…
- CVE-2025-14733WatchGuard Firebox iked Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2025-63665An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON pay
High 33
- CVE-2023-53959FileZilla Client 3.63.1 DLL Hijacking via Missing TextShaping.dllfilezilla-project FileZilla Client
- CVE-2023-53958LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Headerltb-project LDAP Tool Box Self Service Password
- CVE-2023-53957Kimai 1.30.10 SameSite Cookie Vulnerability Session HijackingKimai · kimai/kimai
- CVE-2023-53956Flatnux 2021-03.25 Authenticated File Upload Remote Code Executionaltervista flatnux
- CVE-2023-53954ActFax 10.10 Unquoted Path Services Privilege Escalation VulnerabilityActFax
- CVE-2023-53952Dotclear 2.25.3 Authenticated Remote Code Execution via File UploadDotclear
- CVE-2023-53949AspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission VulnerabilityAspEmail
- CVE-2023-53947OCS Inventory NG 2.3.0.0 Unquoted Service Path Privilege Escalationoscinventory OCS Inventory NG
- CVE-2023-53946Arcsoft PhotoStudio 6.0.0.172 Unquoted Service Path Privilege EscalationArcsoft PhotoStudio
- CVE-2023-53945BrainyCP 1.0 Remote Code Execution via Authenticated Crontab ManipulationBrainyCP
- CVE-2025-68478Langflow Vulnerable to External Control of File Name or Pathlangflow-ai langflow · langflow
- CVE-2025-68477Langflow vulnerable to Server-Side Request Forgerylangflow-ai langflow · langflow
- CVE-2025-14809Address bar spoofing risk in ArcSearch on AndroidThe Browser Company of New York ArcSearch
- CVE-2025-14812Address bar spoofing risk in Arc Search on iOSThe Browser Company of New York ArcSearch
- CVE-2025-1927CSRF in Restajet's Online Food Delivery SystemRestajet Information Technologies Online Food Delivery Syst…
- CVE-2025-14847Zlib compressed protocol header length confusion may allow memory readMongoDB Server
- CVE-2025-66524Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject ProcessorApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2025-14151SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scriptingveronalabs SlimStat Analytics
- CVE-2025-66499Foxit PDF Reader PDF Parsing Heap-Based Buffer Overflow Remote Code Execution VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-66495Foxit PDF Reader Annotation Use-After-Free Remote Code Execution VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-66494Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-66493Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2025-13008Session Token Disclosure in M-Files WebM-Files Server
- CVE-2025-13999HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgerybplugins HTML5 Audio Player – The Ultimate No-Code Podcast,…
- CVE-2025-13307Ocean Modal Window < 2.3.3 - Editor+ Remote Code Execution via Modal ConditionsOcean Modal Window
- CVE-2025-13941Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-52692Bypass AuthenticationLinksys E9450-SG
- CVE-2025-11774Malicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works64Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5
- CVE-2025-50681igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service (application crash) via a crafted IGMPv3 membership
- CVE-2025-66905The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesyst
- CVE-2025-66909Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability.
- CVE-2025-67442EVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal.
- CVE-2025-67843A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attacMintlify Platform
Medium, low and unrated 66
- CVE-2023-53953WebsiteBaker 2.13.3 Stored Cross-Site Scripting via Page CreationWebsiteBaker
- CVE-2025-68481FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSOfastapi-users
- CVE-2025-67712HTML injection issue in ArcGIS Web App BuilderEsri ArcGIS Web AppBuilder {Developer Edition)
- CVE-2025-14968code-projects Simple Stock System update.php sql injectioncode-projects Simple Stock System
- CVE-2025-12874HTTP Request Smuggling in Quest Coexistence Manager for NotesQuest Coexistence Manager for Notes
- CVE-2025-14967itsourcecode Student Management System candidates_report.php sql injectionitsourcecode Student Management System
- CVE-2025-14966FastAdmin Backend Controller Backend.php selectpage sql injectionFastAdmin
- CVE-2025-149651541492390c yougou-mall ResourceController.java delete path traversal1541492390c yougou-mall
- CVE-2025-14962code-projects Simple Stock System chatuser.php cross site scriptingcode-projects Simple Stock System
- CVE-2025-14961code-projects Simple Blood Donor Management System editedcampaign.php sql injectioncode-projects Simple Blood Donor Management System
- CVE-2025-14960code-projects Simple Blood Donor Management System editeddonor.php sql injectioncode-projects Simple Blood Donor Management System
- CVE-2025-14959code-projects Simple Stock System signup.php sql injectioncode-projects Simple Stock System
- CVE-2025-14958floooh sokol sokol_gfx.h _sg_pipeline_common_init heap-based overflowfloooh sokol
- CVE-2025-68430CVAT vulnerable to directory traversal via mounted share listingcvat-ai cvat
- CVE-2025-14957WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereferenceWebAssembly Binaryen
- CVE-2025-68457Orejime has executable code in HTML attributesboscop-fr orejime · orejime
- CVE-2025-65035GLPI Database Inventory Plugin Vulnerable to Stored Object InjectionpluginsGLPI databaseinventory
- CVE-2023-30971Gaia unauthenticated endpointscom.palantir.acme.gaia:gaia
- CVE-2025-14956WebAssembly Binaryen wasm-binary.cpp readExport heap-based overflowWebAssembly Binaryen
- CVE-2025-14955Open5GS PFCP handler.c ogs_pfcp_handle_create_pdr initializationOpen5GS
- CVE-2025-58053Galette has a privilege escalation vulnerabilitygalette
- CVE-2025-58052Galette has groups managers access control bypass on Membersgalette
- CVE-2025-14954Open5GS QER/FAR/URR/PDR context.c ogs_pfcp_qer_find_or_add assertionOpen5GS
- CVE-2025-14953Open5GS FAR-ID handler.c ogs_pfcp_handle_create_pdr null pointer dereferenceOpen5GS
- CVE-2025-53922Galette has access control bypassgalette
- CVE-2025-14952Campcodes Supplier Management System add_category.php sql injectionCampcodes Supplier Management System
- CVE-2025-14951code-projects Scholars Tracking System home.php sql injectioncode-projects Scholars Tracking System
- CVE-2025-14950code-projects Scholars Tracking System delete_post.php sql injectioncode-projects Scholars Tracking System
- CVE-2025-14946Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uriRed Hat libnbd · Red Hat Enterprise Linux +1
- CVE-2025-14881Insecure direct object referencepretix
- CVE-2025-14882Insecure direct object referencepretix-offlinesales · pretix
- CVE-2025-1885Open Redirect in Restajet's Online Food Delivery SystemRestajet Information Technologies Online Food Delivery Syst…
- CVE-2025-14455Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Managementwpchill Image Photo Gallery Final Tiles Grid
- CVE-2025-12361myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposuresaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2025-11747Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeextendthemes Colibri Page Builder
- CVE-2025-66522Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name FieldFoxit Software pdfonline.foxit.com
- CVE-2025-66521Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Trusted Certificates FeatureFoxit Software pdfonline.foxit.com
- CVE-2025-66520Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG HandlingFoxit Software pdfonline.foxit.com
- CVE-2025-66519Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import FunctionalityFoxit Software pdfonline.foxit.com
- CVE-2025-66502Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates FeatureFoxit Software pdfonline.foxit.com
- CVE-2025-66501Foxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text FeatureFoxit Software pdfonline.foxit.com
- CVE-2025-66500Foxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage VulnerabilityFoxit Software webplugins.foxit.com
- CVE-2025-66498Foxit PDF Reader 3D Annotation Out-of-Bounds Memory Access VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-66497Foxit PDF Reader 3D Annotation Out-of-Bounds Memory Access VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-66496Foxit PDF Reader 3D Annotation Out-of-Bounds Memory Access VulnerabilityFoxit Software Foxit PDF Reader · Foxit Software Foxit PDF…
- CVE-2025-14449BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcodebookingalgorithms BA Book Everything
- CVE-2025-13754Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposurecroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2025-66174There is an improper authentication vulnerability in some Hikvision DVR products.Hikvision DS-7104HGHI-F1 · Hikvision DS-7204HGHI-F1
- CVE-2025-66173There is a privilege escalation vulnerability in some Hikvision DVR products.Hikvision DS-7104HGHI-F1 · Hikvision DS-7204HGHI-F1
- CVE-2025-14267Unintended temporary cached data included in a structure only copy intended to be empty of dataM-Files Server
- CVE-2025-14546Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the fastapi-sso
- CVE-2025-14940code-projects Scholars Tracking System delete_user.php sql injectioncode-projects Scholars Tracking System
- CVE-2025-14939code-projects Online Appointment Booking System deletemanager.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-14910Edimax BR-6208AC FTP Daemon Service handle_retr path traversalEdimax BR-6208AC
- CVE-2025-14909JeecgBoot SysUserOnlineController.java SysUserOnlineController user sessionJeecgBoot
- CVE-2025-14908JeecgBoot Multi-Tenant Management SysTenantController.java improper authenticationJeecgBoot
- CVE-2025-14900CodeAstro Real Estate Management System Administrator Endpoint userdelete.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-14899CodeAstro Real Estate Management System Administrator Endpoint stateadd.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-66906Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.
- CVE-2025-66908Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functio
- CVE-2025-66910Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system.
- CVE-2025-66911Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality.
- CVE-2025-67842The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomainMintlify Platform
- CVE-2025-67844The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the reMintlify Platform
- CVE-2025-67845A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to injMintlify Platform
- CVE-2025-67846The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgradMintlify Platform