CVEs published December 22, 2025
111 CVEs were published on December 22, 2025: 25 critical, 37 high. 1 is now in CISA KEV.
- Published
- 111
- Critical
- 25
- High
- 37
- Medium
- 38
- Low
- 1
- Unrated
- 10
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Linux
- 12
- SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- 6
- DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C
- 4
- Sharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…
- 4
- Tenda WH450
- 4
- Hasura GraphQL
- 3
- Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- 3
- myBB forums
- 3
- Centreon Infra Monitoring
- 2
- Cobiansoft Cobian Backup Gravity
- 2
Critical 25
- CVE-2025-68615Net-SNMP snmptrapd crashnet-snmp
- CVE-2023-53963SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command InjectionSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2023-53960SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication BypassSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2023-53955SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object ReferencesSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2023-53975Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Pagethedigicraft Atom CMS
- CVE-2023-53972WebTareas 2.4 Unauthenticated SQL Injection via Session Cookie Parameterluiswang WebTareas
- CVE-2023-53969Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password ChangeDB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C
- CVE-2023-53968Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase AccountDB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C
- CVE-2023-53967Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password ChangeDB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C
- CVE-2023-53966SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer OverflowSOUND4 LinkAndShare Transmitter
- CVE-2025-11545Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions projectors allows a attaSharp Display Solutions NP-PA1705UL-W, NP-PA1705UL-W+, N… +2
- CVE-2025-11544Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthSharp Display Solutions NP-P627UL, NP-P627ULG, NP-P627UL+,…
- CVE-2025-11543Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthSharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…
- CVE-2025-11541Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programSharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…
- CVE-2025-11540Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector.Sharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…
- CVE-2025-12049Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may Sharp Display Solutions Media Player MP-01
- CVE-2025-15016Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic KeyRagic Enterprise Cloud Database
- CVE-2025-15010Tenda WH450 SafeUrlFilter stack-based overflowTenda WH450
- CVE-2025-15007Tenda WH450 HTTP Request L7Im stack-based overflowTenda WH450
- CVE-2025-15006Tenda WH450 HTTP Request CheckTools stack-based overflowTenda WH450
- CVE-2024-27708Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary
- CVE-2025-65856Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti
- CVE-2025-67288An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.Umbraco.Cms
- CVE-2025-67289An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via
- CVE-2025-67418ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrat
High 37
- CVE-2023-53964SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset VulnerabilitySOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2023-53962SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File WriteSOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2023-53981PhotoShow 3.0 Remote Code Execution via Exiftran Path Injectionthibaud-rohmer PhotoShow
- CVE-2023-53980ProjectSend r1605 Remote Code Execution via File Extension ManipulationprojectSend
- CVE-2023-53979MyBB 1.8.32 Authenticated Remote Code Execution via Chained VulnerabilitiesMyBB
- CVE-2023-53974D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated RequestD-Link DSL-124 Wireless N300 ADSL2+
- CVE-2023-53973Zillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine ModuleZillya Total Security
- CVE-2023-53971WebTareas 2.4 Authenticated Remote Code Execution via File Uploadluiswang WebTareas
- CVE-2023-53970Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board ConfigDB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C
- CVE-2023-53965SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service PathSOUND4 Server Service
- CVE-2022-50690Wondershare MirrorGo 2.0.11.346 Local Privilege Escalation via Insecure File PermissionsWondershare MirrorGo
- CVE-2022-50688Cobian Backup Gravity 11.2.0.582 Unquoted Service Path Privilege EscalationCobiansoft Cobian Backup Gravity
- CVE-2021-47713Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL QueryHasura GraphQL
- CVE-2025-68476KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credentialkedacore keda · github.com/kedacore/keda +1
- CVE-2025-68475Fedify has ReDoS Vulnerability in HTML Parsing Regexfedify-dev fedify · @fedify/fedify
- CVE-2025-34457wb2osz/direwolf <= 1.8.1 Stack-based Buffer Overflow DoSwb2osz Dire Wolf
- CVE-2025-34458wb2osz/direwolf <= 1.8.1 Reachable Assertion DoSwb2osz Dire Wolf
- CVE-2025-68337jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corruptedLinux
- CVE-2025-68336locking/spinlock/debug: Fix data-race in do_raw_write_lockLinux
- CVE-2025-10021A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12.Open Design Alliance ODA Drawings SDK - All Versions <
- CVE-2025-61740Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation ErrorJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- CVE-2025-26379Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number GeneratorJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- CVE-2025-14018Unquoted Service Path in NetBT Consultancy's e-FaturaNetBT Consulting Services e-Fatura
- CVE-2025-14273Mattermost Jira plugin user spoofing enables Jira request forgery.Mattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2025-12514A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parametersCentreon Infra Monitoring - Open-tickets
- CVE-2025-61739Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryptionJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- CVE-2025-11542Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programSharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…
- CVE-2025-15015Ragic｜Enterprise Cloud Database - Arbitrary File ReadRagic Enterprise Cloud Database
- CVE-2025-63662Insecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access sensitive i
- CVE-2025-63663Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI Platform before v2.0.10 allows unauthorized attackers to acc
- CVE-2025-63664Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers
- CVE-2025-65817LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.
- CVE-2025-65857An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.
- CVE-2025-66735youlai-boot V2.21.1 is vulnerable to Incorrect Access Control.
- CVE-2025-66736youlai-boot V2.21.1 is vulnerable to Incorrect Access Control.
- CVE-2025-67826An issue was discovered in K7 Ultimate Security 17.0.2045.
- CVE-2025-68645A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper
Medium, low and unrated 49
- CVE-2025-68614LibreNMS Alert Rule API Cross-Site Scripting Vulnerabilitylibrenms · librenms/librenms
- CVE-2023-53961SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request ForgerySOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4
- CVE-2023-53978myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum AnnouncementsmyBB forums
- CVE-2023-53977myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum ManagementmyBB forums
- CVE-2023-53976myBB Forums 1.8.26 Stored Cross-Site Scripting via Template ManagementmyBB forums
- CVE-2022-50689Cobian Reflector 0.9.93 RC1 Local Denial of Service via Password FieldCobiansoft Cobian Reflector
- CVE-2022-50687Cobian Backup 11 Gravity 11.2.0.582 Local Denial of Service via Password FieldCobiansoft Cobian Backup Gravity
- CVE-2021-47715Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema InjectionHasura GraphQL
- CVE-2021-47714Hasura GraphQL 1.3.3 Local File Read via SQL InjectionHasura GraphQL
- CVE-2025-68480Marshmallow has DoS in Schema.load(many)marshmallow-code marshmallow · marshmallow
- CVE-2025-15033WooCommerce - Subscriber/Customer+ Order Data DisclosureAutomattic WooCommerce
- CVE-2025-68335comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()Linux
- CVE-2025-68334platform/x86/amd/pmc: Add support for Van Gogh SoCLinux
- CVE-2025-68333sched_ext: Fix possible deadlock in the deferred_irq_workfn()Linux
- CVE-2025-68332comedi: c6xdigio: Fix invalid PNP driver unregistrationLinux
- CVE-2025-68331usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transferLinux
- CVE-2025-68330iio: accel: bmc150: Fix irq assumption regressionLinux
- CVE-2025-68329tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAsLinux
- CVE-2025-68328firmware: stratix10-svc: fix bug in saving controller dataLinux
- CVE-2025-68327usb: renesas_usbhs: Fix synchronous external abort on unbindLinux
- CVE-2025-68326drm/xe/guc: Fix stack_depot usageLinux
- CVE-2025-54890A user with elevated privileges can inject XSS in the Hostgroups configuration pageCentreon Infra Monitoring
- CVE-2025-8460A user with elevated privileges can inject XSS in the Notification rules configuration pageCentreon Infra Monitoring
- CVE-2025-61738Johnson Controls PowerG and IQPanel cleartext transmission of sensitive informationJohnson Controls IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
- CVE-2025-62094WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0.1.2 - Cross Site Scripting (XSS) vulnerabilityvoidthemes Void Elementor WHMCS Elements For Elementor Page…
- CVE-2025-62107WordPress Feather Login Page plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerabilityPluginOps Feather Login Page
- CVE-2025-62880WordPress Custom 404 Pro plugin <= 3.12.0 - Cross Site Request Forgery (CSRF) vulnerabilityKunal Custom 404 Pro
- CVE-2025-8305Information Disclosure in Identity Agent Debug Filescheckpoint Identity Awareness
- CVE-2025-8304Information Disclosure in Identity Agent Registry Keyscheckpoint Identity Agent
- CVE-2025-15014loganhong php loganSite Article article_detail.php sql injectionloganhong php loganSite
- CVE-2025-15013floooh sokol sokol_gfx.h _sg_validate_pipeline_desc stack-based overflowfloooh sokol
- CVE-2025-15012code-projects Refugee Food Management System home.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15011code-projects Simple Stock System logout.php sql injectioncode-projects Simple Stock System
- CVE-2025-59301Modbus/TCP Dos Vulnerability in DVP15MC11TDelta Electronics DVP15MC11T
- CVE-2025-15009liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted uploadliweiyi ChestnutCMS
- CVE-2025-15008Tenda WH450 HTTP Request L7Port stack-based overflowTenda WH450
- CVE-2025-15005CouchCMS reCAPTCHA config.example.php hard-coded keyCouchCMS
- CVE-2025-15004DedeCMS freelist_main.php sql injectionDedeCMS
- CVE-2024-25812MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.
- CVE-2024-25814MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.
- CVE-2024-35321MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
- CVE-2025-26787An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2.
- CVE-2025-65270Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute
- CVE-2025-65790A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface.
- CVE-2025-65837PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.
- CVE-2025-67290A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary webPiranha
- CVE-2025-67291A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scriptsPiranha
- CVE-2025-67436Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP
- CVE-2025-67443Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS).