# CVEs published 2025-12-22

111 CVEs were published on December 22, 2025: 25 critical, 37 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-68615](https://cve.now/CVE-2025-68615.md): Net-SNMP snmptrapd crash (CVSS 9.8, net-snmp)
- [CVE-2025-68614](https://cve.now/CVE-2025-68614.md): LibreNMS Alert Rule API Cross-Site Scripting Vulnerability (CVSS 4.3, librenms · librenms/librenms)
- [CVE-2023-53964](https://cve.now/CVE-2023-53964.md): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset Vulnerability (CVSS 8.8, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2023-53963](https://cve.now/CVE-2023-53963.md): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection (CVSS 9.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2023-53962](https://cve.now/CVE-2023-53962.md): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write (CVSS 8.8, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2023-53961](https://cve.now/CVE-2023-53961.md): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery (CVSS 5.1, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2023-53960](https://cve.now/CVE-2023-53960.md): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass (CVSS 9.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2023-53955](https://cve.now/CVE-2023-53955.md): SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References (CVSS 9.3, SOUND4 Impact/Pulse/First · SOUND4 Impact/Pulse Eco +4)
- [CVE-2023-53981](https://cve.now/CVE-2023-53981.md): PhotoShow 3.0 Remote Code Execution via Exiftran Path Injection (CVSS 8.6, thibaud-rohmer PhotoShow)
- [CVE-2023-53980](https://cve.now/CVE-2023-53980.md): ProjectSend r1605 Remote Code Execution via File Extension Manipulation (CVSS 8.7, projectSend)
- [CVE-2023-53979](https://cve.now/CVE-2023-53979.md): MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities (CVSS 8.6, MyBB)
- [CVE-2023-53978](https://cve.now/CVE-2023-53978.md): myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements (CVSS 5.1, myBB forums)
- [CVE-2023-53977](https://cve.now/CVE-2023-53977.md): myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management (CVSS 5.1, myBB forums)
- [CVE-2023-53976](https://cve.now/CVE-2023-53976.md): myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management (CVSS 5.1, myBB forums)
- [CVE-2023-53975](https://cve.now/CVE-2023-53975.md): Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page (CVSS 9.3, thedigicraft Atom CMS)
- [CVE-2023-53974](https://cve.now/CVE-2023-53974.md): D-Link DSL-124 ME\_1.00 Backup Configuration File Disclosure via Unauthenticated Request (CVSS 8.8, D-Link DSL-124 Wireless N300 ADSL2+)
- [CVE-2023-53973](https://cve.now/CVE-2023-53973.md): Zillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine Module (CVSS 8.5, Zillya Total Security)
- [CVE-2023-53972](https://cve.now/CVE-2023-53972.md): WebTareas 2.4 Unauthenticated SQL Injection via Session Cookie Parameter (CVSS 9.3, luiswang WebTareas)
- [CVE-2023-53971](https://cve.now/CVE-2023-53971.md): WebTareas 2.4 Authenticated Remote Code Execution via File Upload (CVSS 8.7, luiswang WebTareas)
- [CVE-2023-53970](https://cve.now/CVE-2023-53970.md): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config (CVSS 8.7, DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C)
- [CVE-2023-53969](https://cve.now/CVE-2023-53969.md): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change (CVSS 9.3, DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C)
- [CVE-2023-53968](https://cve.now/CVE-2023-53968.md): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase Account (CVSS 9.3, DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C)
- [CVE-2023-53967](https://cve.now/CVE-2023-53967.md): Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change (CVSS 9.3, DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C)
- [CVE-2023-53966](https://cve.now/CVE-2023-53966.md): SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow (CVSS 9.3, SOUND4 LinkAndShare Transmitter)
- [CVE-2023-53965](https://cve.now/CVE-2023-53965.md): SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path (CVSS 8.6, SOUND4 Server Service)
- [CVE-2022-50690](https://cve.now/CVE-2022-50690.md): Wondershare MirrorGo 2.0.11.346 Local Privilege Escalation via Insecure File Permissions (CVSS 8.5, Wondershare MirrorGo)
- [CVE-2022-50689](https://cve.now/CVE-2022-50689.md): Cobian Reflector 0.9.93 RC1 Local Denial of Service via Password Field (CVSS 6.9, Cobiansoft Cobian Reflector)
- [CVE-2022-50688](https://cve.now/CVE-2022-50688.md): Cobian Backup Gravity 11.2.0.582 Unquoted Service Path Privilege Escalation (CVSS 8.5, Cobiansoft Cobian Backup Gravity)
- [CVE-2022-50687](https://cve.now/CVE-2022-50687.md): Cobian Backup 11 Gravity 11.2.0.582 Local Denial of Service via Password Field (CVSS 6.9, Cobiansoft Cobian Backup Gravity)
- [CVE-2021-47715](https://cve.now/CVE-2021-47715.md): Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection (CVSS 6.9, Hasura GraphQL)
- [CVE-2021-47714](https://cve.now/CVE-2021-47714.md): Hasura GraphQL 1.3.3 Local File Read via SQL Injection (CVSS 6.9, Hasura GraphQL)
- [CVE-2021-47713](https://cve.now/CVE-2021-47713.md): Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query (CVSS 8.7, Hasura GraphQL)
- [CVE-2025-68476](https://cve.now/CVE-2025-68476.md): KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential (CVSS 8.2, kedacore keda · github.com/kedacore/keda +1)
- [CVE-2025-68475](https://cve.now/CVE-2025-68475.md): Fedify has ReDoS Vulnerability in HTML Parsing Regex (CVSS 7.5, fedify-dev fedify · @fedify/fedify)
- [CVE-2025-34457](https://cve.now/CVE-2025-34457.md): wb2osz/direwolf \<= 1.8.1 Stack-based Buffer Overflow DoS (CVSS 8.7, wb2osz Dire Wolf)
- [CVE-2025-34458](https://cve.now/CVE-2025-34458.md): wb2osz/direwolf \<= 1.8.1 Reachable Assertion DoS (CVSS 8.7, wb2osz Dire Wolf)
- [CVE-2025-68480](https://cve.now/CVE-2025-68480.md): Marshmallow has DoS in Schema.load(many) (CVSS 5.3, marshmallow-code marshmallow · marshmallow)
- [CVE-2025-15033](https://cve.now/CVE-2025-15033.md): WooCommerce - Subscriber/Customer+ Order Data Disclosure (CVSS 6.5, Automattic WooCommerce)
- [CVE-2025-68337](https://cve.now/CVE-2025-68337.md): jbd2: avoid bug\_on in jbd2\_journal\_get\_create\_access() when file system corrupted (CVSS 7.5, Linux)
- [CVE-2025-68336](https://cve.now/CVE-2025-68336.md): locking/spinlock/debug: Fix data-race in do\_raw\_write\_lock (CVSS 7.5, Linux)
- [CVE-2025-68335](https://cve.now/CVE-2025-68335.md): comedi: pcl818: fix null-ptr-deref in pcl818\_ai\_cancel() (no CVSS, Linux)
- [CVE-2025-68334](https://cve.now/CVE-2025-68334.md): platform/x86/amd/pmc: Add support for Van Gogh SoC (no CVSS, Linux)
- [CVE-2025-68333](https://cve.now/CVE-2025-68333.md): sched\_ext: Fix possible deadlock in the deferred\_irq\_workfn() (no CVSS, Linux)
- [CVE-2025-68332](https://cve.now/CVE-2025-68332.md): comedi: c6xdigio: Fix invalid PNP driver unregistration (no CVSS, Linux)
- [CVE-2025-68331](https://cve.now/CVE-2025-68331.md): usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (no CVSS, Linux)
- [CVE-2025-68330](https://cve.now/CVE-2025-68330.md): iio: accel: bmc150: Fix irq assumption regression (no CVSS, Linux)
- [CVE-2025-68329](https://cve.now/CVE-2025-68329.md): tracing: Fix WARN\_ON in tracing\_buffers\_mmap\_close for split VMAs (no CVSS, Linux)
- [CVE-2025-68328](https://cve.now/CVE-2025-68328.md): firmware: stratix10-svc: fix bug in saving controller data (no CVSS, Linux)
- [CVE-2025-68327](https://cve.now/CVE-2025-68327.md): usb: renesas\_usbhs: Fix synchronous external abort on unbind (no CVSS, Linux)
- [CVE-2025-68326](https://cve.now/CVE-2025-68326.md): drm/xe/guc: Fix stack\_depot usage (no CVSS, Linux)
- [CVE-2025-10021](https://cve.now/CVE-2025-10021.md): A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. (CVSS 7.0, Open Design Alliance ODA Drawings SDK - All Versions \<)
- [CVE-2025-61740](https://cve.now/CVE-2025-61740.md): Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error (CVSS 7.2, Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG)
- [CVE-2025-26379](https://cve.now/CVE-2025-26379.md): Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator (CVSS 7.2, Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG)
- [CVE-2025-14018](https://cve.now/CVE-2025-14018.md): Unquoted Service Path in NetBT Consultancy's e-Fatura (CVSS 7.3, NetBT Consulting Services e-Fatura)
- [CVE-2025-14273](https://cve.now/CVE-2025-14273.md): Mattermost Jira plugin user spoofing enables Jira request forgery. (CVSS 7.2, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2025-54890](https://cve.now/CVE-2025-54890.md): A user with elevated privileges can inject XSS in the Hostgroups configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-12514](https://cve.now/CVE-2025-12514.md): A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters (CVSS 7.2, Centreon Infra Monitoring - Open-tickets)
- [CVE-2025-8460](https://cve.now/CVE-2025-8460.md): A user with elevated privileges can inject XSS in the Notification rules configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-61739](https://cve.now/CVE-2025-61739.md): Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption (CVSS 7.2, Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG)
- [CVE-2025-61738](https://cve.now/CVE-2025-61738.md): Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information (CVSS 2.3, Johnson Controls IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG)
- [CVE-2025-62094](https://cve.now/CVE-2025-62094.md): WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin \<= 2.0.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, voidthemes Void Elementor WHMCS Elements For Elementor Page…)
- [CVE-2025-62107](https://cve.now/CVE-2025-62107.md): WordPress Feather Login Page plugin \<= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PluginOps Feather Login Page)
- [CVE-2025-62880](https://cve.now/CVE-2025-62880.md): WordPress Custom 404 Pro plugin \<= 3.12.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Kunal Custom 404 Pro)
- [CVE-2025-8305](https://cve.now/CVE-2025-8305.md): Information Disclosure in Identity Agent Debug Files (CVSS 6.5, checkpoint Identity Awareness)
- [CVE-2025-8304](https://cve.now/CVE-2025-8304.md): Information Disclosure in Identity Agent Registry Keys (CVSS 6.5, checkpoint Identity Agent)
- [CVE-2025-11545](https://cve.now/CVE-2025-11545.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions projectors allows a atta (CVSS 9.5, Sharp Display Solutions NP-PA1705UL-W, NP-PA1705UL-W+, N… +2)
- [CVE-2025-11544](https://cve.now/CVE-2025-11544.md): Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauth (CVSS 9.5, Sharp Display Solutions NP-P627UL, NP-P627ULG, NP-P627UL+,…)
- [CVE-2025-11543](https://cve.now/CVE-2025-11543.md): Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauth (CVSS 9.5, Sharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…)
- [CVE-2025-11542](https://cve.now/CVE-2025-11542.md): Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and program (CVSS 8.4, Sharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…)
- [CVE-2025-11541](https://cve.now/CVE-2025-11541.md): Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and program (CVSS 9.2, Sharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…)
- [CVE-2025-11540](https://cve.now/CVE-2025-11540.md): Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector. (CVSS 9.1, Sharp Display Solutions NP-P502HL-2, NP-P502WL-2, NP-P502HL…)
- [CVE-2025-12049](https://cve.now/CVE-2025-12049.md): Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may (CVSS 9.2, Sharp Display Solutions Media Player MP-01)
- [CVE-2025-15014](https://cve.now/CVE-2025-15014.md): loganhong php loganSite Article article\_detail.php sql injection (CVSS 5.3, loganhong php loganSite)
- [CVE-2025-15013](https://cve.now/CVE-2025-15013.md): floooh sokol sokol\_gfx.h \_sg\_validate\_pipeline\_desc stack-based overflow (CVSS 4.8, floooh sokol)
- [CVE-2025-15012](https://cve.now/CVE-2025-15012.md): code-projects Refugee Food Management System home.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15011](https://cve.now/CVE-2025-15011.md): code-projects Simple Stock System logout.php sql injection (CVSS 6.9, code-projects Simple Stock System)
- [CVE-2025-15016](https://cve.now/CVE-2025-15016.md): Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key (CVSS 9.3, Ragic Enterprise Cloud Database)
- [CVE-2025-15015](https://cve.now/CVE-2025-15015.md): Ragic｜Enterprise Cloud Database - Arbitrary File Read (CVSS 8.7, Ragic Enterprise Cloud Database)
- [CVE-2025-15010](https://cve.now/CVE-2025-15010.md): Tenda WH450 SafeUrlFilter stack-based overflow (CVSS 9.3, Tenda WH450)
- [CVE-2025-59301](https://cve.now/CVE-2025-59301.md): Modbus/TCP Dos Vulnerability in DVP15MC11T (CVSS 4.0, Delta Electronics DVP15MC11T)
- [CVE-2025-15009](https://cve.now/CVE-2025-15009.md): liweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted upload (CVSS 5.3, liweiyi ChestnutCMS)
- [CVE-2025-15008](https://cve.now/CVE-2025-15008.md): Tenda WH450 HTTP Request L7Port stack-based overflow (CVSS 6.9, Tenda WH450)
- [CVE-2025-15007](https://cve.now/CVE-2025-15007.md): Tenda WH450 HTTP Request L7Im stack-based overflow (CVSS 9.3, Tenda WH450)
- [CVE-2025-15006](https://cve.now/CVE-2025-15006.md): Tenda WH450 HTTP Request CheckTools stack-based overflow (CVSS 9.3, Tenda WH450)
- [CVE-2025-15005](https://cve.now/CVE-2025-15005.md): CouchCMS reCAPTCHA config.example.php hard-coded key (CVSS 6.3, CouchCMS)
- [CVE-2025-15004](https://cve.now/CVE-2025-15004.md): DedeCMS freelist\_main.php sql injection (CVSS 5.3, DedeCMS)
- [CVE-2024-25812](https://cve.now/CVE-2024-25812.md): MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter. (CVSS 6.1)
- [CVE-2024-25814](https://cve.now/CVE-2024-25814.md): MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter. (CVSS 6.1)
- [CVE-2024-27708](https://cve.now/CVE-2024-27708.md): Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary (CVSS 9.6)
- [CVE-2024-35321](https://cve.now/CVE-2024-35321.md): MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter. (CVSS 4.3)
- [CVE-2025-26787](https://cve.now/CVE-2025-26787.md): An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. (CVSS 4.7)
- [CVE-2025-63662](https://cve.now/CVE-2025-63662.md): Insecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access sensitive i (CVSS 7.5)
- [CVE-2025-63663](https://cve.now/CVE-2025-63663.md): Incorrect access control in the /api/v1/conversations/\*/files API of GT Edge AI Platform before v2.0.10 allows unauthorized attackers to acc (CVSS 7.5)
- [CVE-2025-63664](https://cve.now/CVE-2025-63664.md): Incorrect access control in the /api/v1/conversations/\*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers (CVSS 7.5)
- [CVE-2025-65270](https://cve.now/CVE-2025-65270.md): Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute (CVSS 6.1)
- [CVE-2025-65790](https://cve.now/CVE-2025-65790.md): A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. (CVSS 6.1)
- [CVE-2025-65817](https://cve.now/CVE-2025-65817.md): LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start\_app.sh. (CVSS 8.8)
- [CVE-2025-65837](https://cve.now/CVE-2025-65837.md): PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. (CVSS 5.4)
- [CVE-2025-65856](https://cve.now/CVE-2025-65856.md): Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti (CVSS 9.8)
- [CVE-2025-65857](https://cve.now/CVE-2025-65857.md): An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. (CVSS 7.5)
- [CVE-2025-66735](https://cve.now/CVE-2025-66735.md): youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2025-66736](https://cve.now/CVE-2025-66736.md): youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. (CVSS 7.1)
- [CVE-2025-67288](https://cve.now/CVE-2025-67288.md): An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. (CVSS 10.0, Umbraco.Cms)
- [CVE-2025-67289](https://cve.now/CVE-2025-67289.md): An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via (CVSS 9.6)
- [CVE-2025-67290](https://cve.now/CVE-2025-67290.md): A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web (CVSS 6.1, Piranha)
- [CVE-2025-67291](https://cve.now/CVE-2025-67291.md): A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts (CVSS 6.1, Piranha)
- [CVE-2025-67418](https://cve.now/CVE-2025-67418.md): ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrat (CVSS 9.8)
- [CVE-2025-67436](https://cve.now/CVE-2025-67436.md): Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP (CVSS 6.5)
- [CVE-2025-67443](https://cve.now/CVE-2025-67443.md): Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2025-67826](https://cve.now/CVE-2025-67826.md): An issue was discovered in K7 Ultimate Security 17.0.2045. (CVSS 7.7)
- [CVE-2025-68645](https://cve.now/CVE-2025-68645.md): A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper (CVSS 8.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.