# CVEs published 2025-12-23 154 CVEs were published on December 23, 2025: 28 critical, 90 high. Days are UTC. - [CVE-2025-15049](https://cve.now/CVE-2025-15049.md): code-projects Online Farm System addProduct.php sql injection (CVSS 6.9, code-projects Online Farm System) - [CVE-2025-68696](https://cve.now/CVE-2025-68696.md): httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage (CVSS 7.8, jnunemaker httparty · httparty) - [CVE-2025-68665](https://cve.now/CVE-2025-68665.md): LangChain serialization injection vulnerability enables secret extraction (CVSS 8.6, langchain-ai langchainjs · @langchain/core +1) - [CVE-2025-68669](https://cve.now/CVE-2025-68669.md): 5ire vulnerable to Remote Code Execution (RCE) via mermaid (CVSS 9.7, nanbingxyz 5ire) - [CVE-2025-68664](https://cve.now/CVE-2025-68664.md): LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs (CVSS 9.3, langchain-ai langchain · langchain-core) - [CVE-2025-68667](https://cve.now/CVE-2025-68667.md): Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue (CVSS 9.9, continuwuity) - [CVE-2025-68617](https://cve.now/CVE-2025-68617.md): Use after free in fluidsynth (CVSS 7.0, fluidsynth) - [CVE-2025-15048](https://cve.now/CVE-2025-15048.md): Tenda WH450 HTTP Request CheckTools command injection (CVSS 6.9, Tenda WH450) - [CVE-2025-66213](https://cve.now/CVE-2025-66213.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path (CVSS 9.4, coollabsio coolify) - [CVE-2025-66212](https://cve.now/CVE-2025-66212.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename (CVSS 9.4, coollabsio coolify) - [CVE-2025-15047](https://cve.now/CVE-2025-15047.md): Tenda WH450 HTTP Request PPTPDClient stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2025-66211](https://cve.now/CVE-2025-66211.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename (CVSS 9.4, coollabsio coolify) - [CVE-2025-66210](https://cve.now/CVE-2025-66210.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import (CVSS 9.4, coollabsio coolify) - [CVE-2025-12491](https://cve.now/CVE-2025-12491.md): Senstar Symphony FetchStoredLicense Information Disclosure Vulnerability (CVSS 7.5, Senstar Symphony) - [CVE-2025-13700](https://cve.now/CVE-2025-13700.md): DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability (CVSS 7.2, DreamFactory) - [CVE-2025-66209](https://cve.now/CVE-2025-66209.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup (CVSS 10.0, coollabsio coolify) - [CVE-2025-12840](https://cve.now/CVE-2025-12840.md): Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Academy Software Foundation OpenEXR) - [CVE-2025-12839](https://cve.now/CVE-2025-12839.md): Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Academy Software Foundation OpenEXR) - [CVE-2025-12495](https://cve.now/CVE-2025-12495.md): Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Academy Software Foundation OpenEXR) - [CVE-2025-12838](https://cve.now/CVE-2025-12838.md): MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability (CVSS 7.3, MSP360 Free Backup) - [CVE-2025-13699](https://cve.now/CVE-2025-13699.md): MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability (CVSS 7.0, MariaDB) - [CVE-2025-13698](https://cve.now/CVE-2025-13698.md): Deciso OPNsense diag\_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability (CVSS 4.5, Deciso OPNsense) - [CVE-2025-13715](https://cve.now/CVE-2025-13715.md): Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent FaceDetection-DSFD) - [CVE-2025-13709](https://cve.now/CVE-2025-13709.md): Tencent TFace restore\_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent TFace) - [CVE-2025-13711](https://cve.now/CVE-2025-13711.md): Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent TFace) - [CVE-2025-13706](https://cve.now/CVE-2025-13706.md): Tencent PatrickStar merge\_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent PatrickStar) - [CVE-2025-13708](https://cve.now/CVE-2025-13708.md): Tencent NeuralNLP-NeuralClassifier \_load\_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent NeuralNLP-NeuralClassifier) - [CVE-2025-13716](https://cve.now/CVE-2025-13716.md): Tencent MimicMotion create\_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent MimicMotion) - [CVE-2025-13714](https://cve.now/CVE-2025-13714.md): Tencent MedicalNet generate\_model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent MedicalNet) - [CVE-2025-13710](https://cve.now/CVE-2025-13710.md): Tencent HunyuanVideo load\_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent HunyuanVideo) - [CVE-2025-13707](https://cve.now/CVE-2025-13707.md): Tencent HunyuanDiT model\_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent HunyuanDiT) - [CVE-2025-13712](https://cve.now/CVE-2025-13712.md): Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent HunyuanDiT) - [CVE-2025-13713](https://cve.now/CVE-2025-13713.md): Tencent Hunyuan3D-1 load\_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Tencent Hunyuan3D-1) - [CVE-2025-15046](https://cve.now/CVE-2025-15046.md): Tenda WH450 HTTP Request PPTPClient stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2025-14425](https://cve.now/CVE-2025-14425.md): GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP) - [CVE-2025-14424](https://cve.now/CVE-2025-14424.md): GIMP XCF File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, GIMP) - [CVE-2025-14423](https://cve.now/CVE-2025-14423.md): GIMP LBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP) - [CVE-2025-14422](https://cve.now/CVE-2025-14422.md): GIMP PNM File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP) - [CVE-2025-13703](https://cve.now/CVE-2025-13703.md): VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.8, VIPRE Advanced Security) - [CVE-2025-14414](https://cve.now/CVE-2025-14414.md): Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.8, Soda PDF Desktop) - [CVE-2025-14415](https://cve.now/CVE-2025-14415.md): Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.0, Soda PDF Desktop) - [CVE-2025-14413](https://cve.now/CVE-2025-14413.md): Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, Soda PDF Desktop) - [CVE-2025-14412](https://cve.now/CVE-2025-14412.md): Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.8, Soda PDF Desktop) - [CVE-2025-14411](https://cve.now/CVE-2025-14411.md): Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Soda PDF Desktop) - [CVE-2025-14410](https://cve.now/CVE-2025-14410.md): Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Soda PDF Desktop) - [CVE-2025-14409](https://cve.now/CVE-2025-14409.md): Soda PDF Desktop PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Soda PDF Desktop) - [CVE-2025-14408](https://cve.now/CVE-2025-14408.md): Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Soda PDF Desktop) - [CVE-2025-14407](https://cve.now/CVE-2025-14407.md): Soda PDF Desktop PDF File Parsing Memory Corruption Information Disclosure Vulnerability (CVSS 3.3, Soda PDF Desktop) - [CVE-2025-14406](https://cve.now/CVE-2025-14406.md): Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, Soda PDF Desktop) - [CVE-2025-14421](https://cve.now/CVE-2025-14421.md): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, pdfforge PDF Architect) - [CVE-2025-14420](https://cve.now/CVE-2025-14420.md): pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2025-14419](https://cve.now/CVE-2025-14419.md): pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2025-14418](https://cve.now/CVE-2025-14418.md): pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.0, pdfforge PDF Architect) - [CVE-2025-14417](https://cve.now/CVE-2025-14417.md): pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2025-14416](https://cve.now/CVE-2025-14416.md): pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.0, pdfforge PDF Architect) - [CVE-2025-14405](https://cve.now/CVE-2025-14405.md): PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 6.6, PDFsam Enhanced) - [CVE-2025-14404](https://cve.now/CVE-2025-14404.md): PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.0, PDFsam Enhanced) - [CVE-2025-14403](https://cve.now/CVE-2025-14403.md): PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.8, PDFsam Enhanced) - [CVE-2025-14402](https://cve.now/CVE-2025-14402.md): PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability (CVSS 7.0, PDFsam Enhanced) - [CVE-2025-14401](https://cve.now/CVE-2025-14401.md): PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, PDFsam Enhanced) - [CVE-2025-14500](https://cve.now/CVE-2025-14500.md): IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability (CVSS 9.8, IceWarp) - [CVE-2025-14499](https://cve.now/CVE-2025-14499.md): IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.8, IceWarp) - [CVE-2025-14501](https://cve.now/CVE-2025-14501.md): Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service Vulnerability (CVSS 7.5, Sante PACS Server) - [CVE-2025-14498](https://cve.now/CVE-2025-14498.md): TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation Vulnerability (CVSS 7.8, TradingView Desktop) - [CVE-2025-14494](https://cve.now/CVE-2025-14494.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14491](https://cve.now/CVE-2025-14491.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14489](https://cve.now/CVE-2025-14489.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14490](https://cve.now/CVE-2025-14490.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14488](https://cve.now/CVE-2025-14488.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14497](https://cve.now/CVE-2025-14497.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14495](https://cve.now/CVE-2025-14495.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14493](https://cve.now/CVE-2025-14493.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14496](https://cve.now/CVE-2025-14496.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14492](https://cve.now/CVE-2025-14492.md): RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability (CVSS 7.8, RealDefense SUPERAntiSpyware) - [CVE-2025-14932](https://cve.now/CVE-2025-14932.md): NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, NSF Unidata NetCDF-C) - [CVE-2025-14933](https://cve.now/CVE-2025-14933.md): NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, NSF Unidata NetCDF-C) - [CVE-2025-14934](https://cve.now/CVE-2025-14934.md): NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, NSF Unidata NetCDF-C) - [CVE-2025-14935](https://cve.now/CVE-2025-14935.md): NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, NSF Unidata NetCDF-C) - [CVE-2025-14936](https://cve.now/CVE-2025-14936.md): NSF Unidata NetCDF-C Attribute Name Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, NSF Unidata NetCDF-C) - [CVE-2025-14925](https://cve.now/CVE-2025-14925.md): Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Accelerate) - [CVE-2025-14922](https://cve.now/CVE-2025-14922.md): Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Diffusers) - [CVE-2025-14931](https://cve.now/CVE-2025-14931.md): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 10.0, Hugging Face smolagents · smolagents) - [CVE-2025-14930](https://cve.now/CVE-2025-14930.md): Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14928](https://cve.now/CVE-2025-14928.md): Hugging Face Transformers HuBERT convert\_config Code Injection Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14924](https://cve.now/CVE-2025-14924.md): Hugging Face Transformers megatron\_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14920](https://cve.now/CVE-2025-14920.md): Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14926](https://cve.now/CVE-2025-14926.md): Hugging Face Transformers SEW convert\_config Code Injection Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14927](https://cve.now/CVE-2025-14927.md): Hugging Face Transformers SEW-D convert\_config Code Injection Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14921](https://cve.now/CVE-2025-14921.md): Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-14929](https://cve.now/CVE-2025-14929.md): Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Hugging Face Transformers · transformers) - [CVE-2025-15045](https://cve.now/CVE-2025-15045.md): Tenda WH450 HTTP Request Natlimit stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2025-11419](https://cve.now/CVE-2025-11419.md): Keycloak: keycloak tls client-initiated renegotiation denial of service (CVSS 7.5, keycloak · Red Hat build of Keycloak +1) - [CVE-2025-15044](https://cve.now/CVE-2025-15044.md): Tenda WH450 NatStaticSetting stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2021-47737](https://cve.now/CVE-2021-47737.md): CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard (CVSS 5.1, Cszcms CSZ CMS) - [CVE-2021-47733](https://cve.now/CVE-2021-47733.md): CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding (CVSS 5.1, CMSimple) - [CVE-2021-47716](https://cve.now/CVE-2021-47716.md): Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints (CVSS 5.1, orangescrum) - [CVE-2023-53982](https://cve.now/CVE-2023-53982.md): PMB 7.4.6 SQL Injection Vulnerability via Unsanitized id Parameter (CVSS 9.3, Sigb PMB) - [CVE-2021-47739](https://cve.now/CVE-2021-47739.md): Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service Path (CVSS 8.5, Epic Games Easy Anti-Cheat) - [CVE-2021-47738](https://cve.now/CVE-2021-47738.md): CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging (CVSS 5.1, Cszcms CSZ CMS) - [CVE-2021-47736](https://cve.now/CVE-2021-47736.md): CMSimple\_XH 1.7.4 Authenticated Remote Code Execution via Content Editing (CVSS 8.6, Cmsimple-Xh CMSimple\_XH) - [CVE-2021-47735](https://cve.now/CVE-2021-47735.md): CMSimple 5.4 Authenticated Remote Code Execution via Template Editing (CVSS 8.6, Cmsimple) - [CVE-2021-47734](https://cve.now/CVE-2021-47734.md): CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution (CVSS 8.6, CMSimple) - [CVE-2021-47732](https://cve.now/CVE-2021-47732.md): CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input (CVSS 5.1, CMSimple) - [CVE-2021-47722](https://cve.now/CVE-2021-47722.md): Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery (CVSS 5.1, Axesstmc Zucchetti Axess CLOKI Access Control) - [CVE-2021-47721](https://cve.now/CVE-2021-47721.md): Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation (CVSS 8.7, orangescrum) - [CVE-2021-47720](https://cve.now/CVE-2021-47720.md): Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters (CVSS 8.7, orangescrum) - [CVE-2025-33222](https://cve.now/CVE-2025-33222.md): NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. (CVSS 9.8, NVIDIA Isaac Launchable) - [CVE-2025-33223](https://cve.now/CVE-2025-33223.md): NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. (CVSS 9.8, NVIDIA Isaac Launchable) - [CVE-2025-33224](https://cve.now/CVE-2025-33224.md): NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. (CVSS 9.8, NVIDIA Isaac Launchable) - [CVE-2024-9684](https://cve.now/CVE-2024-9684.md): FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences. (CVSS 7.5, FreyrSCADA IEC-60870-5-104) - [CVE-2025-68343](https://cve.now/CVE-2025-68343.md): can: gs\_usb: gs\_usb\_receive\_bulk\_callback(): check actual\_length before accessing header (no CVSS, Linux) - [CVE-2025-68342](https://cve.now/CVE-2025-68342.md): can: gs\_usb: gs\_usb\_receive\_bulk\_callback(): check actual\_length before accessing data (no CVSS, Linux) - [CVE-2025-68341](https://cve.now/CVE-2025-68341.md): veth: reduce XDP no\_direct return section to fix race (CVSS 9.8, Linux) - [CVE-2025-68340](https://cve.now/CVE-2025-68340.md): team: Move team device type change at the end of team\_port\_add (CVSS 7.8, Linux) - [CVE-2025-68339](https://cve.now/CVE-2025-68339.md): atm/fore200e: Fix possible data race in fore200e\_open() (no CVSS, Linux) - [CVE-2025-68338](https://cve.now/CVE-2025-68338.md): net: dsa: microchip: Don't free uninitialized ksz\_irq (no CVSS, Linux) - [CVE-2025-13183](https://cve.now/CVE-2025-13183.md): Stored XSS in Hotech's Otello (CVSS 7.3, Hotech Software Otello) - [CVE-2024-24844](https://cve.now/CVE-2024-24844.md): WordPress PowerPack Pro for Elementor plugin \<= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability (CVSS 7.5, IdeaBox Creations PowerPack Pro for Elementor) - [CVE-2023-52210](https://cve.now/CVE-2023-52210.md): WordPress Product Delivery Date for WooCommerce – Lite plugin \<= 2.7.0 - Broken Access Control vulnerability (CVSS 5.3, Tyche softwares Product Delivery Date for WooCommerce – Lite) - [CVE-2025-68546](https://cve.now/CVE-2025-68546.md): WordPress Nika theme \<= 1.2.14 - Local File Inclusion vulnerability (CVSS 7.5, thembay Nika) - [CVE-2025-68544](https://cve.now/CVE-2025-68544.md): WordPress Diza theme \<= 1.3.15 - Local File Inclusion vulnerability (CVSS 7.5, thembay Diza) - [CVE-2025-68548](https://cve.now/CVE-2025-68548.md): WordPress Responsive Posts Carousel Pro plugin \<= 15.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WebCodingPlace Responsive Posts Carousel Pro) - [CVE-2025-68550](https://cve.now/CVE-2025-68550.md): WordPress WPBulky plugin \<= 1.1.13 - SQL Injection vulnerability (CVSS 7.6, VillaTheme WPBulky) - [CVE-2025-68551](https://cve.now/CVE-2025-68551.md): WordPress VPSUForm plugin \<= 3.2.24 - Sensitive Data Exposure vulnerability (CVSS 6.5, Vikas Ratudi VPSUForm) - [CVE-2025-68556](https://cve.now/CVE-2025-68556.md): WordPress HAPPY plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.3, VillaTheme HAPPY) - [CVE-2025-68557](https://cve.now/CVE-2025-68557.md): WordPress Chakra test plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 4.3, Vikas Ratudi Chakra test) - [CVE-2025-68559](https://cve.now/CVE-2025-68559.md): WordPress TheGem Theme Elements (for Elementor) plugin \<= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodexThemes TheGem Theme Elements) - [CVE-2025-68560](https://cve.now/CVE-2025-68560.md): WordPress TheGem Theme Elements (for Elementor) plugin \<= 5.10.5.1 - Local File Inclusion vulnerability (CVSS 7.5, CodexThemes TheGem Theme Elements) - [CVE-2025-68561](https://cve.now/CVE-2025-68561.md): WordPress AutomatorWP plugin \<= 5.2.4 - SQL Injection vulnerability (CVSS 7.6, Ruben Garcia AutomatorWP) - [CVE-2025-59886](https://cve.now/CVE-2025-59886.md): Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t (CVSS 8.8, Eaton xComfort ECI) - [CVE-2025-14635](https://cve.now/CVE-2025-14635.md): Happy Addons for Elementor \<= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4, thehappymonster Happy Addons for Elementor) - [CVE-2025-14000](https://cve.now/CVE-2025-14000.md): Membership Plugin – Restrict Content \<= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes (CVSS 6.4, stellarwp Membership Plugin – Restrict Content) - [CVE-2025-14388](https://cve.now/CVE-2025-14388.md): PhastPress \<= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection (CVSS 9.8, kiboit PhastPress) - [CVE-2025-12934](https://cve.now/CVE-2025-12934.md): Beaver Builder – WordPress Page Builder \<= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update (CVSS 8.1, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…) - [CVE-2025-14163](https://cve.now/CVE-2025-14163.md): Premium Addons for Elementor \<= 4.11.53 - Cross-Site Request Forgery via 'insert\_inner\_template' (CVSS 4.3, leap13 Premium Addons for Elementor – Powerful Elementor Te…) - [CVE-2025-14548](https://cve.now/CVE-2025-14548.md): Calendar \<= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event\_desc' (CVSS 6.4, kieranoshea Calendar) - [CVE-2025-14155](https://cve.now/CVE-2025-14155.md): Premium Addons for Elementor \<= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get\_template\_content' (CVSS 5.3, leap13 Premium Addons for Elementor – Powerful Elementor Te…) - [CVE-2025-15034](https://cve.now/CVE-2025-15034.md): itsourcecode Student Management System record.php sql injection (CVSS 6.9, itsourcecode Student Management System) - [CVE-2025-67743](https://cve.now/CVE-2025-67743.md): Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service (CVSS 6.3, LearningCircuit local-deep-research · local-deep-research) - [CVE-2024-57521](https://cve.now/CVE-2024-57521.md): SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in S (CVSS 10.0) - [CVE-2025-25364](https://cve.now/CVE-2025-25364.md): A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execut (CVSS 8.4) - [CVE-2025-29228](https://cve.now/CVE-2025-29228.md): Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter. (CVSS 9.8) - [CVE-2025-29229](https://cve.now/CVE-2025-29229.md): linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. (CVSS 9.8) - [CVE-2025-45493](https://cve.now/CVE-2025-45493.md): Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action\_bandwidth function. (CVSS 6.5) - [CVE-2025-50526](https://cve.now/CVE-2025-50526.md): Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch\_status function. (CVSS 9.8) - [CVE-2025-51511](https://cve.now/CVE-2025-51511.md): Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads. (CVSS 9.8, cadmium-org/cadmium-cms) - [CVE-2025-65354](https://cve.now/CVE-2025-65354.md): Improper input handling in /Grocery/search\_products\_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem\_nam (CVSS 9.8) - [CVE-2025-65410](https://cve.now/CVE-2025-65410.md): A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a craft (CVSS 6.2) - [CVE-2025-65713](https://cve.now/CVE-2025-65713.md): Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. (CVSS 4.0, homeassistant) - [CVE-2025-65865](https://cve.now/CVE-2025-65865.md): An integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 7.5) - [CVE-2025-66845](https://cve.now/CVE-2025-66845.md): A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. (CVSS 6.1) - [CVE-2025-67108](https://cve.now/CVE-2025-67108.md): eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connect (CVSS 10.0) - [CVE-2025-67109](https://cve.now/CVE-2025-67109.md): Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execut (CVSS 10.0) - [CVE-2025-67111](https://cve.now/CVE-2025-67111.md): An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) vi (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.