CVEs published December 26, 2025
57 CVEs were published on December 26, 2025: 5 critical, 15 high.
- Published
- 57
- Critical
- 5
- High
- 15
- Medium
- 32
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Gitea · code.gitea.io/gitea
- 9
- Hanwha Vision Co. QNV-C8012
- 4
- IBM Aspera Faspex
- 3
- IBM Concert
- 3
- n8n-io n8n · n8n
- 3
- Eaton UPS Companion software
- 2
- espressif esp-idf
- 2
- FreshRSS
- 2
- sunkaifei FlyCMS
- 2
- Alteryx Server
- 1
Critical 5
- CVE-2025-66203StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injectionlemon8866 StreamVault
- CVE-2025-68668n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Noden8n-io n8n · n8n
- CVE-2025-13158apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js workerapidoc-core
- CVE-2025-13915Authentication bypass in IBM API ConnectIBM API Connect
- CVE-2024-44065Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults paramet
High 15
- CVE-2025-67729lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()InternLM lmdeploy · lmdeploy
- CVE-2025-68697Self-hosted n8n has Legacy Code node that enables arbitrary file read/writen8n-io n8n · n8n
- CVE-2025-61914n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandboxn8n-io n8n · n8n
- CVE-2025-64645Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2025-12771IBM Concert Software Improper Restriction of Operations within the Bounds of a Memory Buffer.IBM Concert
- CVE-2025-67450Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perfEaton UPS Companion software
- CVE-2025-59887Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attackerEaton UPS Companion Software
- CVE-2025-62578DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive InformationDelta Electronics DVP-12SE
- CVE-2025-68939Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.Gitea · code.gitea.io/gitea
- CVE-2025-15092UTT 进取 512W ConfigExceptMSN strcpy buffer overflowUTT 进取
- CVE-2025-25341A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document.libxmljs
- CVE-2025-57403Cola Dnslog v1.3.2 is vulnerable to Directory Traversal.
- CVE-2025-66738An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the
- CVE-2025-67014Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers
- CVE-2025-67015Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the
Medium, low and unrated 37
- CVE-2025-68474ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handlingespressif esp-idf
- CVE-2025-68473ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handlingespressif esp-idf
- CVE-2025-68148FreshRSS globally denies access to feed via proxy modifying to 429 Retry-AfterFreshRSS
- CVE-2025-68932FreshRSS has weak cryptographic randomness in remember-me token and nonce generationFreshRSS
- CVE-2025-36230XSS in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2025-36229Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2025-36228Incorrect Execution-Assigned Permissions in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2025-36192Missing Authorization with the DS8900F and DS8A00 Hardware Management ConsoleIBM DS8A00 · IBM DS8900F
- CVE-2025-14687Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence CenterIBM Db2 Intelligence Center
- CVE-2025-1721BM Concert Software Improper Clearing of Heap Memory Before Release.IBM Concert
- CVE-2025-59888Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with Eaton UPS Companion software
- CVE-2025-8075Improper Input ValidationHanwha Vision Co. QNV-C8012
- CVE-2025-52601Hardcoding sensitive informationHanwha Vision Co. Device Manager
- CVE-2025-52600Improper Input ValidationHanwha Vision Co. QNV-C8012
- CVE-2025-68946In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.Gitea · code.gitea.io/gitea
- CVE-2025-52599Inadequate account permissions managementHanwha Vision Co. QNV-C8012
- CVE-2025-52598Insufficient certificate validationHanwha Vision Co. QNV-C8012
- CVE-2025-15099simstudioai sim CRON Secret internal.ts improper authenticationsimstudioai sim
- CVE-2025-68945In Gitea before 1.21.2, an anonymous user can visit a private user's project.Gitea · code.gitea.io/gitea
- CVE-2025-68944Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.Gitea · code.gitea.io/gitea
- CVE-2025-68943Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.Gitea · code.gitea.io/gitea
- CVE-2025-15098YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgeryYunaiV yudao-cloud
- CVE-2025-68942Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.Gitea · code.gitea.io/gitea
- CVE-2025-15097Alteryx Server status improper authenticationAlteryx Server
- CVE-2025-68941Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.Gitea · code.gitea.io/gitea
- CVE-2025-68940In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.Gitea · code.gitea.io/gitea
- CVE-2025-15095postmanlabs httpbin core.py cross site scriptingpostmanlabs httpbin
- CVE-2025-15094sunkaifei FlyCMS User Login UserController.java userLogin cross site scriptingsunkaifei FlyCMS
- CVE-2025-68938Gitea before 1.25.2 mishandles authorization for deletion of releases.Gitea · code.gitea.io/gitea
- CVE-2025-15093sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scriptingsunkaifei FlyCMS
- CVE-2024-29720An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component
- CVE-2024-42718A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'editcroogo/croogo
- CVE-2025-65885An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight
- CVE-2025-66737Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal.
- CVE-2025-66947SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.
- CVE-2025-67013The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Reques
- CVE-2025-67349A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3.