# CVEs published 2025-12-26

57 CVEs were published on December 26, 2025: 5 critical, 15 high. Days are UTC.

- [CVE-2025-68474](https://cve.now/CVE-2025-68474.md): ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling (CVSS 6.1, espressif esp-idf)
- [CVE-2025-68473](https://cve.now/CVE-2025-68473.md): ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling (CVSS 0.0, espressif esp-idf)
- [CVE-2025-68148](https://cve.now/CVE-2025-68148.md): FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After (CVSS 4.3, FreshRSS)
- [CVE-2025-68932](https://cve.now/CVE-2025-68932.md): FreshRSS has weak cryptographic randomness in remember-me token and nonce generation (CVSS 2.9, FreshRSS)
- [CVE-2025-66203](https://cve.now/CVE-2025-66203.md): StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection (CVSS 10.0, lemon8866 StreamVault)
- [CVE-2025-67729](https://cve.now/CVE-2025-67729.md): lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() (CVSS 8.8, InternLM lmdeploy · lmdeploy)
- [CVE-2025-68697](https://cve.now/CVE-2025-68697.md): Self-hosted n8n has Legacy Code node that enables arbitrary file read/write (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2025-68668](https://cve.now/CVE-2025-68668.md): n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node (CVSS 9.9, n8n-io n8n · n8n)
- [CVE-2025-61914](https://cve.now/CVE-2025-61914.md): n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox (CVSS 7.3, n8n-io n8n · n8n)
- [CVE-2025-13158](https://cve.now/CVE-2025-13158.md): apidoc-core - prototype pollution in api\_group.js, api\_param\_title.js, api\_use.js, and api\_permission.js worker (CVSS 9.3, apidoc-core)
- [CVE-2025-64645](https://cve.now/CVE-2025-64645.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 7.7, IBM Concert)
- [CVE-2025-36230](https://cve.now/CVE-2025-36230.md): XSS in IBM Aspera Faspex (CVSS 5.4, IBM Aspera Faspex)
- [CVE-2025-36229](https://cve.now/CVE-2025-36229.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex (CVSS 3.1, IBM Aspera Faspex)
- [CVE-2025-36228](https://cve.now/CVE-2025-36228.md): Incorrect Execution-Assigned Permissions in IBM Aspera Faspex (CVSS 3.8, IBM Aspera Faspex)
- [CVE-2025-36192](https://cve.now/CVE-2025-36192.md): Missing Authorization with the DS8900F and DS8A00 Hardware Management Console (CVSS 6.7, IBM DS8A00 · IBM DS8900F)
- [CVE-2025-14687](https://cve.now/CVE-2025-14687.md): Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center (CVSS 4.3, IBM Db2 Intelligence Center)
- [CVE-2025-13915](https://cve.now/CVE-2025-13915.md): Authentication bypass in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2025-12771](https://cve.now/CVE-2025-12771.md): IBM Concert Software Improper Restriction of Operations within the Bounds of a Memory Buffer. (CVSS 7.8, IBM Concert)
- [CVE-2025-1721](https://cve.now/CVE-2025-1721.md): BM Concert Software Improper Clearing of Heap Memory Before Release. (CVSS 5.9, IBM Concert)
- [CVE-2025-67450](https://cve.now/CVE-2025-67450.md): Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perf (CVSS 7.8, Eaton UPS Companion software)
- [CVE-2025-59888](https://cve.now/CVE-2025-59888.md): Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with (CVSS 6.7, Eaton UPS Companion software)
- [CVE-2025-59887](https://cve.now/CVE-2025-59887.md): Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker (CVSS 8.6, Eaton UPS Companion Software)
- [CVE-2025-62578](https://cve.now/CVE-2025-62578.md): DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information (CVSS 7.2, Delta Electronics DVP-12SE)
- [CVE-2025-8075](https://cve.now/CVE-2025-8075.md): Improper Input Validation (CVSS 5.8, Hanwha Vision Co. QNV-C8012)
- [CVE-2025-52601](https://cve.now/CVE-2025-52601.md): Hardcoding sensitive information (CVSS 6.3, Hanwha Vision Co. Device Manager)
- [CVE-2025-52600](https://cve.now/CVE-2025-52600.md): Improper Input Validation (CVSS 5.2, Hanwha Vision Co. QNV-C8012)
- [CVE-2025-68946](https://cve.now/CVE-2025-68946.md): In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. (CVSS 5.4, Gitea · code.gitea.io/gitea)
- [CVE-2025-52599](https://cve.now/CVE-2025-52599.md): Inadequate account permissions management (CVSS 6.3, Hanwha Vision Co. QNV-C8012)
- [CVE-2025-52598](https://cve.now/CVE-2025-52598.md): Insufficient certificate validation (CVSS 6.3, Hanwha Vision Co. QNV-C8012)
- [CVE-2025-15099](https://cve.now/CVE-2025-15099.md): simstudioai sim CRON Secret internal.ts improper authentication (CVSS 6.9, simstudioai sim)
- [CVE-2025-68945](https://cve.now/CVE-2025-68945.md): In Gitea before 1.21.2, an anonymous user can visit a private user's project. (CVSS 5.8, Gitea · code.gitea.io/gitea)
- [CVE-2025-68944](https://cve.now/CVE-2025-68944.md): Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries. (CVSS 5.0, Gitea · code.gitea.io/gitea)
- [CVE-2025-68943](https://cve.now/CVE-2025-68943.md): Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. (CVSS 5.3, Gitea · code.gitea.io/gitea)
- [CVE-2025-15098](https://cve.now/CVE-2025-15098.md): YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery (CVSS 5.3, YunaiV yudao-cloud)
- [CVE-2025-68942](https://cve.now/CVE-2025-68942.md): Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text. (CVSS 5.4, Gitea · code.gitea.io/gitea)
- [CVE-2025-15097](https://cve.now/CVE-2025-15097.md): Alteryx Server status improper authentication (CVSS 6.9, Alteryx Server)
- [CVE-2025-68941](https://cve.now/CVE-2025-68941.md): Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. (CVSS 4.9, Gitea · code.gitea.io/gitea)
- [CVE-2025-68940](https://cve.now/CVE-2025-68940.md): In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. (CVSS 3.1, Gitea · code.gitea.io/gitea)
- [CVE-2025-68939](https://cve.now/CVE-2025-68939.md): Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. (CVSS 8.2, Gitea · code.gitea.io/gitea)
- [CVE-2025-15095](https://cve.now/CVE-2025-15095.md): postmanlabs httpbin core.py cross site scripting (CVSS 5.1, postmanlabs httpbin)
- [CVE-2025-15094](https://cve.now/CVE-2025-15094.md): sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting (CVSS 5.3, sunkaifei FlyCMS)
- [CVE-2025-68938](https://cve.now/CVE-2025-68938.md): Gitea before 1.25.2 mishandles authorization for deletion of releases. (CVSS 4.3, Gitea · code.gitea.io/gitea)
- [CVE-2025-15093](https://cve.now/CVE-2025-15093.md): sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting (CVSS 5.3, sunkaifei FlyCMS)
- [CVE-2025-15092](https://cve.now/CVE-2025-15092.md): UTT 进取 512W ConfigExceptMSN strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2024-29720](https://cve.now/CVE-2024-29720.md): An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component (CVSS 6.2)
- [CVE-2024-42718](https://cve.now/CVE-2024-42718.md): A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit (CVSS 6.5, croogo/croogo)
- [CVE-2024-44065](https://cve.now/CVE-2024-44065.md): Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults paramet (CVSS 9.8)
- [CVE-2025-25341](https://cve.now/CVE-2025-25341.md): A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. (CVSS 7.5, libxmljs)
- [CVE-2025-57403](https://cve.now/CVE-2025-57403.md): Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. (CVSS 7.5)
- [CVE-2025-65885](https://cve.now/CVE-2025-65885.md): An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight (CVSS 5.1)
- [CVE-2025-66737](https://cve.now/CVE-2025-66737.md): Yealink T21P\_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. (CVSS 4.3)
- [CVE-2025-66738](https://cve.now/CVE-2025-66738.md): An issue in Yealink T21P\_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the (CVSS 8.8)
- [CVE-2025-66947](https://cve.now/CVE-2025-66947.md): SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. (CVSS 6.5)
- [CVE-2025-67013](https://cve.now/CVE-2025-67013.md): The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Reques (CVSS 6.5)
- [CVE-2025-67014](https://cve.now/CVE-2025-67014.md): Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers (CVSS 7.5)
- [CVE-2025-67015](https://cve.now/CVE-2025-67015.md): Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the (CVSS 7.5)
- [CVE-2025-67349](https://cve.now/CVE-2025-67349.md): A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.