CVEs published December 27, 2025
15 CVEs were published on December 27, 2025: 2 critical, 3 high.
- Published
- 15
- Critical
- 2
- High
- 3
- Medium
- 10
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- PHP Group PHP
- 3
- getmaxun maxun
- 2
- jackq XCMS
- 2
- abhinavxd libredesk · github.com/abhinavxd/libredesk
- 1
- actiontech sqle · github.com/actiontech/sqle
- 1
- eigent-ai eigent
- 1
- GnuPG
- 1
- nanomq
- 1
- PandaXGO PandaX
- 1
- siyuan-note siyuan
- 1
Critical 2
High 3
Medium, low and unrated 10
- CVE-2025-68972In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that placesGnuPG
- CVE-2025-15110jackq XCMS Backend ProductImageController.class.php upload unrestricted uploadjackq XCMS
- CVE-2025-14177Information Leak of Memory in getimagesizePHP Group PHP
- CVE-2025-14178Heap buffer overflow in array_merge()PHP Group PHP
- CVE-2025-15109jackq XCMS upload.php unrestricted uploadjackq XCMS
- CVE-2025-15108PandaXGO PandaX JWT Secret config.yml hard-coded keyPandaXGO PandaX
- CVE-2025-15107actiontech sqle JWT Secret jwt.go hard-coded keyactiontech sqle · github.com/actiontech/sqle
- CVE-2025-15106getmaxun Authentication Endpoint auth.ts router.get improper authorizationgetmaxun maxun
- CVE-2025-15105getmaxun auth.ts hard-coded keygetmaxun maxun
- CVE-2025-68948SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secretsiyuan-note siyuan