# CVEs published 2025-12-27

15 CVEs were published on December 27, 2025: 2 critical, 3 high. Days are UTC.

- [CVE-2025-68972](https://cve.now/CVE-2025-68972.md): In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places (CVSS 5.9, GnuPG)
- [CVE-2025-15110](https://cve.now/CVE-2025-15110.md): jackq XCMS Backend ProductImageController.class.php upload unrestricted upload (CVSS 5.1, jackq XCMS)
- [CVE-2025-14177](https://cve.now/CVE-2025-14177.md): Information Leak of Memory in getimagesize (CVSS 6.3, PHP Group PHP)
- [CVE-2025-14178](https://cve.now/CVE-2025-14178.md): Heap buffer overflow in array\_merge() (CVSS 6.5, PHP Group PHP)
- [CVE-2025-14180](https://cve.now/CVE-2025-14180.md): NULL Pointer Dereference in PDO quoting (CVSS 8.2, PHP Group PHP)
- [CVE-2025-15109](https://cve.now/CVE-2025-15109.md): jackq XCMS upload.php unrestricted upload (CVSS 6.9, jackq XCMS)
- [CVE-2025-15108](https://cve.now/CVE-2025-15108.md): PandaXGO PandaX JWT Secret config.yml hard-coded key (CVSS 6.3, PandaXGO PandaX)
- [CVE-2025-15107](https://cve.now/CVE-2025-15107.md): actiontech sqle JWT Secret jwt.go hard-coded key (CVSS 6.3, actiontech sqle · github.com/actiontech/sqle)
- [CVE-2025-15106](https://cve.now/CVE-2025-15106.md): getmaxun Authentication Endpoint auth.ts router.get improper authorization (CVSS 5.3, getmaxun maxun)
- [CVE-2025-15105](https://cve.now/CVE-2025-15105.md): getmaxun auth.ts hard-coded key (CVSS 6.3, getmaxun maxun)
- [CVE-2025-59946](https://cve.now/CVE-2025-59946.md): NanoMQ has a Use After Free vulnerability via sub info list (CVSS 7.5, nanomq)
- [CVE-2025-68952](https://cve.now/CVE-2025-68952.md): 1-click Remote Code Execution (RCE) vulnerability in Eigent (CVSS 9.3, eigent-ai eigent)
- [CVE-2025-68948](https://cve.now/CVE-2025-68948.md): SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret (CVSS 6.9, siyuan-note siyuan)
- [CVE-2025-68927](https://cve.now/CVE-2025-68927.md): Improper Neutralization of HTML Tags in a Web Page in libredesk (CVSS 7.3, abhinavxd libredesk · github.com/abhinavxd/libredesk)
- [CVE-2025-54322](https://cve.now/CVE-2025-54322.md): Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. (CVSS 10.0, Xspeeder SXZOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.