# CVEs published 2025-12-29

130 CVEs were published on December 29, 2025: 15 critical, 40 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-23554](https://cve.now/CVE-2025-23554.md): WordPress Off Page SEO plugin \<= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jakub Glos Off Page SEO)
- [CVE-2025-23550](https://cve.now/CVE-2025-23550.md): WordPress Product Puller plugin \<= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kemal YAZICI Product Puller)
- [CVE-2025-23469](https://cve.now/CVE-2025-23469.md): WordPress Sleekplan plugin \<= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sleekplan)
- [CVE-2025-68120](https://cve.now/CVE-2025-68120.md): Unexpected untrusted code execution in github.com/golang/vscode-go (CVSS 5.4, github.com/golang/vscode-go)
- [CVE-2025-23458](https://cve.now/CVE-2025-23458.md): WordPress Ads24 Lite plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rakessh Ads24 Lite)
- [CVE-2025-15210](https://cve.now/CVE-2025-15210.md): code-projects Refugee Food Management System editrefugee.php sql injection (CVSS 5.3, code-projects Refugee Food Management System)
- [CVE-2025-68036](https://cve.now/CVE-2025-68036.md): WordPress CubeWP plugin \<= 1.1.27 - Broken Access Control vulnerability (CVSS 7.5, Imran Tauqeer CubeWP)
- [CVE-2025-68040](https://cve.now/CVE-2025-68040.md): WordPress WP Project Manager plugin \<= 3.0.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, weDevs WP Project Manager)
- [CVE-2023-41656](https://cve.now/CVE-2023-41656.md): WordPress Better Elementor Addons plugin \<= 1.3.7 - Broken Access Control vulnerability (CVSS 5.4, wpdive Better Elementor Addons)
- [CVE-2023-32238](https://cve.now/CVE-2023-32238.md): WordPress TheGem theme \< 5.8.1.1 - Broken Access Control vulnerability (CVSS 5.4, CodexThemes TheGem)
- [CVE-2025-68498](https://cve.now/CVE-2025-68498.md): WordPress JetTabs plugin \<= 2.2.12 - Broken Access Control vulnerability (CVSS 6.5, Crocoblock JetTabs)
- [CVE-2025-68499](https://cve.now/CVE-2025-68499.md): WordPress JetTabs plugin \<= 2.2.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetTabs)
- [CVE-2025-15209](https://cve.now/CVE-2025-15209.md): code-projects Refugee Food Management System editfood.php sql injection (CVSS 5.3, code-projects Refugee Food Management System)
- [CVE-2025-15284](https://cve.now/CVE-2025-15284.md): arrayLimit bypass in bracket notation allows DoS via memory exhaustion (CVSS 6.3, qs)
- [CVE-2025-15208](https://cve.now/CVE-2025-15208.md): code-projects Refugee Food Management System editrefugee.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15207](https://cve.now/CVE-2025-15207.md): Campcodes Supplier Management System view\_products.php sql injection (CVSS 6.9, Campcodes Supplier Management System)
- [CVE-2025-15206](https://cve.now/CVE-2025-15206.md): Campcodes Supplier Management System add\_area.php sql injection (CVSS 6.9, Campcodes Supplier Management System)
- [CVE-2025-68502](https://cve.now/CVE-2025-68502.md): WordPress JetPopup plugin \<= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Crocoblock JetPopup)
- [CVE-2025-68503](https://cve.now/CVE-2025-68503.md): WordPress JetBlog plugin \<= 2.4.7 - Broken Access Control vulnerability (CVSS 6.5, Crocoblock JetBlog)
- [CVE-2025-68504](https://cve.now/CVE-2025-68504.md): WordPress JetSearch plugin \<= 3.5.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetSearch)
- [CVE-2025-68562](https://cve.now/CVE-2025-68562.md): WordPress MapSVG plugin \<= 8.7.3 - Arbitrary File Upload vulnerability (CVSS 9.9, RomanCode MapSVG)
- [CVE-2025-68607](https://cve.now/CVE-2025-68607.md): WordPress Custom Field Template plugin \<= 2.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hiroaki Miyashita Custom Field Template)
- [CVE-2025-68860](https://cve.now/CVE-2025-68860.md): WordPress Mobile builder plugin \<= 1.4.2 - Broken Authentication vulnerability (CVSS 9.8, Mobile builder)
- [CVE-2025-15205](https://cve.now/CVE-2025-15205.md): code-projects Student File Management System download.php sql injection (CVSS 5.3, code-projects Student File Management System)
- [CVE-2025-69205](https://cve.now/CVE-2025-69205.md): In µURU, a Specially Crafted Federation Name Allows Dialplan Injection (CVSS 6.3, olell uURU)
- [CVE-2025-15204](https://cve.now/CVE-2025-15204.md): SohuTV CacheCloud QuartzManageController.java doQuartzList cross site scripting (CVSS 4.8, SohuTV CacheCloud)
- [CVE-2025-15203](https://cve.now/CVE-2025-15203.md): SohuTV CacheCloud ResourceController.java index cross site scripting (CVSS 4.8, SohuTV CacheCloud)
- [CVE-2025-15202](https://cve.now/CVE-2025-15202.md): SohuTV CacheCloud TaskController.java taskQueueList cross site scripting (CVSS 4.8, SohuTV CacheCloud)
- [CVE-2025-14175](https://cve.now/CVE-2025-14175.md): Weak Algorithm Support in SSH Server on TL-WR820N (CVSS 6.0, TP-Link Systems TL-WR820N)
- [CVE-2025-69202](https://cve.now/CVE-2025-69202.md): axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header (CVSS 6.0, arthurfiorette axios-cache-interceptor · axios-cache-interc…)
- [CVE-2025-68431](https://cve.now/CVE-2025-68431.md): libheif has Potential Heap Buffer Over-Read (CVSS 6.5, strukturag libheif)
- [CVE-2025-14728](https://cve.now/CVE-2025-14728.md): Rapid7 Velociraptor Directory Traversal Vulnerability (CVSS 6.8, Rapid7 Velociraptor)
- [CVE-2025-15201](https://cve.now/CVE-2025-15201.md): SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15200](https://cve.now/CVE-2025-15200.md): SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting (CVSS 4.8, SohuTV CacheCloud)
- [CVE-2025-13592](https://cve.now/CVE-2025-13592.md): Advanced Ads \<= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode (CVSS 7.2, monetizemore Advanced Ads – Ad Manager & AdSense)
- [CVE-2025-14280](https://cve.now/CVE-2025-14280.md): PixelYourSite \<= 11.1.5 - Sensitive Information Exposure via Log File (CVSS 5.3, PixelYourSite – Your smart PIXEL (TAG) & API Manager)
- [CVE-2025-15199](https://cve.now/CVE-2025-15199.md): code-projects College Notes Uploading System userprofile.php unrestricted upload (CVSS 5.3, code-projects College Notes Uploading System)
- [CVE-2025-15198](https://cve.now/CVE-2025-15198.md): code-projects College Notes Uploading System login.php sql injection (CVSS 6.9, code-projects College Notes Uploading System)
- [CVE-2025-55064](https://cve.now/CVE-2025-55064.md): Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 4.8, Priority Web)
- [CVE-2025-68861](https://cve.now/CVE-2025-68861.md): WordPress Plugin Optimizer plugin \<= 1.3.7 - Broken Access Control vulnerability (CVSS 7.1, pluginoptimizer Plugin Optimizer)
- [CVE-2025-55063](https://cve.now/CVE-2025-55063.md): Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 4.8, Priority Web)
- [CVE-2025-55062](https://cve.now/CVE-2025-55062.md): Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 4.8, Priority Web)
- [CVE-2025-55061](https://cve.now/CVE-2025-55061.md): Priority - CWE-434 Unrestricted Upload of File with Dangerous Type (CVSS 8.8, Priority Web)
- [CVE-2025-55060](https://cve.now/CVE-2025-55060.md): Priority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (CVSS 6.1, Priority Web)
- [CVE-2025-15197](https://cve.now/CVE-2025-15197.md): code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload (CVSS 5.1, code-projects Content Management System · code-projects… +2)
- [CVE-2025-15196](https://cve.now/CVE-2025-15196.md): code-projects Assessment Management login.php sql injection (CVSS 6.9, code-projects Assessment Management)
- [CVE-2025-53627](https://cve.now/CVE-2025-53627.md): Meshtastic firmware allows forged DMs with no PKC to show up as encrypted (CVSS 5.3, meshtastic firmware)
- [CVE-2025-68868](https://cve.now/CVE-2025-68868.md): WordPress Wp Text Slider Widget plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codeaffairs Wp Text Slider Widget)
- [CVE-2025-68870](https://cve.now/CVE-2025-68870.md): WordPress CookieHint WP plugin \<= 1.0.0 - Local File Inclusion vulnerability (CVSS 7.5, reDim CookieHint WP)
- [CVE-2025-68876](https://cve.now/CVE-2025-68876.md): WordPress Invelity SPS connect plugin \<= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Invelity SPS connect)
- [CVE-2025-68877](https://cve.now/CVE-2025-68877.md): WordPress CedCommerce Integration for Good Market plugin \<= 1.0.6 - Local File Inclusion vulnerability (CVSS 7.5, CedCommerce Integration for Good Market)
- [CVE-2025-15195](https://cve.now/CVE-2025-15195.md): code-projects Assessment Management add-module.php sql injection (CVSS 6.9, code-projects Assessment Management)
- [CVE-2025-69211](https://cve.now/CVE-2025-69211.md): Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) (CVSS 6.9, nestjs nest · @nestjs/platform-fastify)
- [CVE-2025-68878](https://cve.now/CVE-2025-68878.md): WordPress Advanced Custom CSS plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, prasadkirpekar Advanced Custom CSS)
- [CVE-2025-68879](https://cve.now/CVE-2025-68879.md): WordPress Content Grid Slider plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, councilsoft Content Grid Slider)
- [CVE-2025-68893](https://cve.now/CVE-2025-68893.md): WordPress WordPress Image shrinker plugin \<= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, HETWORKS WordPress Image shrinker)
- [CVE-2025-68897](https://cve.now/CVE-2025-68897.md): WordPress IF AS Shortcode plugin \<= 1.2 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Mohammad I. Okfie IF AS Shortcode)
- [CVE-2025-69206](https://cve.now/CVE-2025-69206.md): Hemmelig has SSRF Filter bypass in Secret Request functionality (CVSS 4.3, HemmeligOrg Hemmelig.app · hemmelig)
- [CVE-2025-69201](https://cve.now/CVE-2025-69201.md): Tugtainer has RCE in Agent Command Execution Api (CVSS 8.1, Quenary tugtainer)
- [CVE-2025-15194](https://cve.now/CVE-2025-15194.md): D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow (CVSS 9.3, D-Link DIR-600)
- [CVE-2025-69200](https://cve.now/CVE-2025-69200.md): phpMyFAQ has unauthenticated config backup download via /api/setup/backup (CVSS 7.5, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2025-68951](https://cve.now/CVE-2025-68951.md): phpMyFAQ has stored XSS in admin "List of users" via display\_name HTML entity decoding (html\_entity\_decode) + Twig |raw (CVSS 5.4, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2025-68929](https://cve.now/CVE-2025-68929.md): Frappe may be vulnerable remote code execution due to server-side template injection (CVSS 9.1, frappe)
- [CVE-2025-68928](https://cve.now/CVE-2025-68928.md): Frappe CRM vulnerable to authenticated XSS via website field (CVSS 5.4, frappe crm)
- [CVE-2025-15193](https://cve.now/CVE-2025-15193.md): D-Link DWR-M920 formParentControl sub\_423848 buffer overflow (CVSS 8.7, D-Link DWR-M920)
- [CVE-2025-15192](https://cve.now/CVE-2025-15192.md): D-Link DWR-M920 formLtefotaUpgradeQuectel sub\_415328 command injection (CVSS 5.3, D-Link DWR-M920)
- [CVE-2025-15191](https://cve.now/CVE-2025-15191.md): D-Link DWR-M920 formLtefotaUpgradeFibocom sub\_4155B4 command injection (CVSS 5.3, D-Link DWR-M920)
- [CVE-2025-15190](https://cve.now/CVE-2025-15190.md): D-Link DWR-M920 formFilter sub\_42261C stack-based overflow (CVSS 8.7, D-Link DWR-M920)
- [CVE-2025-15189](https://cve.now/CVE-2025-15189.md): D-Link DWR-M920 formDefRoute sub\_464794 buffer overflow (CVSS 8.7, D-Link DWR-M920)
- [CVE-2025-15188](https://cve.now/CVE-2025-15188.md): Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting (CVSS 4.8, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2025-15187](https://cve.now/CVE-2025-15187.md): GreenCMS File DataController.class.php path traversal (CVSS 5.1, GreenCMS)
- [CVE-2025-15186](https://cve.now/CVE-2025-15186.md): code-projects Refugee Food Management System addusers.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15185](https://cve.now/CVE-2025-15185.md): code-projects Refugee Food Management System refugeesreport.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15184](https://cve.now/CVE-2025-15184.md): code-projects Refugee Food Management System refugeesreport2.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15183](https://cve.now/CVE-2025-15183.md): code-projects Refugee Food Management System viewtakenfd.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15182](https://cve.now/CVE-2025-15182.md): code-projects Refugee Food Management System served.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15181](https://cve.now/CVE-2025-15181.md): code-projects Refugee Food Management System pagenateRefugeesList.php sql injection (CVSS 6.9, code-projects Refugee Food Management System)
- [CVE-2025-15180](https://cve.now/CVE-2025-15180.md): Tenda WH450 HTTP Request webExcptypemanFilte stack-based overflow (CVSS 8.6, Tenda WH450)
- [CVE-2025-15179](https://cve.now/CVE-2025-15179.md): Tenda WH450 qossetting stack-based overflow (CVSS 8.6, Tenda WH450)
- [CVE-2025-15178](https://cve.now/CVE-2025-15178.md): Tenda WH450 HTTP Request VirtualSer stack-based overflow (CVSS 8.6, Tenda WH450)
- [CVE-2025-15228](https://cve.now/CVE-2025-15228.md): WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Upload (CVSS 9.3, WELLTEND TECHNOLOGY BPMFlowWebkit)
- [CVE-2025-15227](https://cve.now/CVE-2025-15227.md): WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Read (CVSS 8.7, WELLTEND TECHNOLOGY BPMFlowWebkit)
- [CVE-2025-15177](https://cve.now/CVE-2025-15177.md): Tenda WH450 HTTP Request SetIpBind stack-based overflow (CVSS 8.6, Tenda WH450)
- [CVE-2025-15226](https://cve.now/CVE-2025-15226.md): Sunnet｜WMPro - Arbitrary File Upload (CVSS 9.3, Sunnet WMPro)
- [CVE-2025-15176](https://cve.now/CVE-2025-15176.md): Open5GS PFCP Session Establishment Request rule-match.c ogs\_pfcp\_pdr\_rule\_find\_by\_packet assertion (CVSS 6.9, Open5GS)
- [CVE-2025-15225](https://cve.now/CVE-2025-15225.md): Sunnet｜WMPro - Arbitrary File Read (CVSS 8.7, Sunnet WMPro)
- [CVE-2025-15175](https://cve.now/CVE-2025-15175.md): SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-13958](https://cve.now/CVE-2025-13958.md): YaMaps \< 0.6.40 - Contributor+ Stored XSS (CVSS 5.9, YaMaps for WordPress Plugin)
- [CVE-2025-13417](https://cve.now/CVE-2025-13417.md): Plugin Organizer \< 10.2.4 - Subscriber+ SQLi (CVSS 8.6, Plugin Organizer)
- [CVE-2025-15174](https://cve.now/CVE-2025-15174.md): SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15070](https://cve.now/CVE-2025-15070.md): Data Exposure in Gmission Web FAX (CVSS 6.8, Gmission Web Fax)
- [CVE-2025-15069](https://cve.now/CVE-2025-15069.md): Privilege Escalation in Gmission Web FAX (CVSS 8.4, Gmission Web Fax)
- [CVE-2025-15068](https://cve.now/CVE-2025-15068.md): Account Takeover in Gmission Web FAX (CVSS 8.5, Gmission Web Fax)
- [CVE-2025-15173](https://cve.now/CVE-2025-15173.md): SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15172](https://cve.now/CVE-2025-15172.md): SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15171](https://cve.now/CVE-2025-15171.md): SohuTV CacheCloud ServerController.java index cross site scripting (CVSS 5.1, SohuTV CacheCloud)
- [CVE-2025-15170](https://cve.now/CVE-2025-15170.md): Advaya Softech GEMS ERP Portal Error Message home.jsp cross site scripting (CVSS 5.3, Advaya Softech GEMS ERP Portal)
- [CVE-2025-15169](https://cve.now/CVE-2025-15169.md): BiggiDroid Simple PHP CMS editsite.php sql injection (CVSS 5.1, BiggiDroid Simple PHP CMS)
- [CVE-2025-15168](https://cve.now/CVE-2025-15168.md): itsourcecode Student Management System statistical.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-52691](https://cve.now/CVE-2025-52691.md): Upload Arbitrary Files (CVSS 10.0, KEV, SmarterTools SmarterMail)
- [CVE-2025-15167](https://cve.now/CVE-2025-15167.md): itsourcecode Online Cake Ordering System detailtransac.php sql injection (CVSS 6.9, itsourcecode Online Cake Ordering System)
- [CVE-2025-15166](https://cve.now/CVE-2025-15166.md): itsourcecode Online Cake Ordering System updatesupplier.php sql injection (CVSS 6.9, itsourcecode Online Cake Ordering System)
- [CVE-2025-15165](https://cve.now/CVE-2025-15165.md): itsourcecode Online Cake Ordering System updatecustomer.php sql injection (CVSS 6.9, itsourcecode Online Cake Ordering System)
- [CVE-2025-15067](https://cve.now/CVE-2025-15067.md): Unrestricted File Upload and RCE in Innorix WP (CVSS 8.5, Innorix WP)
- [CVE-2025-15066](https://cve.now/CVE-2025-15066.md): Arbitrary File Download through Path Traversal in Innorix WP (CVSS 6.9, Innorix WP)
- [CVE-2025-15164](https://cve.now/CVE-2025-15164.md): Tenda WH450 SafeMacFilter stack-based overflow (CVSS 8.6, Tenda WH450)
- [CVE-2025-15065](https://cve.now/CVE-2025-15065.md): Data Exposure in Kings Information & Network KESS Enterprise (CVSS 8.6, Kings Information & Network KESS Enterprise)
- [CVE-2025-15163](https://cve.now/CVE-2025-15163.md): Tenda WH450 SafeEmailFilter stack-based overflow (CVSS 8.6, Tenda WH450)
- [CVE-2024-25181](https://cve.now/CVE-2024-25181.md): A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary fil (CVSS 9.1)
- [CVE-2024-25182](https://cve.now/CVE-2024-25182.md): givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. (CVSS 9.8)
- [CVE-2024-25183](https://cve.now/CVE-2024-25183.md): givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. (CVSS 7.5)
- [CVE-2024-27480](https://cve.now/CVE-2024-27480.md): givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. (CVSS 9.8)
- [CVE-2024-30855](https://cve.now/CVE-2024-30855.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml\_list\_action.php. (CVSS 8.8)
- [CVE-2025-56333](https://cve.now/CVE-2025-56333.md): An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component (CVSS 9.8)
- [CVE-2025-57460](https://cve.now/CVE-2025-57460.md): File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell. (CVSS 9.8)
- [CVE-2025-57462](https://cve.now/CVE-2025-57462.md): Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fi (CVSS 6.1)
- [CVE-2025-60458](https://cve.now/CVE-2025-60458.md): UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. (CVSS 6.5)
- [CVE-2025-65442](https://cve.now/CVE-2025-65442.md): DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or (CVSS 6.1)
- [CVE-2025-65570](https://cve.now/CVE-2025-65570.md): A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP\_NEXT opcode. (CVSS 9.8)
- [CVE-2025-66861](https://cve.now/CVE-2025-66861.md): An issue was discovered in function d\_unqualified\_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of servic (CVSS 2.5)
- [CVE-2025-66862](https://cve.now/CVE-2025-66862.md): A buffer overflow vulnerability in function gnu\_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service v (CVSS 7.5)
- [CVE-2025-66863](https://cve.now/CVE-2025-66863.md): An issue was discovered in function d\_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via (CVSS 7.5)
- [CVE-2025-66864](https://cve.now/CVE-2025-66864.md): An issue was discovered in function d\_print\_comp\_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service (CVSS 5.5)
- [CVE-2025-66865](https://cve.now/CVE-2025-66865.md): An issue was discovered in function d\_print\_comp\_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service (CVSS 7.5)
- [CVE-2025-66866](https://cve.now/CVE-2025-66866.md): An issue was discovered in function d\_abi\_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via craf (CVSS 5.5)
- [CVE-2025-66869](https://cve.now/CVE-2025-66869.md): Buffer overflow vulnerability in function strcat in asan\_interceptors.cpp in libming 0.4.8. (CVSS 7.5)
- [CVE-2025-66877](https://cve.now/CVE-2025-66877.md): Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8. (CVSS 7.5)
- [CVE-2025-67254](https://cve.now/CVE-2025-67254.md): NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php. (CVSS 7.5)
- [CVE-2025-67255](https://cve.now/CVE-2025-67255.md): In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Inject (CVSS 8.8)
- [CVE-2025-68706](https://cve.now/CVE-2025-68706.md): A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.