cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of December 29, 2025
Multiple vulnerabilities across various vendors are detailed, each with a high CVSS score, indicating significant risk. SmarterMail allows arbitrary file uploads, potentially enabling remote code execution. MiniDVBLinux contains a remote command execution vulnerability, allowing unauthenticated root access. SOUND4 products have multiple flaws, including ICMP flooding, radio stream disclosure, file disclosure, and command injection. JM-DATA ONU JF511-TV uses default credentials, enabling unauthorized access. Akuvox Smart Doorphone exposes live video streams without authentication. Flamingo XL has a restricted shell vulnerability allowing attackers to break from the sandbox. The Branda WordPress plugin has a privilege escalation vulnerability through password changes.
Delta Electronics' DVP-12SE11T has password bypass and out-of-bounds write vulnerabilities. Ksenia Security Lares 4.0 exposes the alarm system PIN. D-Link DIR-600 has a stack-based buffer overflow. Both Sunnet and WELLTEND TECHNOLOGY products have arbitrary file upload vulnerabilities. Tenda W6-S has a stack-based buffer overflow. ConoHa by GMO WING WordPress Migrator is susceptible to CSRF leading to web shell uploads. Signal K Server versions before 2.19.0 allowed for account takeover. RomanCode MapSVG suffers from unrestricted file uploads, which can be exploited to upload a web shell.