CVEs published January 9, 2026
125 CVEs were published on January 9, 2026: 16 critical, 28 high. Browse them by severity, product and exploitation status.
- Published
- 125
- Critical
- 16
- High
- 28
- Medium
- 73
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- GitLab
- 7
- Samsung Mobile Devices
- 7
- GestSup
- 5
- Dell PowerProtect Data Domain with Data Domain Operating… +2
- 4
- Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- 4
- Vivotek IP7137
- 4
- RainyGao DocSys
- 3
- Sangfor Operation and Maintenance Management System
- 3
- shabti Frontend Admin by DynamiApps
- 3
- themeum Tutor LMS – eLearning and online course solution
- 3
Critical 16
- CVE-2025-15501Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injectionSangfor Operation and Maintenance Management System
- CVE-2026-22584Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage…Salesforce Uni2TS · uni2ts
- CVE-2025-15500Sangfor Operation and Maintenance Management System HTTP POST Request getHis os command injectionSangfor Operation and Maintenance Management System
- CVE-2020-36875AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code ExecutionAccessAlly
- CVE-2025-69426Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCERUCKUS Networks vRIoT IOT Controller
- CVE-2025-69425Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCERUCKUS Networks vRIoT IoT Controller
- CVE-2025-14598CVE-2025-14598BeeS Software Solutions BET ePortal
- CVE-2025-66050No password set for administrative account in Vivotek IP7137 camerasVivotek IP7137
- CVE-2025-7072Hardcoded credentials in KAON CG3000T/CG3000CT routersKAON CG3000T · KAON CG3000TC
- CVE-2025-64093Unauthenticated Remote Code Execution via the device hostnameZenitel ICX500 · Zenitel ICX510
- CVE-2025-64090Authenticated Remote Code Execution in device hostnameZenitel TCIS-3+
- CVE-2025-14741Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Elementshabti Frontend Admin by DynamiApps
- CVE-2025-70974Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a…Alibaba Fastjson · com.alibaba:fastjson
- CVE-2025-14736Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Fieldshabti Frontend Admin by DynamiApps
- CVE-2025-69542A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07.
- CVE-2025-70161EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection.
High 28
- CVE-2025-15499Sangfor Operation and Maintenance Management System VersionController.java uploadCN os command injectionSangfor Operation and Maintenance Management System
- CVE-2026-0830Command Injection in Kiro GitLab Merge Request HelperAWS Kiro IDE
- CVE-2026-22196GestSup < 3.2.60 SQL Injection in Ticket CreationGestSup
- CVE-2026-22197GestSup < 3.2.60 Multiple SQL Injections in Asset ListGestSup
- CVE-2026-22195GestSup < 3.2.60 SQL Injection in Search BarGestSup
- CVE-2026-22194GestSup <= 3.2.60 CSRF Allows Privileged ActionsGestSup
- CVE-2025-66052Command injection in Vivotek IP7137 camerasVivotek IP7137
- CVE-2025-66049Unprotected RTSP stream in Vivotek IP7137 camerasVivotek IP7137
- CVE-2026-22082Insecure Session ID Management Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2026-22081Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2026-22080Insecure Transmission Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2026-22079Cleartext Transmission Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2025-9222Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-13772Missing Authorization in GitLabGitLab
- CVE-2025-13761Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-64092Unauthenticated SQL injection via GET request parametersZenitel ICX500 · Zenitel ICX510
- CVE-2025-64091Authenticated Remote Code Execution in the NTP-configurationZenitel TCIS-3+
- CVE-2025-69195Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urlswget2
- CVE-2025-69194Wget2: arbitrary file write via metalink path traversal in gnu wget2wget2
- CVE-2025-14657Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to…arraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2025-14937Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'shabti Frontend Admin by DynamiApps
- CVE-2025-15055SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parametersveronalabs SlimStat Analytics
- CVE-2025-15057SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameterveronalabs SlimStat Analytics
- CVE-2026-20971Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.Samsung Mobile Devices
- CVE-2025-56225fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when…
Show all 28 entriesShow fewer entries
- CVE-2025-66744In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal…
- CVE-2025-67070A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the…
- CVE-2025-67133An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component
Medium, low and unrated 81
- CVE-2025-46297A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-62487Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent…com.palantir.acme:gotham-default-apps-bundle · com.palan… +1
- CVE-2025-46298The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-46299A memory initialization issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-46286A logic issue was addressed with improved validation.Apple iOS and iPadOS
- CVE-2025-15035Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75TP-Link Systems Archer AXE75
- CVE-2025-15496guchengwuyue yshopmall jobs getPage sql injectionguchengwuyue yshopmall
- CVE-2025-15495BiggiDroid Simple PHP CMS editsite.php unrestricted uploadBiggiDroid Simple PHP CMS
- CVE-2025-15494RainyGao DocSys UserMapper.xml sql injectionRainyGao DocSys
- CVE-2025-15493RainyGao DocSys ReposAuthMapper.xml sql injectionRainyGao DocSys
- CVE-2026-22198GestSup < 3.2.60 Stored XSS in API Error LogsGestSup
- CVE-2025-46645Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025…Dell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2025-46643Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025…Dell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2025-15492RainyGao DocSys GroupMemberMapper.xml sql injectionRainyGao DocSys
- CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLsWikimedia Foundation MediaWiki - CampaignEvents extension
- CVE-2025-46676Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025…Dell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2026-0803PHPGurukul Online Course Registration System enroll.php sql injectionPHPGurukul Online Course Registration System
- CVE-2025-46644Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025…Dell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2025-66051Path traversal in Vivotek IP7137 camerasVivotek IP7137
- CVE-2025-11453Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinganand_kumar Header and Footer Scripts
- CVE-2025-13908The Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesalobaidi The Tooltip
- CVE-2025-13862Menu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesfurqan-khanzada Menu Card
- CVE-2025-14172WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flushinfosatech WP Page Permalink Extension
- CVE-2025-13717Contact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id'…ashishajani Contact Form vCard Generator
- CVE-2025-13704Autogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameteramirshk Autogen Headers Menu
Show all 81 entriesShow fewer entries
- CVE-2025-13892MG AdvancedOptions <= 1.2 - Reflected Cross-Site Scriptingmountaingrafix MG AdvancedOptions
- CVE-2025-13897Client Testimonial Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Fieldamu02aftab Client Testimonial Slider
- CVE-2025-13854Curved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessoniz Curved Text
- CVE-2025-13701Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']beshkin Shabat Keeper
- CVE-2025-13967Woodpecker for WordPress <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attributewoodpeckerleadform Woodpecker for WordPress
- CVE-2025-13852Debt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdebtcom Debt.com Business in a Box
- CVE-2025-13893Lesson Plan Book <= 1.3 - Reflected Cross-Site Scriptingburtrw Lesson Plan Book
- CVE-2025-13903PullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesctietze PullQuote
- CVE-2025-3950Exposure of Private Personal Information to an Unauthorized Actor in GitLabGitLab
- CVE-2025-10569Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-11246Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-13781Missing Authorization in GitLabGitLab
- CVE-2025-13895Top Position Google Finance <= 0.1.0 - Reflected Cross-Site Scriptingtop-position Top Position Google Finance
- CVE-2025-13900WP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attributethemelocation WP Popup Magic
- CVE-2025-13853Nearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeslnbadmin1 Nearby Now Reviews
- CVE-2025-13729Entry Views <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodegreenshady Entry Views
- CVE-2026-0627AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Uploadmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2025-13753WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creationwptb WP Table Builder – Drag & Drop Table Builder
- CVE-2025-13935Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completionthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-13934Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypassthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-13628Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon…themeum Tutor LMS – eLearning and online course solution
- CVE-2025-14146Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposurewpdevelop Booking Calendar
- CVE-2026-21409Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3.Ricoh Company RICOH Streamline NX
- CVE-2025-14574weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposurewedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2025-14893IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' ParameterIndieWeb
- CVE-2025-14718Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing…Schedule Post Changes With PublishPress Future: Unpublish,…
- CVE-2025-14720Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actionsameliabooking Booking for Appointments and Events Calendar…
- CVE-2026-0563WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site…pagup WP Google Street View (with 360° virtual tour) & Goog…
- CVE-2025-14782Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+)…wpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-14980BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposurewpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
- CVE-2025-15019BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored…pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) opt…
- CVE-2026-20976Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.Samsung Mobile Galaxy Store
- CVE-2026-20975Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in…Samsung Mobile Samsung Cloud
- CVE-2026-20974Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass…Samsung Mobile Devices
- CVE-2026-20973Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-20972Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.Samsung Mobile Devices
- CVE-2026-20970Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.Samsung Mobile Devices
- CVE-2026-20969Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege.Samsung Mobile Devices
- CVE-2026-20968Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2025-14803Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSSNEX-Forms
- CVE-2025-13749Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tamperingcreativemotion Clearfy Cache – WordPress optimization plugi…
- CVE-2025-14886Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modificationshoheitanaka Japanized for WooCommerce
- CVE-2025-66315ZTE MF258K Pro Version Server has a Configuration Defect VulnerabilityZTE MF258K
- CVE-2026-22712ApprovedRevs allows bypassing the inline CSS sanitizerThe Wikimedia Foundation Mediawiki - ApprovedRevs Extension
- CVE-2026-22713Stored XSS through edit summaries in GrowthExperimentsThe Wikimedia Foundation Mediawiki - GrowthExperiments Exte…
- CVE-2025-51626SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint.
- CVE-2025-60538A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.github.com/go-shiori/shiori
- CVE-2025-66715A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DLL file.
- CVE-2025-67004* Disputed * An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing…
- CVE-2025-67278An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP…
- CVE-2025-67279An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application…
- CVE-2025-67280In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged…
- CVE-2025-67281In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative…
- CVE-2025-67282In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to…
- CVE-2025-67810In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read…
- CVE-2025-67811Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users.