# CVEs published 2026-01-09

125 CVEs were published on January 9, 2026: 16 critical, 28 high. Days are UTC.

- [CVE-2025-15501](https://cve.now/CVE-2025-15501.md): Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection (CVSS 9.3, Sangfor Operation and Maintenance Management System)
- [CVE-2026-22584](https://cve.now/CVE-2026-22584.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage… (CVSS 9.8, Salesforce Uni2TS · uni2ts)
- [CVE-2025-15500](https://cve.now/CVE-2025-15500.md): Sangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection (CVSS 9.3, Sangfor Operation and Maintenance Management System)
- [CVE-2025-15499](https://cve.now/CVE-2025-15499.md): Sangfor Operation and Maintenance Management System VersionController.java uploadCN os command injection (CVSS 8.7, Sangfor Operation and Maintenance Management System)
- [CVE-2025-46297](https://cve.now/CVE-2025-46297.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-62487](https://cve.now/CVE-2025-62487.md): Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent… (CVSS 3.5, com.palantir.acme:gotham-default-apps-bundle · com.palan… +1)
- [CVE-2025-46298](https://cve.now/CVE-2025-46298.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-46299](https://cve.now/CVE-2025-46299.md): A memory initialization issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-46286](https://cve.now/CVE-2025-46286.md): A logic issue was addressed with improved validation. (CVSS 4.3, Apple iOS and iPadOS)
- [CVE-2026-0830](https://cve.now/CVE-2026-0830.md): Command Injection in Kiro GitLab Merge Request Helper (CVSS 8.4, AWS Kiro IDE)
- [CVE-2025-15035](https://cve.now/CVE-2025-15035.md): Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75 (CVSS 6.9, TP-Link Systems Archer AXE75)
- [CVE-2025-15496](https://cve.now/CVE-2025-15496.md): guchengwuyue yshopmall jobs getPage sql injection (CVSS 5.3, guchengwuyue yshopmall)
- [CVE-2025-15495](https://cve.now/CVE-2025-15495.md): BiggiDroid Simple PHP CMS editsite.php unrestricted upload (CVSS 5.1, BiggiDroid Simple PHP CMS)
- [CVE-2020-36875](https://cve.now/CVE-2020-36875.md): AccessAlly \< 3.3.2 Unauthenticated Arbitrary PHP Code Execution (CVSS 9.3, AccessAlly)
- [CVE-2025-15494](https://cve.now/CVE-2025-15494.md): RainyGao DocSys UserMapper.xml sql injection (CVSS 5.3, RainyGao DocSys)
- [CVE-2025-15493](https://cve.now/CVE-2025-15493.md): RainyGao DocSys ReposAuthMapper.xml sql injection (CVSS 5.3, RainyGao DocSys)
- [CVE-2026-22196](https://cve.now/CVE-2026-22196.md): GestSup \< 3.2.60 SQL Injection in Ticket Creation (CVSS 7.7, GestSup)
- [CVE-2026-22198](https://cve.now/CVE-2026-22198.md): GestSup \< 3.2.60 Stored XSS in API Error Logs (CVSS 5.1, GestSup)
- [CVE-2026-22197](https://cve.now/CVE-2026-22197.md): GestSup \< 3.2.60 Multiple SQL Injections in Asset List (CVSS 7.5, GestSup)
- [CVE-2026-22195](https://cve.now/CVE-2026-22195.md): GestSup \< 3.2.60 SQL Injection in Search Bar (CVSS 7.7, GestSup)
- [CVE-2026-22194](https://cve.now/CVE-2026-22194.md): GestSup \<= 3.2.60 CSRF Allows Privileged Actions (CVSS 8.9, GestSup)
- [CVE-2025-69426](https://cve.now/CVE-2025-69426.md): Ruckus vRIoT IoT Controller \< 3.0.0.0 Hardcoded SSH Credentials RCE (CVSS 10.0, RUCKUS Networks vRIoT IOT Controller)
- [CVE-2025-46645](https://cve.now/CVE-2025-46645.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025… (CVSS 6.5, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-69425](https://cve.now/CVE-2025-69425.md): Ruckus vRIoT IoT Controller \< 3.0.0.0 Hardcoded Tokens RCE (CVSS 10.0, RUCKUS Networks vRIoT IoT Controller)
- [CVE-2025-46643](https://cve.now/CVE-2025-46643.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025… (CVSS 2.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-15492](https://cve.now/CVE-2025-15492.md): RainyGao DocSys GroupMemberMapper.xml sql injection (CVSS 5.3, RainyGao DocSys)
- [CVE-2026-0817](https://cve.now/CVE-2026-0817.md): CampaignEvents API missing authorization exposes meeting and chat URLs (CVSS 5.3, Wikimedia Foundation MediaWiki - CampaignEvents extension)
- [CVE-2025-46676](https://cve.now/CVE-2025-46676.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025… (CVSS 2.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2026-0803](https://cve.now/CVE-2026-0803.md): PHPGurukul Online Course Registration System enroll.php sql injection (CVSS 5.3, PHPGurukul Online Course Registration System)
- [CVE-2025-46644](https://cve.now/CVE-2025-46644.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025… (CVSS 6.0, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-14598](https://cve.now/CVE-2025-14598.md): CVE-2025-14598 (CVSS 9.8, BeeS Software Solutions BET ePortal)
- [CVE-2025-66052](https://cve.now/CVE-2025-66052.md): Command injection in Vivotek IP7137 cameras (CVSS 8.6, Vivotek IP7137)
- [CVE-2025-66051](https://cve.now/CVE-2025-66051.md): Path traversal in Vivotek IP7137 cameras (CVSS 6.9, Vivotek IP7137)
- [CVE-2025-66050](https://cve.now/CVE-2025-66050.md): No password set for administrative account in Vivotek IP7137 cameras (CVSS 9.3, Vivotek IP7137)
- [CVE-2025-66049](https://cve.now/CVE-2025-66049.md): Unprotected RTSP stream in Vivotek IP7137 cameras (CVSS 8.7, Vivotek IP7137)
- [CVE-2025-7072](https://cve.now/CVE-2025-7072.md): Hardcoded credentials in KAON CG3000T/CG3000CT routers (CVSS 9.3, KAON CG3000T · KAON CG3000TC)
- [CVE-2026-22082](https://cve.now/CVE-2026-22082.md): Insecure Session ID Management Vulnerability in Tenda Wireless Routers (CVSS 8.8, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2026-22081](https://cve.now/CVE-2026-22081.md): Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers (CVSS 8.8, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2025-11453](https://cve.now/CVE-2025-11453.md): Header and Footer Scripts \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, anand\_kumar Header and Footer Scripts)
- [CVE-2025-13908](https://cve.now/CVE-2025-13908.md): The Tooltip \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, alobaidi The Tooltip)
- [CVE-2025-13862](https://cve.now/CVE-2025-13862.md): Menu Card \<= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, furqan-khanzada Menu Card)
- [CVE-2025-14172](https://cve.now/CVE-2025-14172.md): WP Page Permalink Extension \<= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush (CVSS 6.5, infosatech WP Page Permalink Extension)
- [CVE-2025-13717](https://cve.now/CVE-2025-13717.md): Contact Form vCard Generator \<= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id'… (CVSS 5.3, ashishajani Contact Form vCard Generator)
- [CVE-2025-13704](https://cve.now/CVE-2025-13704.md): Autogen Headers Menu \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head\_class' Shortcode Parameter (CVSS 6.4, amirshk Autogen Headers Menu)
- [CVE-2025-13892](https://cve.now/CVE-2025-13892.md): MG AdvancedOptions \<= 1.2 - Reflected Cross-Site Scripting (CVSS 6.1, mountaingrafix MG AdvancedOptions)
- [CVE-2025-13897](https://cve.now/CVE-2025-13897.md): Client Testimonial Slider \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft\_testimonial\_meta\_name' Metabox Field (CVSS 6.4, amu02aftab Client Testimonial Slider)
- [CVE-2025-13854](https://cve.now/CVE-2025-13854.md): Curved Text \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, soniz Curved Text)
- [CVE-2025-13701](https://cve.now/CVE-2025-13701.md): Shabat Keeper \<= 0.4.4 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, beshkin Shabat Keeper)
- [CVE-2025-13967](https://cve.now/CVE-2025-13967.md): Woodpecker for WordPress \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form\_name' Shortcode Attribute (CVSS 6.4, woodpeckerleadform Woodpecker for WordPress)
- [CVE-2025-13852](https://cve.now/CVE-2025-13852.md): Debt.com Business in a Box \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, debtcom Debt.com Business in a Box)
- [CVE-2025-13893](https://cve.now/CVE-2025-13893.md): Lesson Plan Book \<= 1.3 - Reflected Cross-Site Scripting (CVSS 6.1, burtrw Lesson Plan Book)
- [CVE-2025-13903](https://cve.now/CVE-2025-13903.md): PullQuote \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ctietze PullQuote)
- [CVE-2026-22080](https://cve.now/CVE-2026-22080.md): Insecure Transmission Vulnerability in Tenda Wireless Routers (CVSS 8.7, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2026-22079](https://cve.now/CVE-2026-22079.md): Cleartext Transmission Vulnerability in Tenda Wireless Routers (CVSS 8.7, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2025-64093](https://cve.now/CVE-2025-64093.md): Unauthenticated Remote Code Execution via the device hostname (CVSS 10.0, Zenitel ICX500 · Zenitel ICX510)
- [CVE-2025-3950](https://cve.now/CVE-2025-3950.md): Exposure of Private Personal Information to an Unauthorized Actor in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-9222](https://cve.now/CVE-2025-9222.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-10569](https://cve.now/CVE-2025-10569.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-11246](https://cve.now/CVE-2025-11246.md): Insufficient Granularity of Access Control in GitLab (CVSS 5.4, GitLab)
- [CVE-2025-13772](https://cve.now/CVE-2025-13772.md): Missing Authorization in GitLab (CVSS 7.1, GitLab)
- [CVE-2025-13761](https://cve.now/CVE-2025-13761.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab)
- [CVE-2025-13781](https://cve.now/CVE-2025-13781.md): Missing Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-64092](https://cve.now/CVE-2025-64092.md): Unauthenticated SQL injection via GET request parameters (CVSS 7.5, Zenitel ICX500 · Zenitel ICX510)
- [CVE-2025-64091](https://cve.now/CVE-2025-64091.md): Authenticated Remote Code Execution in the NTP-configuration (CVSS 8.6, Zenitel TCIS-3+)
- [CVE-2025-64090](https://cve.now/CVE-2025-64090.md): Authenticated Remote Code Execution in device hostname (CVSS 10.0, Zenitel TCIS-3+)
- [CVE-2025-13895](https://cve.now/CVE-2025-13895.md): Top Position Google Finance \<= 0.1.0 - Reflected Cross-Site Scripting (CVSS 6.1, top-position Top Position Google Finance)
- [CVE-2025-13900](https://cve.now/CVE-2025-13900.md): WP Popup Magic \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (CVSS 6.4, themelocation WP Popup Magic)
- [CVE-2025-13853](https://cve.now/CVE-2025-13853.md): Nearby Now Reviews \<= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, lnbadmin1 Nearby Now Reviews)
- [CVE-2025-13729](https://cve.now/CVE-2025-13729.md): Entry Views \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, greenshady Entry Views)
- [CVE-2026-0627](https://cve.now/CVE-2026-0627.md): AMP for WP \<= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2025-69195](https://cve.now/CVE-2025-69195.md): Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls (CVSS 7.6, wget2)
- [CVE-2025-69194](https://cve.now/CVE-2025-69194.md): Wget2: arbitrary file write via metalink path traversal in gnu wget2 (CVSS 8.8, wget2)
- [CVE-2025-14657](https://cve.now/CVE-2025-14657.md): Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) \<= 4.0.51 - Missing Authorization to… (CVSS 7.2, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2025-13753](https://cve.now/CVE-2025-13753.md): WP Table Builder \<= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation (CVSS 4.3, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2025-13935](https://cve.now/CVE-2025-13935.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-13934](https://cve.now/CVE-2025-13934.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-14741](https://cve.now/CVE-2025-14741.md): Frontend Admin by DynamiApps \<= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element (CVSS 9.1, shabti Frontend Admin by DynamiApps)
- [CVE-2025-13628](https://cve.now/CVE-2025-13628.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon… (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-14937](https://cve.now/CVE-2025-14937.md): Frontend Admin by DynamiApps \<= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update\_field' (CVSS 7.2, shabti Frontend Admin by DynamiApps)
- [CVE-2025-14146](https://cve.now/CVE-2025-14146.md): Booking Calendar \<= 10.14.10 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, wpdevelop Booking Calendar)
- [CVE-2026-21409](https://cve.now/CVE-2026-21409.md): Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. (CVSS 5.9, Ricoh Company RICOH Streamline NX)
- [CVE-2025-70974](https://cve.now/CVE-2025-70974.md): Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a… (CVSS 10.0, Alibaba Fastjson · com.alibaba:fastjson)
- [CVE-2025-14574](https://cve.now/CVE-2025-14574.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.1.15 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)
- [CVE-2025-14893](https://cve.now/CVE-2025-14893.md): IndieWeb \<= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter (CVSS 6.4, IndieWeb)
- [CVE-2025-15055](https://cve.now/CVE-2025-15055.md): SlimStat Analytics \<= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2025-15057](https://cve.now/CVE-2025-15057.md): SlimStat Analytics \<= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2025-14718](https://cve.now/CVE-2025-14718.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.9.3 - Missing… (CVSS 5.4, Schedule Post Changes With PublishPress Future: Unpublish,…)
- [CVE-2025-14720](https://cve.now/CVE-2025-14720.md): Booking for Appointments and Events Calendar – Amelia \<= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions (CVSS 5.3, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2026-0563](https://cve.now/CVE-2026-0563.md): WP Google Street View (with 360° virtual tour) & Google maps + Local SEO \<= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site… (CVSS 6.4, pagup WP Google Street View (with 360° virtual tour) & Goog…)
- [CVE-2025-14782](https://cve.now/CVE-2025-14782.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.49.1 - Missing Authorization to Authenticated (Forminator User+)… (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2025-14980](https://cve.now/CVE-2025-14980.md): BetterDocs \<= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 6.5, wpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…)
- [CVE-2025-15019](https://cve.now/CVE-2025-15019.md): BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce \<= 2.2.1 - Authenticated (Contributor+) Stored… (CVSS 6.4, pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) opt…)
- [CVE-2025-14736](https://cve.now/CVE-2025-14736.md): Frontend Admin by DynamiApps \<= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-20976](https://cve.now/CVE-2026-20976.md): Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script. (CVSS 5.1, Samsung Mobile Galaxy Store)
- [CVE-2026-20975](https://cve.now/CVE-2026-20975.md): Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in… (CVSS 2.1, Samsung Mobile Samsung Cloud)
- [CVE-2026-20974](https://cve.now/CVE-2026-20974.md): Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass… (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2026-20973](https://cve.now/CVE-2026-20973.md): Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory. (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2026-20972](https://cve.now/CVE-2026-20972.md): Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. (CVSS 4.8, Samsung Mobile Devices)
- [CVE-2026-20971](https://cve.now/CVE-2026-20971.md): Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2026-20970](https://cve.now/CVE-2026-20970.md): Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2026-20969](https://cve.now/CVE-2026-20969.md): Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. (CVSS 2.3, Samsung Mobile Devices)
- [CVE-2026-20968](https://cve.now/CVE-2026-20968.md): Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2025-14803](https://cve.now/CVE-2025-14803.md): Nex-Forms Express WP Form Builder \< 9.1.8 - Authenticated Stored XSS (CVSS 6.8, NEX-Forms)
- [CVE-2025-13749](https://cve.now/CVE-2025-13749.md): Clearfy \<= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering (CVSS 4.3, creativemotion Clearfy Cache – WordPress optimization plugi…)
- [CVE-2025-14886](https://cve.now/CVE-2025-14886.md): Japanized for WooCommerce \<= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification (CVSS 5.3, shoheitanaka Japanized for WooCommerce)
- [CVE-2025-66315](https://cve.now/CVE-2025-66315.md): ZTE MF258K Pro Version Server has a Configuration Defect Vulnerability (CVSS 4.3, ZTE MF258K)
- [CVE-2026-22712](https://cve.now/CVE-2026-22712.md): ApprovedRevs allows bypassing the inline CSS sanitizer (CVSS 2.3, The Wikimedia Foundation Mediawiki - ApprovedRevs Extension)
- [CVE-2026-22713](https://cve.now/CVE-2026-22713.md): Stored XSS through edit summaries in GrowthExperiments (CVSS 2.3, The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…)
- [CVE-2025-51626](https://cve.now/CVE-2025-51626.md): SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel\_order.php endpoint. (CVSS 6.5)
- [CVE-2025-56225](https://cve.now/CVE-2025-56225.md): fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid\_synth\_monopoly.c, that can be triggered when… (CVSS 7.5)
- [CVE-2025-60538](https://cve.now/CVE-2025-60538.md): A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. (CVSS 6.5, github.com/go-shiori/shiori)
- [CVE-2025-66715](https://cve.now/CVE-2025-66715.md): A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DLL file. (CVSS 6.5)
- [CVE-2025-66744](https://cve.now/CVE-2025-66744.md): In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal… (CVSS 7.5)
- [CVE-2025-67004](https://cve.now/CVE-2025-67004.md): \* Disputed \* An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing… (CVSS 6.5)
- [CVE-2025-67070](https://cve.now/CVE-2025-67070.md): A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the… (CVSS 8.2)
- [CVE-2025-67133](https://cve.now/CVE-2025-67133.md): An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component (CVSS 7.5)
- [CVE-2025-67278](https://cve.now/CVE-2025-67278.md): An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP… (CVSS 6.5)
- [CVE-2025-67279](https://cve.now/CVE-2025-67279.md): An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application… (CVSS 5.3)
- [CVE-2025-67280](https://cve.now/CVE-2025-67280.md): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged… (CVSS 5.4)
- [CVE-2025-67281](https://cve.now/CVE-2025-67281.md): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative… (CVSS 5.4)
- [CVE-2025-67282](https://cve.now/CVE-2025-67282.md): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to… (CVSS 5.4)
- [CVE-2025-67810](https://cve.now/CVE-2025-67810.md): In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read… (CVSS 6.5)
- [CVE-2025-67811](https://cve.now/CVE-2025-67811.md): Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. (CVSS 6.5)
- [CVE-2025-69542](https://cve.now/CVE-2025-69542.md): A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. (CVSS 9.8)
- [CVE-2025-70161](https://cve.now/CVE-2025-70161.md): EDIMAX BR-6208AC V2\_1.02 is vulnerable to Command Injection. (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.