CVEs published January 5, 2026
151 CVEs were published on January 5, 2026: 18 critical, 51 high. 1 is now in CISA KEV.
- Published
- 151
- Critical
- 18
- High
- 51
- Medium
- 64
- Low
- 5
- Unrated
- 13
- Now in CISA KEV
- 1
- Fix available
- 50
Most affected products
- Linux
- 16
- coollabsio coolify
- 11
- aio-libs aiohttp · aiohttp
- 8
- code-projects Online Product Reservation System
- 8
- Centreon Infra Monitoring
- 7
- Quanta Computer QOCA aim AI Medical Cloud Platform
- 6
- craftcms cms · craftcms/cms
- 5
- bg5sbk MiniCMS
- 4
- UTT 进取
- 4
- code-projects Online Music Site
- 3
Critical 18
- CVE-2025-68428jsPDF has Local File Inclusion/Path Traversal vulnerabilityparallax jsPDF · jspdf
- CVE-2026-0625D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration EndpointD-Link DSL-2640B · D-Link DSL-2740R +15
- CVE-2025-64424Colify has command injection vulnerability in project git sourcecoollabsio coolify
- CVE-2025-64420Coolify members can see private key of root usercoollabsio coolify
- CVE-2025-64419Coolify vulnerable to command injection via docker-compose.yaml parameterscoollabsio coolify
- CVE-2025-59158Coolify has Stored XSS in Project Namecoollabsio coolify
- CVE-2025-59157Coolify has Git Repository RCEcoollabsio coolify
- CVE-2025-59156Coolify has Docker Compose Injection issuecoollabsio coolify
- CVE-2025-39484WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerabilityWaituk Entrada
- CVE-2025-14346WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections.WHILL Model C2 Electric Wheelchair · WHILL Model F Power Ch…
- CVE-2025-15029An unauthenticated user is able to introduce SQL Injection using the Awie export moduleCentreon Infra Monitoring
- CVE-2025-15026Unauthenticated configuration import allows administrative account creation using AWIE componentCentreon Infra Monitoring
- CVE-2023-50897WordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerabilityMeow Apps Media File Renamer
- CVE-2025-68865WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerabilityInfility Global
- CVE-2025-31048WordPress Shopo <= 1.1.4 - Arbitrary File Upload VulnerabilityThemify Shopo
- CVE-2025-30633WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection VulnerabilityAA-Team Amazon Native Shopping Recommendations
- CVE-2025-27807An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,
- CVE-2025-67397An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific p
High 51
- CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backupcraftcms cms · craftcms/cms
- CVE-2025-69223AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombaio-libs aiohttp · aiohttp
- CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms cms · craftcms/cms
- CVE-2025-68953Certain Frappe requests are vulnerable to Path Traversalfrappe
- CVE-2025-67732Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpointlanggenius dify
- CVE-2025-66648`vega-functions` vulnerable to Cross-site Scripting via `setdata` functionvega · vega-functions
- CVE-2025-65110Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scopevega · vega-selections
- CVE-2025-61916Spinnaker vulnerable to SSRF due to improper restrictions on http from user inputspinnaker · io.spinnaker.clouddriver:clouddriver-artifacts
- CVE-2026-0621MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoSAnthropic MCP TypeScript SDK · @modelcontextprotocol/sdk
- CVE-2025-64425Coolify has host header injection in forgot passwordcoollabsio coolify
- CVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation linkscoollabsio coolify
- CVE-2025-64421Coolify has a privilege escalation - low privileged user can invite themselves as an admin usercoollabsio coolify
- CVE-2025-61781GraphQL IDOR allows authenticated user to delete workspace content of other usersOpenCTI-Platform opencti · pycti
- CVE-2025-55204muffon has One-click Remote Code Execution via XSS and Custom URL Handlingstaniel359 muffon
- CVE-2025-59467A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation Ubiquiti UCRM Argentina AFIP invoices Plugin
- CVE-2026-21633A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery pUbiquiti UniFi Protect Application
- CVE-2025-46255WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerabilityMarketing Fire LoginWP - Pro
- CVE-2024-53735WordPress iPhone Webclip Manager plugin <= 0.5 - CSRF to Stored XSS vulnerabilitycorourke iPhone Webclip Manager
- CVE-2024-30516WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerabilitySaasProject Booking Package
- CVE-2024-30461WordPress Tumult Hype Animations plugin <= 1.9.11 - CSRF to XSS vulnerabilityTumult Hype Animations
- CVE-2023-49186WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerabilityKlbTheme Machic Core
- CVE-2025-68850WordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerabilitycodepeople Sell Downloads
- CVE-2025-68547WordPress Follow My Blog Post plugin <= 2.4.0 - Arbitrary Content Deletion vulnerabilitywpweb Follow My Blog Post
- CVE-2025-68044WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerabilityRustaurius Five Star Restaurant Reservations
- CVE-2025-68033WordPress Custom Related Posts plugin <= 1.8.0 - Sensitive Data Exposure vulnerabilityBrecht Custom Related Posts
- CVE-2025-31047WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection VulnerabilityThemify Edmin
- CVE-2025-31044WordPress Premium SEO Pack <= 3.3.2 - SQL Injection VulnerabilityAA-Team Premium SEO Pack
- CVE-2025-69087WordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerabilityjwsthemes FreeAgent
- CVE-2025-5965RCE via the backup feature available only to user with high privilegeCentreon Infra Monitoring
- CVE-2025-68764NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flagsLinux
- CVE-2025-68761hfs: fix potential use after free in hfs_correct_next_unused_CNID()Linux
- CVE-2025-68753ALSA: firewire-motu: add bounds check in put_user loop for DSP eventsLinux
- CVE-2025-66518Apache Kyuubi: Unauthorized directory access due to missing path normalizationApache Software Foundation Apache Kyuubi · org.apache.kyuub…
- CVE-2025-15240Quanta Computer｜QOCA aim AI Medical Cloud Platform - Arbitrary File UploadQuanta Computer QOCA aim AI Medical Cloud Platform
- CVE-2025-15239Quanta Computer｜QOCA aim AI Medical Cloud Platform - SQL InjectionQuanta Computer QOCA aim AI Medical Cloud Platform
- CVE-2025-15238Quanta Computer｜QOCA aim AI Medical Cloud Platform - SQL InjectionQuanta Computer QOCA aim AI Medical Cloud Platform
- CVE-2025-15235Quanta Computer｜QOCA aim AI Medical Cloud Platform - Missing AuthorizationQuanta Computer QOCA aim AI Medical Cloud Platform
- CVE-2025-15462UTT 进取 520W ConfigAdvideo strcpy buffer overflowUTT 进取
- CVE-2025-15461UTT 进取 520W formTaskEdit strcpy buffer overflowUTT 进取
- CVE-2025-15460UTT 进取 520W formPptpClientConfig strcpy buffer overflowUTT 进取
- CVE-2025-14124Team < 5.0.11 - Unauthenticated SQLiTeam
- CVE-2025-15459UTT 进取 520W formUser strcpy buffer overflowUTT 进取
- CVE-2025-5591Stored Cross-site Scripting (XSS) in Kentico Xperience 13Kentico Xperience
- CVE-2025-43706An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920,
- CVE-2025-49495An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580.
- CVE-2025-52519An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500.
- CVE-2025-53966An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580.
- CVE-2025-57836An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows.
- CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import dZimbra Collaboration
- CVE-2025-67303An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.comfyui-manager
- CVE-2025-67419A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's res@evershop/evershop
Medium, low and unrated 82
- CVE-2026-21439badkeys vulnerable to ASCII control character injection on console via malformed inputbadkeys
- CVE-2025-69230AIOHTTP Vulnerable to Cookie Parser Warning Stormaio-libs aiohttp · aiohttp
- CVE-2025-69229AIOHTTP vulnerable to DoS through chunked messagesaio-libs aiohttp · aiohttp
- CVE-2026-0607code-projects Online Music Site AdminViewSongs.php sql injectioncode-projects Online Music Site
- CVE-2025-69228AIOHTTP vulnerable to denial of service through large payloadsaio-libs aiohttp · aiohttp
- CVE-2025-69227AIOHTTP vulnerable to DoS when bypassing assertsaio-libs aiohttp · aiohttp
- CVE-2025-69225AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fieldsaio-libs aiohttp · aiohttp
- CVE-2026-0606code-projects Online Music Site Albums.php sql injectioncode-projects Online Music Site
- CVE-2025-69226AIOHTTP allows for a brute-force leak of internal static filepath componentsaio-libs aiohttp · aiohttp
- CVE-2025-69224AIOHTTP's Unicode processing of header values could cause parsing discrepanciesaio-libs aiohttp · aiohttp
- CVE-2025-68454Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTIcraftcms cms · craftcms/cms
- CVE-2025-68437Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutationcraftcms cms · craftcms/cms
- CVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocationcraftcms cms · craftcms/cms
- CVE-2026-0605code-projects Online Music Site login.php sql injectioncode-projects Online Music Site
- CVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host headercoollabsio coolify
- CVE-2025-59955Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpointcoollabsio coolify
- CVE-2025-10933Silicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds readsilabs.com Z-Wave Protocol Controller
- CVE-2025-39497WordPress Dokan Pro plugin <= 3.14.5 - Cross Site Scripting (XSS) vulnerabilityDokan Pro
- CVE-2025-39561WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Broken Access Control vulnerabilityMarketing Fire LoginWP - Pro
- CVE-2026-21635An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feaUbiquiti UniFi Connect EV Station Lite
- CVE-2026-21634A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery prUbiquiti UniFi Protect Application
- CVE-2025-53344WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityThimPress Thim Core
- CVE-2026-0597Campcodes Supplier Management System edit_profile.php sql injectionCampcodes Supplier Management System
- CVE-2025-12511A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration pageCentreon Infra Monitoring
- CVE-2025-68280Apache SIS: XML External Entity (XXE) vulnerabilityApache Software Foundation Apache SIS · org.apache.sis.core…
- CVE-2025-12513A user with elevated privileges can inject XSS in the Hosts configuration parameters pageCentreon Infra Monitoring
- CVE-2024-23511WordPress The Plus Addons for Elementor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH The Plus Addons for Elementor Page Builder Lite
- CVE-2023-52212WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic WP Job Manager
- CVE-2026-0592code-projects Online Product Reservation System User Registration register_code.php sql injectioncode-projects Online Product Reservation System
- CVE-2023-51513WordPress Geo Controller plugin <= 8.5.2 - Cross Site Scripting (XSS) vulnerabilityINTINITUM FORM Geo Controller
- CVE-2026-0591code-projects Online Product Reservation System Cart Update update.php sql injectioncode-projects Online Product Reservation System
- CVE-2026-0590code-projects Online Product Reservation System POST Parameter delete.php sql injectioncode-projects Online Product Reservation System
- CVE-2026-0589code-projects Online Product Reservation System Administration Backend improper authenticationcode-projects Online Product Reservation System
- CVE-2026-0588Xinhu Rainrock RockOA API rockfun.php cross site scriptingXinhu Rainrock RockOA
- CVE-2026-0587Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scriptingXinhu Rainrock RockOA
- CVE-2025-68029WordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerabilityWP Swings Wallet System for WooCommerce
- CVE-2025-68014WordPress AweBooking plugin <= 3.2.26 - Sensitive Data Exposure vulnerabilityawethemes AweBooking
- CVE-2026-0586code-projects Online Product Reservation System prod.php cross site scriptingcode-projects Online Product Reservation System
- CVE-2025-31046WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control VulnerabilityWPvibes AnyWhere Elementor Pro
- CVE-2025-12519Information disclosure on Administration parameters API endpointCentreon Infra Monitoring
- CVE-2025-13056A user with elevated privileges can inject XSS in the Administration ACL Menus configuration pageCentreon Infra Monitoring
- CVE-2026-0585code-projects Online Product Reservation System GET Parameter order_view.php sql injectioncode-projects Online Product Reservation System
- CVE-2025-68766irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()Linux
- CVE-2025-68765mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()Linux
- CVE-2025-68763crypto: starfive - Correctly handle return of sg_nents_for_lenLinux
- CVE-2025-68762net: netpoll: initialize work queue before error checksLinux
- CVE-2025-68760iommu/amd: Fix potential out-of-bounds read in iommu_mmio_showLinux
- CVE-2025-68759wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()Linux
- CVE-2025-68758backlight: led-bl: Add devlink to supplier LEDsLinux
- CVE-2025-68757drm/vgem-fence: Fix potential deadlock on releaseLinux
- CVE-2025-68756block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lockLinux
- CVE-2025-68755staging: most: remove broken i2c driverLinux
- CVE-2025-68754rtc: amlogic-a4: fix double free caused by devmLinux
- CVE-2025-68752iavf: Implement settime64 with -EOPNOTSUPPLinux
- CVE-2025-68751s390/fpu: Fix false-positive kmsan report in fpu_vstl()Linux
- CVE-2026-0584code-projects Online Product Reservation System left_cart.php sql injectioncode-projects Online Product Reservation System
- CVE-2026-0583code-projects Online Product Reservation System User Login login.php sql injectioncode-projects Online Product Reservation System
- CVE-2026-0582itsourcecode Society Management System edit_activity_query.php sql injectionitsourcecode Society Management System
- CVE-2026-0581Tenda AC1206 httpd BehaviorManager formBehaviorManager command injectionTenda AC1206
- CVE-2025-15022Cross-site scripting in Action captionvaadin · vaadin-spreadsheet-flow +3
- CVE-2025-15237Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path TraversalQuanta Computer QOCA aim AI Medical Cloud Platform
- CVE-2025-15236Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path TraversalQuanta Computer QOCA aim AI Medical Cloud Platform
- CVE-2026-0580SourceCodester API Key Manager App Import Key cross site scriptingSourceCodester API Key Manager App
- CVE-2025-9543FlexTable Google Sheets Connector < 3.19.2 - Admin+ Stored XSSFlexTable
- CVE-2025-15458bg5sbk MiniCMS Article post-edit.php improper authenticationbg5sbk MiniCMS
- CVE-2025-15457bg5sbk MiniCMS Trash File Restore post.php improper authenticationbg5sbk MiniCMS
- CVE-2025-15456bg5sbk MiniCMS Publish page-edit.php improper authenticationbg5sbk MiniCMS
- CVE-2025-15455bg5sbk MiniCMS File Recovery Request page.php delete_page improper authenticationbg5sbk MiniCMS
- CVE-2025-15454zhanglun lettura RSS ContentRender.tsx cross site scriptingzhanglun lettura
- CVE-2025-15453milvus HTTP Endpoint expr.go expr.Exec deserializationmilvus
- CVE-2025-15452xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scriptingxnx3 wangmarket
- CVE-2025-15451xnx3 wangmarket System Variables variableSave.do cross site scriptingxnx3 wangmarket
- CVE-2025-15450sfturing hosp_order orderHos findOrderHosNum sql injectionsfturing hosp_order
- CVE-2025-15449cld378632668 JavaMall MinioController.java delete path traversalcld378632668 JavaMall
- CVE-2025-15448cld378632668 JavaMall MinioController.java upload unrestricted uploadcld378632668 JavaMall
- CVE-2025-52515An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500.
- CVE-2025-52516An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500.
- CVE-2025-52517An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500.
- CVE-2025-65328Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating
- CVE-2025-65922PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes.
- CVE-2025-67316An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in Hey
- CVE-2025-67427A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to@evershop/evershop