CVEs published January 6, 2026
185 CVEs were published on January 6, 2026: 12 critical, 64 high.
- Published
- 185
- Critical
- 12
- High
- 64
- Medium
- 107
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- MediaTek chipset
- 28
- Qualcomm Snapdragon
- 22
- InternationalColorConsortium iccDEV
- 16
- Altera Quartus Prime Pro
- 3
- Altera Quartus Prime Standard · Altera Quartus Prime Lite
- 3
- CodexThemes TheGem Theme Elements
- 3
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- 3
- Joomla! Project Joomla! CMS
- 2
- Pro-Bravia Sony BRAVIA Digital Signage
- 2
- projectworlds House Rental and Property Listing
- 2
Critical 12
- CVE-2025-15471TRENDnet TEW-713RE formFSrvX os command injectionTRENDnet TEW-713RE
- CVE-2025-30996Arbitrary File Upload Vulnerability in WordPress themes by ThemifyThemify Sidepane WordPress Theme · Themify Newsy +7
- CVE-2025-14942Authentication BypasswolfSSL wolfSSH
- CVE-2025-39477WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerabilitySfwebservice InWave Jobs
- CVE-2025-15001FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeoverfsylum FS Registration Password
- CVE-2025-14996AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeoveraksharsoftsolutions AS Password Field In Default Registrati…
- CVE-2026-21675iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletionInternationalColorConsortium iccDEV
- CVE-2025-15385Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue aTECNO Mobile com.afmobi.boomplayer
- CVE-2025-15444Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodiumIAMB Crypt::Sodium::XS
- CVE-2025-60262An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulne
- CVE-2025-60534Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests i
- CVE-2025-65212An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1.
High 64
- CVE-2026-0628Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install Google Chrome
- CVE-2025-47396Double Free in GraphicsQualcomm Snapdragon
- CVE-2025-47394Buffer Copy Without Checking Size of Input in DSP ServiceQualcomm Snapdragon
- CVE-2025-47393Improper Validation of Array Index in Automotive Linux OSQualcomm Snapdragon
- CVE-2025-47388Buffer Copy without Checking Size of Input in DSP ServiceQualcomm Snapdragon
- CVE-2025-47380Untrusted Pointer Dereference in CameraQualcomm Snapdragon
- CVE-2025-47356Double Free in VideoQualcomm Snapdragon
- CVE-2025-47348Use of Uninitialized Variable in HLOSQualcomm Snapdragon
- CVE-2025-47346Out-of-bounds Write in HLOSQualcomm Snapdragon
- CVE-2025-47345Reusing a Nonce, Key Pair in Encryption in Automotive PlatformQualcomm Snapdragon
- CVE-2025-47343Untrusted Pointer Dereference in VideoQualcomm Snapdragon
- CVE-2025-47339Use After Free in HLOSQualcomm Snapdragon
- CVE-2025-15472TRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injectionTRENDnet TEW-811DRU
- CVE-2025-31642WordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDasinfomedia WPCHURCH
- CVE-2025-13744Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLGitHub Enterprise Server
- CVE-2025-30631Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress pluginsAA-Team Woocommerce Sales Funnel Builder · AA-Team Amazon A…
- CVE-2025-29004Privilege Escalation Vulnerability in AA-Team WordPress pluginsAA-Team Premium Age Verification / Restriction for WordPres…
- CVE-2025-32304WordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerabilityMojoomla WPCHURCH
- CVE-2024-30547WordPress Header Image Slider plugin <= 0.3 - Cross Site Scripting (XSS) vulnerabilityShazdeh Header Image Slider
- CVE-2025-47553WordPress DZS Video Gallery plugin <= 12.25 - PHP Object Injection vulnerabilityDigital zoom studio DZS Video Gallery
- CVE-2025-69083WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerabilityElated-Themes Frappé
- CVE-2025-69356WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2025-69351WordPress Ninja Tables plugin <= 5.2.4 - SQL Injection vulnerabilityShahjahan Jewel Ninja Tables
- CVE-2025-69342WordPress Calafate theme <= 1.7.7 - Local File Inclusion vulnerabilityVanKarWai Calafate
- CVE-2025-69084WordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerabilitygt3themes Photo Gallery
- CVE-2025-69085WordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilitye-plugins JobBank
- CVE-2025-69086WordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerabilityjwsthemes Issabella
- CVE-2025-36589Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability.Dell Unisphere for PowerMax
- CVE-2020-36917iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via CookieGuangzhou Yeroo Tech Co. iDS6 DSSPro Digital Signage System
- CVE-2020-36914QiHang Media Web Digital Signage 3.0.9 Cookie Authentication Credentials DisclosureShenzhen Xingmeng Qihang Media Co. QiHang Media Web (QH.asp…
- CVE-2020-36925Arteco Web Client DVR/NVR Session ID Brute Force Authentication BypassArteco-Global Arteco Web Client DVR/NVR
- CVE-2020-36920iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access ControlYerootech iDS6 DSSPro Digital Signage System
- CVE-2020-36916TDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure PermissionsTdmsignage TDM Digital Signage PC Player
- CVE-2020-36915Adtec Digital SignEdje Digital Signage Player v2.08.28 Default CredentialsAdtecdigital SignEdje Digital Signage Player · Adtecdigi… +9
- CVE-2020-36913All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication BypassAll-Dynamics Software enlogic:show Digital Signage System
- CVE-2020-36910Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP ParameterCAYIN Technology SMP-8000QD · CAYIN Technology SMP-8000 +17
- CVE-2020-36909Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read/WriteSecure Computing SnapGear Management Console SG560
- CVE-2020-36907Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of ServiceExtreme Networks Aerohive HiveOS
- CVE-2026-0640Tenda AC23 PowerSaveSet sscanf buffer overflowTenda AC23
- CVE-2025-14979Eddie VPN 2.24.6 - Local Privilege EscalationAirVPN Eddie
- CVE-2025-14026Vulnerable Python version used in Forcepoint One DLP ClientForcepoint One Endpoint
- CVE-2026-21411Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authePlat'Home Co. OpenBlocks IoT DX1 · Plat'Home Co. OpenBlo… +4
- CVE-2025-14997BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletionbuddydev BuddyPress Xprofile Custom Field Types
- CVE-2026-21486Use After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEVInternationalColorConsortium iccDEV
- CVE-2026-21485iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()InternationalColorConsortium iccDEV
- CVE-2026-21677iccDEV has Undefined Behavior in CIccCLUT::Init()InternationalColorConsortium iccDEV
- CVE-2026-21676iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() functionInternationalColorConsortium iccDEV
- CVE-2025-12793An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent.ASUS ASCI
- CVE-2025-15364Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePasswordcodename065 Download Manager
- CVE-2025-20781In display, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20780In display, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20779In display, there is a possible use after free due to a race condition.MediaTek chipset
- CVE-2025-20778In display, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-20801In seninf, there is a possible memory corruption due to a race condition.MediaTek chipset
- CVE-2025-20800In mminfra, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-20799In c2ps, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20798In battery, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-20797In battery, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-20796In imgsys, there is a possible out of bounds write due to improper input validation.MediaTek chipset
- CVE-2025-20795In KeyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-21673iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()InternationalColorConsortium iccDEV
- CVE-2025-68954Pterodactyl does not revoke SFTP access when server is deleted or permissions reducedpterodactyl panel · github.com/pterodactyl/wings +1
- CVE-2026-21507iccDEV is Vulnerable to Denial of Service via Infinite Loop in CalcProfileID()InternationalColorConsortium iccDEV
- CVE-2025-59379DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying S
Medium, low and unrated 109
- CVE-2026-0643projectworlds House Rental and Property Listing Signup register.php unrestricted uploadprojectworlds House Rental and Property Listing
- CVE-2025-47395Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2025-47369Information Exposure in Computer VisionQualcomm Snapdragon
- CVE-2025-47344Time-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverQualcomm Snapdragon
- CVE-2025-47337Use After Free in Camera DriverQualcomm Snapdragon
- CVE-2025-47336Use After Free in Camera DriverQualcomm Snapdragon
- CVE-2025-47335Buffer Copy Without Checking Size of Input in Camera DriverQualcomm Snapdragon
- CVE-2025-47334Buffer Copy Without Checking Size of Input in Camera DriverQualcomm Snapdragon
- CVE-2025-47333Use After Free in HLOSQualcomm Snapdragon
- CVE-2025-47332Time-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverQualcomm Snapdragon
- CVE-2025-47331Buffer Over-read in VideoQualcomm Snapdragon
- CVE-2025-47330Buffer Over-read in VideoQualcomm Snapdragon
- CVE-2026-0642projectworlds House Rental and Property Listing complaint.php cross site scriptingprojectworlds House Rental and Property Listing
- CVE-2025-11235MOVEit Transfer REST API does not require current password in order to initiate the password change processProgress MOVEit Transfer
- CVE-2025-14625Quartus® Prime Standard and Quartus® Prime Lite Security AdvisoryAltera Quartus Prime Standard · Altera Quartus Prime Lite
- CVE-2025-14614Quartus® Prime Standard and Quartus® Prime Lite Security AdvisoryAltera Quartus Prime Standard · Altera Quartus Prime Lite
- CVE-2025-14599Quartus® Prime Standard and Quartus® Prime Lite Security AdvisoryAltera Quartus Prime Standard · Altera Quartus Prime Lite
- CVE-2025-14612Quartus Prime Pro Edition AdvisoryAltera Quartus Prime Pro
- CVE-2025-14605Quartus Prime Pro Edition AdvisoryAltera Quartus Prime Pro
- CVE-2025-31051WordPress Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure VulnerabilityEngoTheme Plant - Gardening & Houseplants WordPress Theme
- CVE-2025-14596Quartus Prime Pro Edition Installer AdvisoryAltera Quartus Prime Pro
- CVE-2026-21492iccDEV ToneMap Writer has NULL Pointer Member CallInternationalColorConsortium iccDEV
- CVE-2025-7048On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption oArista Networks EOS
- CVE-2026-21491iccDEV has unicode buffer overflow in CIccTagTextDescriptionInternationalColorConsortium iccDEV
- CVE-2026-21490iccDEV has heap buffer overflow in CIccTagLut16::Validate()InternationalColorConsortium iccDEV
- CVE-2026-0641TOTOLINK WA300 cstecgi.cgi sub_401510 command injectionTOTOLINK WA300
- CVE-2026-21494iccDEV has heap buffer overflow in CIccTagLut8::Validate()InternationalColorConsortium iccDEV
- CVE-2025-15382Client SCP Request Triggers Buffer Overread by 1 BytewolfSSL wolfSSH
- CVE-2024-31088WordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityWPShop.ru AdsPlace'r – Ad Manager, Inserter, AdSense Ads
- CVE-2025-69364WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerabilityCloudways Breeze
- CVE-2025-69363WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerabilityCyberChimps Responsive Addons for Elementor
- CVE-2025-69362WordPress UiChemy plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH UiChemy
- CVE-2025-69361WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerabilityPublishPress Post Expirator
- CVE-2025-69360WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2025-69359WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerabilityWPFunnels Creator LMS
- CVE-2025-69357WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2025-69355WordPress Tickera plugin <= 3.5.6.4 - Broken Access Control vulnerabilityTickera
- CVE-2025-69354WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerabilityBBR Plugins Better Business Reviews
- CVE-2025-69353WordPress Proxy & VPN Blocker plugin <= 3.5.3 - Broken Access Control vulnerabilityProxy & VPN Blocker
- CVE-2025-69352WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerabilityStellarWP The Events Calendar
- CVE-2025-69350WordPress Accordion plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityThemepoints Accordion
- CVE-2025-69349WordPress RSS Feed Widget plugin <= 3.0.2 - Broken Access Control vulnerabilityFahad Mahmood RSS Feed Widget
- CVE-2025-69348WordPress The Events Calendar Countdown Addon plugin <= 1.4.15 - Broken Access Control vulnerabilityCoolHappy The Events Calendar Countdown Addon
- CVE-2025-69346WordPress AffiliateX plugin <= 1.3.9.3 - Broken Access Control vulnerabilityWPCenter AffiliateX
- CVE-2025-69345WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerabilityPost and Page Builder by BoldGrid
- CVE-2025-69341WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerabilityBuddhaThemes WeDesignTech Ultimate Booking Addon
- CVE-2025-69336WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2025-69335WordPress Team Showcase plugin <= 2.9 - Cross Site Scripting (XSS) vulnerabilityThemepoints Team Showcase
- CVE-2025-69334WordPress Wishlist for WooCommerce plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerabilityWPFactory Wishlist for WooCommerce
- CVE-2025-69331WordPress Theater for WordPress plugin <= 0.19 - Broken Access Control vulnerabilityJeroen Schmit Theater for WordPress
- CVE-2025-69327WordPress Car Rental Manager plugin <= 1.0.9 - Broken Access Control vulnerabilitymagepeopleteam Car Rental Manager
- CVE-2025-63082Joomla! Core - [20260101] - Inadequate content filtering for data URLsJoomla! Project Joomla! CMS
- CVE-2025-63083Joomla! Core - [20260102] - XSS vector in the pagebreak pluginJoomla! Project Joomla! CMS
- CVE-2020-36924Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File InclusionPro-Bravia Sony BRAVIA Digital Signage
- CVE-2020-36923Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDORSony Electronics Sony BRAVIA Digital Signage
- CVE-2020-36922Sony BRAVIA Digital Signage 1.7.8 Unauthenticated System API Information DisclosurePro-Bravia Sony BRAVIA Digital Signage
- CVE-2020-36921RED-V Super Digital Signage System 5.1.1 Log Information Disclosure VulnerabilityRED-V Super Digital Signage System RXV-A740R
- CVE-2020-36918iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User ManagementYerootech iDS6 DSSPro Digital Signage System
- CVE-2020-36912Plexus anblick Digital Signage Management 3.1.13 Open Redirect via Pagina ParameterPlexus anblick Digital Signage Management
- CVE-2020-36908Secure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin UsersSecure Computing SnapGear Management Console SG560
- CVE-2020-36906P5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User ManagementP5 FNIP-8x16A
- CVE-2020-36905FIBARO System Home Center 5.021 Remote File Inclusion via Proxy APIFIBAR GROUP S.A. Home Center
- CVE-2025-46696Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Dell Secure Connect Gateway (SCG) Appliance · Dell Secure C…
- CVE-2026-21493iccDEV has Type Confusion during XML Curve SerializationInternationalColorConsortium iccDEV
- CVE-2026-21489iccDEV has Out-of-bounds Read and Integer Underflow (Wrap or Wraparound)InternationalColorConsortium iccDEV
- CVE-2026-21488iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null TerminationInternationalColorConsortium iccDEV
- CVE-2025-9318Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameterexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2025-9637Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploadsexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2025-14552MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcodebuddydev MediaPress
- CVE-2025-5919Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modificationarraytics Timetics – Appointment Booking & Scheduling
- CVE-2025-13964LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modificationthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2025-9294Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletionexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2025-13766MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletionstylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2025-13812GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposurerubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2025-12067Table Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Contentjonua Table Field Add-on for ACF and SCF
- CVE-2025-14371TaxoPress <= 3.41.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modificationstevejburge Tag, Category, and Taxonomy Manager – AI Autota…
- CVE-2025-4776Phlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attributeaverta Phlox
- CVE-2025-13215Shortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposureaverta Shortcodes and extra features for Phlox theme
- CVE-2025-14120URL Image Importer <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbww URL Image Importer
- CVE-2025-14438Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request ForgeryXagio SEO – AI Powered SEO
- CVE-2025-14441Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletionroxnor Popup builder with Gamification, Multi-Step Popups,…
- CVE-2026-21487iccDEV has Out-of-bounds Read, Use of Out-of-range Pointer Offset and Improper Input ValidationInternationalColorConsortium iccDEV
- CVE-2025-13746ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Nameultimatemember ForumWP – Forum & Discussion Board
- CVE-2025-14034ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletionghera74 ilGhera Support System for WooCommerce
- CVE-2025-11370Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updatesaverta Depicter — Popup & Slider Builder
- CVE-2025-14153Page Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode Attributevikasratudi Page Expire Popup/Redirection for WordPress
- CVE-2026-0604FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameterninjateam FastDup – Fastest WordPress Migration & Duplicator
- CVE-2025-13652CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parametermanchumahara CBX Bookmark & Favorite
- CVE-2025-11723Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposurecroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2025-13409Form Vibes – Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injectionwpvibes Form Vibes – Database Manager for Forms
- CVE-2025-20807In dpe, there is a possible out of bounds write due to an integer overflow.MediaTek chipset
- CVE-2025-20806In dpe, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20805In dpe, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20804In dpe, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20803In dpe, there is a possible memory corruption due to an integer overflow.MediaTek chipset
- CVE-2025-20787In display, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20786In display, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20785In display, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20784In display, there is a possible memory corruption due to uninitialized data.MediaTek chipset
- CVE-2025-20783In display, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-20782In display, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2025-20802In geniezone, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2025-20760In Modem, there is a possible read of uninitialized heap data due to an uncaught exception.MediaTek chipset
- CVE-2025-20761In Modem, there is a possible system crash due to incorrect error handling.MediaTek chipset
- CVE-2025-20762In Modem, there is a possible system crash due to incorrect error handling.MediaTek chipset
- CVE-2025-20793In Modem, there is a possible system crash due to incorrect error handling.MediaTek chipset
- CVE-2025-20794In Modem, there is a possible system crash due to improper input validation.MediaTek chipset
- CVE-2026-21674iccDEV has a Memory Leak in its CIccProfileXml::ParseTag() Error PathInternationalColorConsortium iccDEV
- CVE-2025-69197Pterodactyl TOTPs can be reused during validity windowpterodactyl panel · pterodactyl/panel