CVEs published January 7, 2026
224 CVEs were published on January 7, 2026: 19 critical, 62 high.
- Published
- 224
- Critical
- 19
- High
- 62
- Medium
- 137
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 74
Most affected products
- InternationalColorConsortium iccDEV
- 30
- EFACEC QC 60/90/120
- 8
- ABB WebPro SNMP Card PowerValue
- 3
- Columbia Weather Systems MicroServer
- 3
- danny-avila LibreChat
- 3
- HCLSoftware BigFix IVR
- 3
- iWT FaceSentry Access Control System
- 3
- Panda3D
- 3
- pnpm
- 3
- the-hideout tarkov-data-manager
- 3
Critical 19
- CVE-2026-21858n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handlingn8n-io n8n · n8n
- CVE-2026-21875ClipBucket v5 Vulnerable to Blind SQL Injection through Channel CommentsMacWarrior clipbucket-v5
- CVE-2025-15346wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirementwolfSSL-py · wolfssl
- CVE-2019-25291INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials VulnerabilityINIM Electronics s.r.l. Smartliving SmartLAN/G/SI
- CVE-2019-25278FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM DisclosureiWT FaceSentry Access Control System
- CVE-2017-20216FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command InjectionFLIR Systems FLIR Thermal Camera PT-Series
- CVE-2017-20214FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials VulnerabilityFLIR Systems FLIR Thermal Camera F/FC/PT/D
- CVE-2025-69222LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictionsdanny-avila LibreChat
- CVE-2026-21855Tarkov Data Manager has Unauthenticated Reflected XSSthe-hideout tarkov-data-manager
- CVE-2026-21854Tarkov Data Manager Authentication Bypass vulnerabilitythe-hideout tarkov-data-manager
- CVE-2025-12543Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfRed Hat build of Apache Camel 4.14.4 for Spring Boot ·… +10
- CVE-2026-22542DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNETEFACEC QC 60/90/120
- CVE-2026-22540DENIAL OF SERVICE VIA ARP PACKETSEFACEC QC60/90/120
- CVE-2025-47552WordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection VulnerabilityDigital zoom studio DZS Video Gallery
- CVE-2025-32303WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection VulnerabilityMojoomla WPCHURCH
- CVE-2025-68637Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP ClientApache Software Foundation Apache Uniffle
- CVE-2025-15018Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeoverdjanym Optional Email
- CVE-2026-0650OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path NormalizationOpenFlagr Flagr · github.com/openflagr/flagr
- CVE-2025-61492A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary comterminal-controller
High 62
- CVE-2026-21869llama.cpp has Out-of-bounds Write in llama-serverggml-org llama.cpp
- CVE-2019-25289INIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command ExecutionINIM Electronics s.r.l. SmartLiving SmartLAN/G/SI
- CVE-2019-25268NREL BEopt 2.8.0 Insecure Library Loading Arbitrary Code ExecutionNREL BEopt
- CVE-2019-25231devolo dLAN Cockpit 4.3.1 Unquoted Service Path Privilege Escalationdevolo AG devolo dLAN Cockpit
- CVE-2017-20215FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command InjectionFLIR Systems FLIR Thermal Camera FC-S/PT
- CVE-2017-20213FLIR Thermal Camera F/FC/PT/D Stream 8.0.0.64 Unauthenticated Stream DisclosureFLIR Systems FLIR Thermal Camera F/FC/PT/D Stream
- CVE-2017-20212FLIR Thermal Camera F/FC/PT/D 8.0.0.64 Information Disclosure via File ReadingFLIR Systems FLIR Thermal Camera F/FC/PT/D
- CVE-2026-21857Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Readredaxo · redaxo/source
- CVE-2025-69262pnpm vulnerable to Command Injection via environment variable substitutionpnpm
- CVE-2026-21697axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leakrezmoss axios4go
- CVE-2026-21441urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)urllib3
- CVE-2026-22047iccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppInternationalColorConsortium iccDEV
- CVE-2026-22046iccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppInternationalColorConsortium iccDEV
- CVE-2026-21693iccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppInternationalColorConsortium iccDEV
- CVE-2026-21692iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cppInternationalColorConsortium iccDEV
- CVE-2025-69264pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"pnpm
- CVE-2026-21688iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cppInternationalColorConsortium iccDEV
- CVE-2026-21687iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()InternationalColorConsortium iccDEV
- CVE-2025-69263pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependenciespnpm
- CVE-2026-21686iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()InternationalColorConsortium iccDEV
- CVE-2026-21685iccDEV has Undefined Behavior in CIccTagLut16::Read()InternationalColorConsortium iccDEV
- CVE-2026-21684iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()InternationalColorConsortium iccDEV
- CVE-2025-13151CVE-2025-13151GnuTLS libtasn1
- CVE-2026-21683iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()InternationalColorConsortium iccDEV
- CVE-2026-21682iccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText()InternationalColorConsortium iccDEV
- CVE-2025-69220LibreChat has Insufficient Access Control for Agent Filesdanny-avila LibreChat
- CVE-2026-21681iccDEV has Undefined Behavior runtime error: nan is outside the range .. IccProfLib/IccTagBasic.cppInternationalColorConsortium iccDEV
- CVE-2025-68705RustFS Path Traversal Vulnerabilityrustfs
- CVE-2025-66620Columbia Weather Systems MicroServer Command Shell in Externally Accessible DirectoryColumbia Weather Systems MicroServer
- CVE-2025-64305Columbia Weather Systems MicroServer Cleartext Storage in a File or on DiskColumbia Weather Systems MicroServer
- CVE-2025-61939Columbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended EndpointsColumbia Weather Systems MicroServer
- CVE-2026-21856Tarkov Data Manager has Authenticated SQL Injectionthe-hideout tarkov-data-manager
- CVE-2026-0669Path Traversal vulnerability in CSS extension on certain web serversWikimedia Foundation MediaWiki - CSS extension
- CVE-2026-21679iccDEV has heap-buffer-overflow vulnerability in CIccLocalizedUnicode::GetText()InternationalColorConsortium iccDEV
- CVE-2026-21678iccDEV has heap-buffer-overflow vulnerability on IccTagXml()InternationalColorConsortium iccDEV
- CVE-2025-4676Authentication bypass by brute forcing Authentication HeadersABB WebPro SNMP Card PowerValue
- CVE-2026-22536PRIVILEGE ESCALATION VIA SUDO COMMANDEFACEC QC 60/90/120
- CVE-2026-22535FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERSEFACEC QC 60/90/120
- CVE-2026-22544EXCHANGE OF CREDENTIALS IN CLEAR TEXTEFACEC QC 60/90/120
- CVE-2026-22541DENIAL OF SERVICE VIA ICMP PACKETSEFACEC QC 60/90/120
- CVE-2025-46494WordPress WidgetKit Pro plugin <= 1.13.1 - Reflected Cross Site Scripting (XSS) vulnerabilityThemesgrove WidgetKit Pro
- CVE-2025-32300WordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerabilityDigital zoom studio DZS Video Gallery
- CVE-2025-31643WordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation VulnerabilityDasinfomedia WPCHURCH
- CVE-2025-69080WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerabilityJanStudio Gecko
- CVE-2025-69081WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerabilityThemeREX Hope
- CVE-2025-69082WordPress Arlo theme <= 6.0.3 - Cross Site Scripting (XSS) vulnerabilityFrenify Arlo
- CVE-2025-13801Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Readyocoadmin Yoco Payments
- CVE-2025-14070Reviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creationxfinitysoft Reviewify — Review Discounts & Photo/Video Revi…
- CVE-2025-15158WP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Uploadeastsidecode WP Enable WebP
- CVE-2025-13493Latest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Exportwebrndexperts Latest Registered Users
- CVE-2025-11877User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Loginsolwininfotech User Activity Log
- CVE-2026-0656iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information DisclosureiPaymu Payment Gateway for WooCommerce
- CVE-2025-13371Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposuremoneyspace Money Space
- CVE-2025-14804Frontend File Manager < 23.5 - Subscriber+ Arbitrary File DeletionFrontend File Manager Plugin
- CVE-2025-14835WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scriptingopajaap WP Photo Album Plus
- CVE-2025-9611Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header ValidationMicrosoft Playwright · @playwright/mcp
- CVE-2026-20893Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier.Fujitsu Client Computing Limited Fujitsu Security Solution…
- CVE-2025-14631Null Pointer Dereference Vulnerability in Malformed 802.11 Frame of TP-Link Archer BE400TP-Link Systems Archer BE400
- CVE-2025-65805OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages.
- CVE-2025-66786OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests.
- CVE-2025-67364fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file.fast-filesystem-mcp
- CVE-2025-67366@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality.
Medium, low and unrated 143
- CVE-2026-21859Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)axllent mailpit · github.com/axllent/mailpit
- CVE-2026-21695Titra API Contains Mass Assignment Vulnerabilitykromitgmbh titra
- CVE-2019-25284V-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Reflected Cross-Site Scripting VulnerabilityGuangzhou V V-SOL GPON/EPON OLT Platform
- CVE-2019-25280Yahei-PHP Prober 0.4.7 Remote HTML Injection via Speed ParameterYahei.Net Yahei-PHP Prober
- CVE-2019-25277FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.phpiWT FaceSentry Access Control System
- CVE-2019-25270SOCA Access Control System 180612 Reflected Cross-Site Scripting via logged_page.phpSOCA Technology Co. SOCA Access Control System
- CVE-2026-21694Titra APIs have Improper Access Controlkromitgmbh titra
- CVE-2019-25290INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImageINIM Electronics s.r.l. Smartliving SmartLAN/G/SI
- CVE-2019-25282V-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Open Redirect via bindProfile.htmlGuangzhou V V-SOL GPON/EPON OLT Platform
- CVE-2019-25279FaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityiWT FaceSentry Access Control System
- CVE-2019-25259Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Cross-Site Request ForgeryLeica Geosystems AG Leica Geosystems GR10/GR25/GR30/GR50 GN…
- CVE-2023-7333bluelabsio records-mover Table Object sql injectionbluelabsio records-mover · records-mover
- CVE-2025-62224Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2026-21851MONAI has Path Traversal (Zip Slip) in NGC Private Bundle DownloadProject-MONAI MONAI · monai
- CVE-2025-12776Stored Cross-Site ScriptingCommvault WebConsole
- CVE-2026-21691iccDEV has Type Confusion in CIccTag:IsTypeCompressed()InternationalColorConsortium iccDEV
- CVE-2026-21690iccDEV has Type Confusion in CIccTagXmlTagData::ToXml()InternationalColorConsortium iccDEV
- CVE-2026-21689iccDEV has Type Confusion in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppInternationalColorConsortium iccDEV
- CVE-2025-69221LibreChat has Insufficient Access Control for Agent Permission Queriesdanny-avila LibreChat
- CVE-2025-69255RustFS gRPC GetMetrics deserialization panic enables remote DoSrustfs
- CVE-2026-22187Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache FilesOpen Microscopy Environment Bio-Formats · ome:pom-bio-forma…
- CVE-2026-22186Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata ParserOpen Microscopy Environment Bio-Formats · ome:pom-bio-forma…
- CVE-2026-22185OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()OpenLDAP Foundation OpenLDAP
- CVE-2026-22188Panda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()Panda3D
- CVE-2026-22190Panda3D <= 1.10.16 egg-mkfont Format String Information DisclosurePanda3D
- CVE-2026-22189Panda3D <= 1.10.16 egg-mkfont Stack Buffer OverflowPanda3D
- CVE-2026-22184zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()zlib software zlib
- CVE-2026-0670Stored XSS through a system message and a user-provided parameter in ProofreadPageWikimedia Foundation MediaWiki - ProofreadPage Extension
- CVE-2026-21680iccDEV has Null Pointer Dereference in CIccProfile::CheckTagTypes()InternationalColorConsortium iccDEV
- CVE-2026-0668VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user inputWikimedia Foundation MediaWiki - VisualData Extension
- CVE-2025-66560Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to writequarkusio quarkus · io.quarkus:quarkus-rest
- CVE-2025-61782Open Redirect in OpenCTI's SAML Authentication FlowOpenCTI-Platform opencti · pycti
- CVE-2025-58441Knowage is vulnerable to blind server-side request forgery (SSRF)KnowageLabs Knowage-Server
- CVE-2026-22539INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)EFACEC QC 60/90/120
- CVE-2026-21506iccDEV is Vulnerable to Null Pointer Dereference in CIccProfileXml::ParseBasic() Leading to Denial of ServiceInternationalColorConsortium iccDEV
- CVE-2026-21505iccDEV has Undefined Behavior (UB) - Invalid Enum ValueInternationalColorConsortium iccDEV
- CVE-2026-21503iccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArrayInternationalColorConsortium iccDEV
- CVE-2026-21504Heap Buffer Overflow in iccDEV ToneMap ParserInternationalColorConsortium iccDEV
- CVE-2026-21501Stack Overflow in iccDEV Calculator ParserInternationalColorConsortium iccDEV
- CVE-2026-21502NULL Pointer Dereference in iccDEV XML Tag ParserInternationalColorConsortium iccDEV
- CVE-2026-21500Stack Overflow in iccDEV XML Calculator Macro ExpansionInternationalColorConsortium iccDEV
- CVE-2026-21499NULL Pointer Dereference in iccDEV XML ParserInternationalColorConsortium iccDEV
- CVE-2026-21498NULL Pointer Dereference in iccDEV XML Calculator ParserInternationalColorConsortium iccDEV
- CVE-2026-21496NULL Pointer Dereference in iccDEV Signature ParserInternationalColorConsortium iccDEV
- CVE-2025-4677Idle session timeout is not configured for multiple open portsABB WebPro SNMP Card PowerValue
- CVE-2026-21497NULL Pointer Dereference in iccDEV Unknown Tag ParserInternationalColorConsortium iccDEV
- CVE-2026-21495Division by Zero in iccDEV TIFF Image ReaderInternationalColorConsortium iccDEV
- CVE-2026-22537INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEMEFACEC QC 60/90/120
- CVE-2026-0618Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.Devolutions PowerShell Universal
- CVE-2025-4675Improper implementation of Modbus protocol leading to DOS attackABB WebPro SNMP Card PowerValue
- CVE-2026-20029Cisco Identity Services Engine XML External Entity Processing Information Disclosure VulnerabilityCisco Identity Services Engine Software
- CVE-2026-20027Cisco Snort DCERPC Stub Data Out of Bounds ReadCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-20026Multiple Cisco Products Snort 3 DCERPC VulnerabilitiesCisco Secure Firewall Threat Defense (FTD) Software · Cisco…
- CVE-2026-22543WEEK ENCODING FOR PASSWORDSEFACEC QC 60/90/120
- CVE-2025-62327HCL DevOps Deploy is susceptible to insufficiently protected credentialsHCLSoftware DevOps Deploy
- CVE-2025-49335WordPress External Media plugin <= 1.0.36 - Server Side Request Forgery (SSRF) vulnerabilityminnur External Media
- CVE-2025-15479NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal dataData Illusion Zumbrunn NGSurvey
- CVE-2025-6225Command injection in Kieback&Peter Neutrino-GLTKieback&Peter Neutrino-GLT
- CVE-2025-46434WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerabilityPOSIMYTH Innovation The Plus Addons for Elementor Pro
- CVE-2025-46256WordPress Advanced Database Cleaner PRO Plugin <= 3.2.10 - Limited .txt Path Traversal vulnerabilitySigmaPlugin Advanced Database Cleaner PRO
- CVE-2025-69333WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerabilityCrocoblock JetEngine
- CVE-2025-69344WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerabilitythemehunk Oneline Lite
- CVE-2025-13722Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Buildertechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2025-14057Multi-column Tag Map <= 17.0.39 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parametertugbucket Multi-column Tag Map
- CVE-2025-14077Simcast <= 1.0.0 - Cross-Site Request Forgery to Settings Updateopenchamp Simcast
- CVE-2025-15058Responsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency'spwebguy Responsive Pricing Table
- CVE-2025-141141180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attributechrisblackwell 1180px Shortcodes
- CVE-2025-14460Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Changeenartia Piraeus Bank WooCommerce Payment Gateway
- CVE-2025-14122AD Sliding FAQ <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesanybodesign AD Sliding FAQ
- CVE-2025-13974Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Contentthemehigh Email Customizer for WooCommerce | Drag and Drop…
- CVE-2025-14121EDD Download Info <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessamikeijonen EDD Download Info
- CVE-2025-14147Easy GitHub Gist Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributecorsonr Easy GitHub Gist Shortcodes
- CVE-2025-13841Smart App Banners <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributesclevelandwebdeveloper Smart App Banners
- CVE-2025-13990Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data ManipulationMamurjor Employee Info
- CVE-2025-13419Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletionaharonyan Guest posting / Frontend Posting / Front Editor –…
- CVE-2025-14465Sticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Updatepraveentamil Sticky Action Buttons
- CVE-2025-14144Mstoic Shortcodes <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode AttributeMstoic Shortcodes
- CVE-2025-14131WP Widget Changer <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']damienoh WP Widget Changer
- CVE-2025-14453My Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attributeruhul080 My Album Gallery
- CVE-2025-14113Viitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attributeviitorcloudvc Viitor Button Shortcodes
- CVE-2025-14112Snillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attributemattiaspkallio Snillrik Restaurant Menu
- CVE-2025-13418Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scriptingspwebguy Responsive Pricing Table
- CVE-2025-14626QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributeswww15to QR Code for WooCommerce order emails, PDF invoices,…
- CVE-2025-14130Post Like Dislike <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']cuvixsystem Post Like Dislike
- CVE-2025-13849Cool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesmatiasanca Cool YT Player
- CVE-2025-13887AI BotKit <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeswisdmlabs AI ChatBot for WordPress by AI BotKit – Live in 2…
- CVE-2025-14145Niche Hero | Beautifully-designed blocks in seconds <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'spacing' Shortcode Attributedjrowling Niche Hero | Beautifully-designed blocks in secon…
- CVE-2025-14352Awesome Hotel Booking <= 1.0.3 - Incorrect Authorization to Unauthenticated Arbitrary Booking Modificationnahian91 Awesome Hotel Booking
- CVE-2025-14110WP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attributepichel WP Js List Pages Shortcodes
- CVE-2025-13848STM Gallery 1.9 <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessergiotoca STM Gallery
- CVE-2025-14118Starred Review <= 1.4.2 - Reflected Cross-Site Scripting via PHP_SELF Variablecallumalden Starred Review
- CVE-2025-14028Contact Us Simple Form <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsbruterdregz Contact Us Simple Form
- CVE-2025-14796My Album Gallery <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Image Titleruhul080 My Album Gallery
- CVE-2025-14128Stumble! for WordPress <= 1.1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']mitchoyoshitaka Stumble! for WordPress
- CVE-2025-14127Testimonial Master <= 0.2.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']fpcorso Testimonial Master
- CVE-2025-13667WP Recipe Manager <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Fieldtomiup WP Recipe Manager
- CVE-2025-14109AH Shortcodes <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attributeahecht AH Shortcodes
- CVE-2025-13694AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Headeraaextensions AA Block country
- CVE-2025-14053Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesjseto Travel Bucket List – Wish To Go
- CVE-2025-13847PhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdavidangel PhotoFade
- CVE-2025-13521WP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Updatefulippo WP Status Notifier
- CVE-2025-13497Recras WordPress plugin <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attributezanderz Recras
- CVE-2025-13496Moosend Landing Pages <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Option DeletionMoosend Landing Pages
- CVE-2025-13520MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings UpdateMTCaptcha WordPress Plugin
- CVE-2025-13527xShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameteranwerashif xShare
- CVE-2025-12958Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code CreationRankology SEO and Analytics Tool
- CVE-2025-13529Unify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parametercodeclouds Unify
- CVE-2025-14999Latest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Updatekentothemes Latest Tabs
- CVE-2025-12540ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data ExposureShareThis Dashboard for Google Analytics
- CVE-2025-12030ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modificationairesvsg ACF to REST API
- CVE-2025-13519SVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site ScriptingSVG Map by Smjrifle
- CVE-2025-13531Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameterhayyatapps Stylish Order Form Builder
- CVE-2025-15000Page Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parametertfrommen Page Keys
- CVE-2025-0980JSON RPC authentication bypass in Nokia SR LinuxNokia SR Linux
- CVE-2025-31964HCL BigFix IVR is impacted by an improper service binding configurationHCLSoftware BigFix IVR
- CVE-2025-14792Key Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_renderaudrasjb Key Figures
- CVE-2025-12449aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modificationkodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2025-13369Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site ScriptingPremmerce WooCommerce Customers Manager
- CVE-2025-14802LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2025-31963HCL BigFix IVR is impacted by improper authentication and missing CSRF protectionHCLSoftware BigFix IVR
- CVE-2025-31962HCL BigFix IVR is impacted by an insufficient session expiration vulnerabilityHCLSoftware BigFix IVR
- CVE-2025-14867Flashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversalliangshao Flashcard Plugin for WordPress
- CVE-2025-14842Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Uploadglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-14845NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Updatensthemes NS Ie Compatibility Fixer
- CVE-2025-14888Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Fieldanjan011 Simple User Meta Editor
- CVE-2025-13657HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_argshelpdeskcom HelpDesk Contact Form
- CVE-2025-14887twinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settingswpcommerz twinklesmtp – Email Service Provider For WordPress
- CVE-2025-14370Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Updatemetodiew Quote Comments
- CVE-2025-14875HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' ParameterHBLPAY Payment Gateway for WooCommerce
- CVE-2025-14901Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replaybitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- CVE-2025-14904Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Updateanilankola Newsletter Email Subscribe
- CVE-2025-14719Relevanssi (Free < 4.26.0, Premium < 2.29.0) - Contributor+ SQLiRelevanssi
- CVE-2025-15474AuntyFey Smart Combination Lock BLE Connection Flood DoSAuntyFey Smart Combination Lock
- CVE-2025-14468AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submissionmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2025-14059EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversalroxnor EmailKit – Email Customizer for WooCommerce & WP
- CVE-2025-14891Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameterivole Customer Reviews for WooCommerce
- CVE-2025-12648WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Filescbutlerjr WP-Members Membership Plugin
- CVE-2026-0649invoiceninja Migration Import Import.php copy server-side request forgeryinvoiceninja
- CVE-2024-14020carboneio carbone Formatter input.js prototype pollutioncarboneio carbone · carbone
- CVE-2025-61489A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via
- CVE-2025-66686A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2.
- CVE-2025-66837A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware
- CVE-2025-66838In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upl