CVEs published January 8, 2026
191 CVEs were published on January 8, 2026: 27 critical, 77 high.
- Published
- 191
- Critical
- 27
- High
- 77
- Medium
- 81
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 74
Most affected products
- code-projects Intern Membership Management System
- 7
- curl
- 6
- OPEXUS eCASE Audit
- 4
- zauberzeug nicegui · nicegui
- 4
- kanboard
- 3
- Trend Micro Apex Central
- 3
- Veeam Backup and Recovery
- 3
- Asseco InfoMedica Plus
- 2
- https://github.com/FoobarOy/ Foomuuri
- 2
- https://github.com/KDE/ smb4k
- 2
Critical 27
- CVE-2026-22234OPEXUS eCasePortal unauthenticated IDOROPEXUS eCase Portal
- CVE-2025-59468This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passworVeeam Backup and Recovery
- CVE-2025-59469This vulnerability allows a Backup or Tape Operator to write files as root.Veeam Backup and Recovery
- CVE-2025-59470This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or oVeeam Backup and Recovery
- CVE-2026-22034Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD packagejvoisin snuffleupagus
- CVE-2026-21891ZimaOS has Authentication Bypass via System-Level UsernameIceWhaleTech ZimaOS
- CVE-2026-21876OWASP CRS has multipart bypass using multiple content-type partscoreruleset
- CVE-2025-69258A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL Trend Micro Apex Central
- CVE-2025-62877Harvest may expose OS default ssh login password via SUSE Virtualization Interactive InstallerSUSE harvester · github.com/harvester/harvester-installer
- CVE-2025-67928WordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerabilitythemesuite Automotive Listings
- CVE-2025-67924WordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerabilityzozothemes Corpkit
- CVE-2025-67911WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerabilityTribulant Software Newsletters
- CVE-2025-67910WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerabilityContentstudio
- CVE-2025-23993WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerabilityRiceTheme Felan Framework
- CVE-2025-23504WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerabilityRiceTheme Felan Framework
- CVE-2019-25296WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Deleteloopus WP Cost Estimation & Payment Forms Builder
- CVE-2026-21881Kanboard is Vulnerable to Reverse Proxy Authentication Bypasskanboard
- CVE-2026-21877n8n is vulnerable to Remote Code Execution via Arbitrary File Writen8n-io n8n · n8n
- CVE-2025-56425An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version
- CVE-2025-61246indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter.
- CVE-2025-61546There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34
- CVE-2025-61548SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business
- CVE-2025-66913JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs.
- CVE-2025-66916The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpre
- CVE-2025-67325Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achiev
- CVE-2025-68715An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/se
- CVE-2025-68717KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation.
High 77
- CVE-2025-14436Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scriptingneeraj_slit Brevo for WooCommerce
- CVE-2025-15464KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijackingyintibao Fun Print Mobile
- CVE-2026-22257Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious namessalvo-rs salvo · salvo
- CVE-2026-22256Salvo is vulnerable to reflected XSS in the list_html functionsalvo-rs salvo · salvo
- CVE-2026-22235OPEXUS eComplaint IDOROPEXUS eComplaint
- CVE-2026-22230OPEXUS eCASE Audit incorrect access controlOPEXUS eCASE Audit
- CVE-2026-22521WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerabilityG5Theme Handmade Framework
- CVE-2025-55125This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuraVeeam Backup And Recovery
- CVE-2026-21639A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote Ubiquiti airMAX AC · Ubiquiti airMAX M +2
- CVE-2026-21638A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote Ubiquiti UBB-XG · Ubiquiti UDB-Pro/UDB-Pro-Sector +1
- CVE-2026-22255iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cppInternationalColorConsortium iccDEV
- CVE-2025-67858A crafted "interface" input parameter can lead to integrity loss of the firewall configurationhttps://github.com/FoobarOy/ Foomuuri
- CVE-2026-22245Mastodon has SSRF Protection bypassmastodon
- CVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCEopen-metadata OpenMetadata · org.open-metadata:platform
- CVE-2026-22241Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)gunet openeclass
- CVE-2025-66003Local users can perform a local root exploit via smb4k mounthelperhttps://github.com/KDE/ smb4k
- CVE-2026-22028Preact has JSON VNode Injection issuepreactjs preact · preact
- CVE-2025-14025Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1
- CVE-2025-69260A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service conditionTrend Micro Apex Central
- CVE-2025-69259A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service Trend Micro Apex Central
- CVE-2026-0719Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authenticationRed Hat Enterprise Linux · Red Hat OpenShift Dev Spaces (RH…
- CVE-2025-66001NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)SUSE neuvector · github.com/neuvector/neuvector
- CVE-2026-21873Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`zauberzeug nicegui · nicegui
- CVE-2025-68892WordPress Scroll rss excerpt plugin <= 5.0 - Reflected Cross Site Scripting (XSS) vulnerabilitygopiplus@hotmail.com Scroll rss excerpt
- CVE-2025-68891WordPress WP App Bar plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityRyan Sutana WP App Bar
- CVE-2025-68890WordPress e-shops plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityhands01 e-shops
- CVE-2025-68889WordPress Pinpoll plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityPinpoll
- CVE-2025-68887WordPress WP-BusinessDirectory plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityCMSJunkie - WordPress Business Directory Plugins WP-Busines…
- CVE-2025-68874WordPress Visitor Stats Widget plugin <= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityShahjada Visitor Stats Widget
- CVE-2025-68873WordPress PRIMER by chloédigital plugin <= 1.0.25 - Reflected Cross Site Scripting (XSS) vulnerabilityPRIMER by chloédigital
- CVE-2025-67937WordPress Hendon theme < 1.7 - Local File Inclusion vulnerabilityMikado-Themes Hendon
- CVE-2025-67936WordPress Curly theme < 3.3 - Local File Inclusion vulnerabilityMikado-Themes Curly
- CVE-2025-67935WordPress Optimize theme < 2.4 - Local File Inclusion vulnerabilityMikado-Themes Optimize
- CVE-2025-67934WordPress Wellspring theme < 2.8 - Local File Inclusion vulnerabilityMikado-Themes Wellspring
- CVE-2025-67933WordPress Taskbuilder plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerabilityTaskbuilder
- CVE-2025-67932WordPress Listeo Core plugin < 2.0.19 - Cross Site Scripting (XSS) vulnerabilitypurethemes Listeo Core
- CVE-2025-67931WordPress BulletProof Security plugin <= 6.9 - Sensitive Data Exposure vulnerabilityAITpro BulletProof Security
- CVE-2025-67930WordPress eHive Search plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityVernon Systems Limited eHive Search
- CVE-2025-67927WordPress Link Whisper Free plugin <= 0.8.8 - Cross Site Scripting (XSS) vulnerabilitySpencer Haws Link Whisper Free
- CVE-2025-67925WordPress Corpkit theme <= 2.0 - Local File Inclusion vulnerabilityzozothemes Corpkit
- CVE-2025-67922WordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Restaurant
- CVE-2025-67921WordPress Lobo theme < 2.8.6 - SQL Injection vulnerabilityVanKarWai Lobo
- CVE-2025-67920WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerabilityElated-Themes Neo Ocular
- CVE-2025-67918WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerabilityWofficeIO Woffice
- CVE-2025-67916WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerabilityAstoundify Jobify
- CVE-2025-67915WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerabilityArraytics Timetics
- CVE-2025-67914WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerabilitybeeteam368 VidMov
- CVE-2025-27004WordPress Famous - Responsive Image And Video Grid Gallery WordPress Plugin plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Famous - Responsive Image And Video Grid Galle…
- CVE-2025-27002WordPress CountDown With Image or Video Background plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup CountDown With Image or Video Background
- CVE-2025-22728WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerabilityAmentoTech Workreap
- CVE-2025-22725WordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityloopus WP Virtual Assistant
- CVE-2025-22715WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion vulnerabilityloopus WP Attractive Donations System - Easy Stripe & Paypa…
- CVE-2025-22713WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerabilityvanquish WooCommerce Orders & Customers Exporter
- CVE-2025-22712WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerabilityQantumThemes Typify
- CVE-2025-22708WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerabilityThemeMove Mitech
- CVE-2025-22707WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerabilityThemeMove Moody
- CVE-2025-22509WordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerabilityTMRW-studio Atlas
- CVE-2025-14431WordPress Navian theme <= 1.5.4 - Local File Inclusion vulnerabilityTHEMELOGI Navian
- CVE-2025-14430WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerabilityThemeMove Brook
- CVE-2025-14429WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerabilityThemeMove AeroLand
- CVE-2025-14360WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerabilityKaira Blockons
- CVE-2025-14359WordPress Oshine theme < 7.3.0 - Local File Inclusion vulnerabilitybrandexponents Oshine
- CVE-2025-14358WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerabilitysizam REHub Framework
- CVE-2025-13504WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilitye-plugins Real Estate Pro
- CVE-2025-12551WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerabilitye-plugins ListingHub
- CVE-2025-12550WordPress OchaHouse theme <= 2.2.8 - Local File Inclusion vulnerabilityjwsthemes OchaHouse
- CVE-2025-12549WordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerabilitymagentech Rozy - Flower Shop
- CVE-2026-21427The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurelyPIONEER USB DAC Amplifier APS-DA101JS · PIONEER USB DAC… +8
- CVE-2026-21868Flag Forge has ReDoS Vulnerability in User Profile Lookup APIFlagForgeCTF flagForge
- CVE-2026-22035Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugingreenshot
- CVE-2025-50334An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component
- CVE-2025-56424An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service v
- CVE-2025-63611Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /regis
- CVE-2025-65518Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition.
- CVE-2025-67089A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8.
- CVE-2025-68716KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface.
- CVE-2025-68719KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management.
Medium, low and unrated 87
- CVE-2026-22714i18n XSS, DoS and config SQLI in MonacoThe Wikimedia Foundation Mediawiki - Monaco Skin
- CVE-2026-22710Stored XSS through autocomment system messages in WikibaseThe Wikimedia Foundation Mediawiki - Wikibase Extension
- CVE-2026-0733PHPGurukul Online Course Registration System manage-students.php sql injectionPHPGurukul Online Course Registration System
- CVE-2026-0732D-Link DI-8200G upgrade_filter.asp command injectionD-Link DI-8200G
- CVE-2026-0731TOTOLINK WA1200 HTTP Request cstecgi.cgi null pointer dereferenceTOTOLINK WA1200
- CVE-2026-0730PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scriptingPHPGurukul Staff Leave Management System
- CVE-2026-0729code-projects Intern Membership Management System add_activity.php sql injectioncode-projects Intern Membership Management System
- CVE-2025-14505Elliptic Cryptanalysis vulnerability when `k` has leading zerosElliptic
- CVE-2026-22588Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modificationspree · spree_api
- CVE-2026-0728code-projects Intern Membership Management System delete_admin.php sql injectioncode-projects Intern Membership Management System
- CVE-2026-0747Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025Devolutions Remote Desktop Manager
- CVE-2026-22253Soft Serve is missing an authorization check in LFS lock deletioncharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2026-21860Werkzeug safe_join() allows Windows special device names with compound extensionspallets werkzeug · werkzeug
- CVE-2026-21896Kirby is missing permission checks in the content changes APIgetkirby kirby · getkirby/cms
- CVE-2025-68158Authlib: 1-click Account Takeoverauthlib
- CVE-2026-22233OPEXUS eCASE Audit Project Cost stored XSSOPEXUS eCASE Audit
- CVE-2026-22232OPEXUS eCASE Audit Project Setup stored XSSOPEXUS eCASE Audit
- CVE-2026-22231OPEXUS eCASE Audit Document Check Out stored XSSOPEXUS eCASE Audit
- CVE-2026-22587Ideagen DevonWay Reports page stored XSSIdeagen DevonWay
- CVE-2026-22486WordPress Re Gallery plugin <= 1.18.9 - Broken Access Control vulnerabilityRe Gallery
- CVE-2026-22487WordPress Speed Kit plugin <= 2.0.2 - Broken Access Control vulnerabilitybaqend Speed Kit
- CVE-2026-22488WordPress Dashboard Welcome for Beaver Builder plugin <= 1.0.8 - Broken Access Control vulnerabilityIdeaBox Creations Dashboard Welcome for Beaver Builder
- CVE-2026-22489WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerabilityWptexture Image Slider Slideshow
- CVE-2026-22490WordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerabilityniklaslindemann Bulk Landing Page Creator for WordPress LPa…
- CVE-2026-22492WordPress Docket Cache plugin <= 24.07.04 - Broken Access Control vulnerabilityNawawi Jamili Docket Cache
- CVE-2026-22517WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerabilityPassionate Brains GA4WP: Google Analytics for WordPress
- CVE-2026-0671Multiple stored i18n/message-key XSSes in UploadWizardWikimedia Foundation MediaWiki - UploadWizard extension
- CVE-2026-22518WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerabilitypencilwp X Addons for Elementor
- CVE-2026-22519WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerabilityBuddyDev MediaPress
- CVE-2026-22522WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerabilityMunir Kamal Block Slider
- CVE-2025-68151CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messagescoredns · github.com/coredns/coredns
- CVE-2026-22246Local Mastodon users can enumerate and access severed relationships of every other local usermastodon
- CVE-2025-67603Lack of client authorization allows arbitrary users to influence the firewall configurationhttps://github.com/FoobarOy/ Foomuuri
- CVE-2026-22043RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Mintingrustfs
- CVE-2025-4596Information disclosure via IDOR in Asseco AMDXAsseco AMDX
- CVE-2026-22042RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalationrustfs
- CVE-2026-22041loggingredactor converts non-string types to string types in logsarmurox loggingredactor · loggingredactor
- CVE-2026-22032Directus has open redirect in SAMLdirectus · @directus/api
- CVE-2025-66002Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validationhttps://github.com/KDE/ smb4k
- CVE-2026-21895rsa crate has potential panic on a prime being equal to 1RustCrypto RSA · rsa
- CVE-2026-21892Parsl Monitoring Visualization Vulnerable to SQL Injectionparsl
- CVE-2026-21885Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resourcesminiflux · miniflux.app/v2 +1
- CVE-2025-8307Recoverable passwords in Asseco Infomedica PlusAsseco InfoMedica Plus
- CVE-2025-8306Improper Access Control in Asseco Infomedica PlusAsseco InfoMedica Plus
- CVE-2025-15224libssh key passphrase bypass without agent setcurl
- CVE-2025-15079libssh global known_hosts overridecurl
- CVE-2025-14819OpenSSL partial chain store policy bypasscurl
- CVE-2025-14524bearer token leak on cross-protocol redirectcurl
- CVE-2025-14017broken TLS options for threaded LDAPScurl
- CVE-2025-13034No QUIC certificate pinning with GnuTLScurl
- CVE-2026-22242CoreShop Vulnerable to SQL Injection via Admin ReportsCoreShop · coreshop/core-shop
- CVE-2026-21894n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooksn8n-io n8n · n8n
- CVE-2026-21874NiceGUI has Redis connection leak via tab storage causes service degradationzauberzeug nicegui · nicegui
- CVE-2026-21872NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided linkszauberzeug nicegui · nicegui
- CVE-2026-21871NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()zauberzeug nicegui · nicegui
- CVE-2025-14984Gutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadjegstudio Gutenverse Form – Contact Form Builder, Booking,…
- CVE-2026-0676WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerabilityG5Theme Zorka
- CVE-2026-0674WordPress Campaign Monitor for WordPress plugin <= 2.9.1 - Broken Access Control vulnerabilityCampaign Monitor for WordPress
- CVE-2025-69169WordPress Easy Media Download plugin <= 1.1.11 - CSS Injection vulnerabilityNoor Alam Easy Media Download
- CVE-2025-68875WordPress Flaming Password Reset plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityjcaruso001 Flaming Password Reset
- CVE-2025-68867WordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityanibalwainstein Effect Maker
- CVE-2025-67926WordPress Fluent Support plugin <= 1.10.4 - Broken Access Control vulnerabilityShahjahan Jewel Fluent Support
- CVE-2025-67919WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerabilityWofficeIO Woffice Core
- CVE-2025-67917WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerabilityshinetheme Traveler
- CVE-2025-67913WordPress Aruba HiSpeed Cache plugin < 3.0.3 - Broken Access Control vulnerabilityAruba.it Dev Aruba HiSpeed Cache
- CVE-2025-22726WordPress nK Themes Helper plugin <= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability_nK nK Themes Helper
- CVE-2026-0701code-projects Intern Membership Management System add_admin.php sql injectioncode-projects Intern Membership Management System
- CVE-2025-13679Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailsthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-0700code-projects Intern Membership Management System check_admin.php sql injectioncode-projects Intern Membership Management System
- CVE-2026-0699code-projects Intern Membership Management System edit_activity.php sql injectioncode-projects Intern Membership Management System
- CVE-2026-0698code-projects Intern Membership Management System edit_students.php sql injectioncode-projects Intern Membership Management System
- CVE-2026-0697code-projects Intern Membership Management System edit_admin.php sql injectioncode-projects Intern Membership Management System
- CVE-2026-0707Keycloak: keycloak authorization header parsing leading to potential security control bypassRed Hat build of Keycloak · org.keycloak:keycloak-parent
- CVE-2025-12640Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacementpremio Folders – Unlimited Folders to Organize Media Librar…
- CVE-2025-14275Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2019-25295WP Cost Estimation < 9.660 - Upload Directory Traversalloopus WP Cost Estimation & Payment Forms Builder
- CVE-2026-21883Bokeh server applications have Incomplete Origin Validation in WebSocketsbokeh
- CVE-2026-21880Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosurekanboard
- CVE-2026-21879Kanboard vulnerable to Open Redirect via protocol-relative URLskanboard
- CVE-2025-61547Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76
- CVE-2025-61549Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Pr
- CVE-2025-61550Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx end
- CVE-2025-65731An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical acce
- CVE-2025-67090The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable.
- CVE-2025-67091An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable.
- CVE-2025-67825An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34.
- CVE-2025-68718KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:1234567