# CVEs published 2026-01-08

191 CVEs were published on January 8, 2026: 27 critical, 77 high. Days are UTC.

- [CVE-2026-22714](https://cve.now/CVE-2026-22714.md): i18n XSS, DoS and config SQLI in Monaco (CVSS 2.3, The Wikimedia Foundation Mediawiki - Monaco Skin)
- [CVE-2026-22710](https://cve.now/CVE-2026-22710.md): Stored XSS through autocomment system messages in Wikibase (CVSS 2.3, The Wikimedia Foundation Mediawiki - Wikibase Extension)
- [CVE-2026-0733](https://cve.now/CVE-2026-0733.md): PHPGurukul Online Course Registration System manage-students.php sql injection (CVSS 5.3, PHPGurukul Online Course Registration System)
- [CVE-2026-0732](https://cve.now/CVE-2026-0732.md): D-Link DI-8200G upgrade\_filter.asp command injection (CVSS 5.3, D-Link DI-8200G)
- [CVE-2026-0731](https://cve.now/CVE-2026-0731.md): TOTOLINK WA1200 HTTP Request cstecgi.cgi null pointer dereference (CVSS 6.9, TOTOLINK WA1200)
- [CVE-2026-0730](https://cve.now/CVE-2026-0730.md): PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE\_STAFF cross site scripting (CVSS 4.8, PHPGurukul Staff Leave Management System)
- [CVE-2026-0729](https://cve.now/CVE-2026-0729.md): code-projects Intern Membership Management System add\_activity.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2025-14436](https://cve.now/CVE-2025-14436.md): Brevo for WooCommerce \<= 4.0.49 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, neeraj\_slit Brevo for WooCommerce)
- [CVE-2025-14505](https://cve.now/CVE-2025-14505.md): Elliptic Cryptanalysis vulnerability when \`k\` has leading zeros (CVSS 5.6, Elliptic)
- [CVE-2025-15464](https://cve.now/CVE-2025-15464.md): KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking (CVSS 7.5, yintibao Fun Print Mobile)
- [CVE-2026-22588](https://cve.now/CVE-2026-22588.md): Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification (CVSS 6.5, spree · spree\_api)
- [CVE-2026-0728](https://cve.now/CVE-2026-0728.md): code-projects Intern Membership Management System delete\_admin.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2026-0747](https://cve.now/CVE-2026-0747.md): Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025 (CVSS 3.3, Devolutions Remote Desktop Manager)
- [CVE-2026-22253](https://cve.now/CVE-2026-22253.md): Soft Serve is missing an authorization check in LFS lock deletion (CVSS 5.4, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2026-21860](https://cve.now/CVE-2026-21860.md): Werkzeug safe\_join() allows Windows special device names with compound extensions (CVSS 6.3, pallets werkzeug · werkzeug)
- [CVE-2026-22257](https://cve.now/CVE-2026-22257.md): Salvo is vulnerable to stored XSS in the list\_html function by uploading files with malicious names (CVSS 8.8, salvo-rs salvo · salvo)
- [CVE-2026-22256](https://cve.now/CVE-2026-22256.md): Salvo is vulnerable to reflected XSS in the list\_html function (CVSS 8.8, salvo-rs salvo · salvo)
- [CVE-2026-21896](https://cve.now/CVE-2026-21896.md): Kirby is missing permission checks in the content changes API (CVSS 5.8, getkirby kirby · getkirby/cms)
- [CVE-2025-68158](https://cve.now/CVE-2025-68158.md): Authlib: 1-click Account Takeover (CVSS 5.7, authlib)
- [CVE-2026-22235](https://cve.now/CVE-2026-22235.md): OPEXUS eComplaint IDOR (CVSS 7.5, OPEXUS eComplaint)
- [CVE-2026-22234](https://cve.now/CVE-2026-22234.md): OPEXUS eCasePortal unauthenticated IDOR (CVSS 9.8, OPEXUS eCase Portal)
- [CVE-2026-22233](https://cve.now/CVE-2026-22233.md): OPEXUS eCASE Audit Project Cost stored XSS (CVSS 5.5, OPEXUS eCASE Audit)
- [CVE-2026-22232](https://cve.now/CVE-2026-22232.md): OPEXUS eCASE Audit Project Setup stored XSS (CVSS 4.8, OPEXUS eCASE Audit)
- [CVE-2026-22231](https://cve.now/CVE-2026-22231.md): OPEXUS eCASE Audit Document Check Out stored XSS (CVSS 5.5, OPEXUS eCASE Audit)
- [CVE-2026-22230](https://cve.now/CVE-2026-22230.md): OPEXUS eCASE Audit incorrect access control (CVSS 7.6, OPEXUS eCASE Audit)
- [CVE-2026-22587](https://cve.now/CVE-2026-22587.md): Ideagen DevonWay Reports page stored XSS (CVSS 5.5, Ideagen DevonWay)
- [CVE-2026-22486](https://cve.now/CVE-2026-22486.md): WordPress Re Gallery plugin \<= 1.18.9 - Broken Access Control vulnerability (CVSS 5.3, Re Gallery)
- [CVE-2026-22487](https://cve.now/CVE-2026-22487.md): WordPress Speed Kit plugin \<= 2.0.2 - Broken Access Control vulnerability (CVSS 4.3, baqend Speed Kit)
- [CVE-2026-22488](https://cve.now/CVE-2026-22488.md): WordPress Dashboard Welcome for Beaver Builder plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 5.3, IdeaBox Creations Dashboard Welcome for Beaver Builder)
- [CVE-2026-22489](https://cve.now/CVE-2026-22489.md): WordPress Image Slider Slideshow plugin \<= 1.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Wptexture Image Slider Slideshow)
- [CVE-2026-22490](https://cve.now/CVE-2026-22490.md): WordPress Bulk Landing Page Creator for WordPress LPagery plugin \<= 2.4.9 - Broken Access Control vulnerability (CVSS 5.4, niklaslindemann Bulk Landing Page Creator for WordPress LPa…)
- [CVE-2026-22492](https://cve.now/CVE-2026-22492.md): WordPress Docket Cache plugin \<= 24.07.04 - Broken Access Control vulnerability (CVSS 4.3, Nawawi Jamili Docket Cache)
- [CVE-2026-22517](https://cve.now/CVE-2026-22517.md): WordPress GA4WP: Google Analytics for WordPress plugin \<= 2.10.0 - Broken Access Control vulnerability (CVSS 5.4, Passionate Brains GA4WP: Google Analytics for WordPress)
- [CVE-2026-0671](https://cve.now/CVE-2026-0671.md): Multiple stored i18n/message-key XSSes in UploadWizard (CVSS 6.1, Wikimedia Foundation MediaWiki - UploadWizard extension)
- [CVE-2026-22518](https://cve.now/CVE-2026-22518.md): WordPress X Addons for Elementor plugin \<= 1.0.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pencilwp X Addons for Elementor)
- [CVE-2026-22519](https://cve.now/CVE-2026-22519.md): WordPress MediaPress plugin \<= 1.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BuddyDev MediaPress)
- [CVE-2026-22521](https://cve.now/CVE-2026-22521.md): WordPress Handmade Framework plugin \<= 3.9 - Local File Inclusion vulnerability (CVSS 7.5, G5Theme Handmade Framework)
- [CVE-2025-59468](https://cve.now/CVE-2025-59468.md): This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passwor (CVSS 9.0, Veeam Backup and Recovery)
- [CVE-2025-55125](https://cve.now/CVE-2025-55125.md): This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configura (CVSS 7.8, Veeam Backup And Recovery)
- [CVE-2025-59469](https://cve.now/CVE-2025-59469.md): This vulnerability allows a Backup or Tape Operator to write files as root. (CVSS 9.0, Veeam Backup and Recovery)
- [CVE-2025-59470](https://cve.now/CVE-2025-59470.md): This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or o (CVSS 9.0, Veeam Backup and Recovery)
- [CVE-2026-22522](https://cve.now/CVE-2026-22522.md): WordPress Block Slider plugin \<= 2.2.3 - Broken Access Control vulnerability (CVSS 6.5, Munir Kamal Block Slider)
- [CVE-2026-21639](https://cve.now/CVE-2026-21639.md): A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote (CVSS 8.8, Ubiquiti airMAX AC · Ubiquiti airMAX M +2)
- [CVE-2026-21638](https://cve.now/CVE-2026-21638.md): A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote (CVSS 8.8, Ubiquiti UBB-XG · Ubiquiti UDB-Pro/UDB-Pro-Sector +1)
- [CVE-2025-68151](https://cve.now/CVE-2025-68151.md): CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages (CVSS 6.6, coredns · github.com/coredns/coredns)
- [CVE-2026-22255](https://cve.now/CVE-2026-22255.md): iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp (CVSS 8.8, InternationalColorConsortium iccDEV)
- [CVE-2026-22246](https://cve.now/CVE-2026-22246.md): Local Mastodon users can enumerate and access severed relationships of every other local user (CVSS 6.5, mastodon)
- [CVE-2025-67858](https://cve.now/CVE-2025-67858.md): A crafted "interface" input parameter can lead to integrity loss of the firewall configuration (CVSS 7.0, https://github.com/FoobarOy/ Foomuuri)
- [CVE-2026-22245](https://cve.now/CVE-2026-22245.md): Mastodon has SSRF Protection bypass (CVSS 7.1, mastodon)
- [CVE-2026-22244](https://cve.now/CVE-2026-22244.md): OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE (CVSS 8.5, open-metadata OpenMetadata · org.open-metadata:platform)
- [CVE-2026-22241](https://cve.now/CVE-2026-22241.md): Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE) (CVSS 7.3, gunet openeclass)
- [CVE-2025-67603](https://cve.now/CVE-2025-67603.md): Lack of client authorization allows arbitrary users to influence the firewall configuration (CVSS 5.1, https://github.com/FoobarOy/ Foomuuri)
- [CVE-2026-22043](https://cve.now/CVE-2026-22043.md): RustFS has IAM deny\_only Short-Circuit that Allows Privilege Escalation via Service Account Minting (CVSS 5.7, rustfs)
- [CVE-2025-66003](https://cve.now/CVE-2025-66003.md): Local users can perform a local root exploit via smb4k mounthelper (CVSS 7.3, https://github.com/KDE/ smb4k)
- [CVE-2025-4596](https://cve.now/CVE-2025-4596.md): Information disclosure via IDOR in Asseco AMDX (CVSS 5.3, Asseco AMDX)
- [CVE-2026-22042](https://cve.now/CVE-2026-22042.md): RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation (CVSS 5.7, rustfs)
- [CVE-2026-22041](https://cve.now/CVE-2026-22041.md): loggingredactor converts non-string types to string types in logs (CVSS 2.0, armurox loggingredactor · loggingredactor)
- [CVE-2026-22034](https://cve.now/CVE-2026-22034.md): Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package (CVSS 9.2, jvoisin snuffleupagus)
- [CVE-2026-22032](https://cve.now/CVE-2026-22032.md): Directus has open redirect in SAML (CVSS 4.3, directus · @directus/api)
- [CVE-2025-66002](https://cve.now/CVE-2025-66002.md): Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation (CVSS 6.9, https://github.com/KDE/ smb4k)
- [CVE-2026-22028](https://cve.now/CVE-2026-22028.md): Preact has JSON VNode Injection issue (CVSS 7.2, preactjs preact · preact)
- [CVE-2026-21895](https://cve.now/CVE-2026-21895.md): rsa crate has potential panic on a prime being equal to 1 (CVSS 2.7, RustCrypto RSA · rsa)
- [CVE-2026-21892](https://cve.now/CVE-2026-21892.md): Parsl Monitoring Visualization Vulnerable to SQL Injection (CVSS 5.3, parsl)
- [CVE-2026-21891](https://cve.now/CVE-2026-21891.md): ZimaOS has Authentication Bypass via System-Level Username (CVSS 9.4, IceWhaleTech ZimaOS)
- [CVE-2026-21885](https://cve.now/CVE-2026-21885.md): Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources (CVSS 6.5, miniflux · miniflux.app/v2 +1)
- [CVE-2026-21876](https://cve.now/CVE-2026-21876.md): OWASP CRS has multipart bypass using multiple content-type parts (CVSS 9.3, coreruleset)
- [CVE-2025-14025](https://cve.now/CVE-2025-14025.md): Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions (CVSS 8.5, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2025-8307](https://cve.now/CVE-2025-8307.md): Recoverable passwords in Asseco Infomedica Plus (CVSS 5.9, Asseco InfoMedica Plus)
- [CVE-2025-8306](https://cve.now/CVE-2025-8306.md): Improper Access Control in Asseco Infomedica Plus (CVSS 5.1, Asseco InfoMedica Plus)
- [CVE-2025-69260](https://cve.now/CVE-2025-69260.md): A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition (CVSS 7.5, Trend Micro Apex Central)
- [CVE-2025-69259](https://cve.now/CVE-2025-69259.md): A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service (CVSS 7.5, Trend Micro Apex Central)
- [CVE-2025-69258](https://cve.now/CVE-2025-69258.md): A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL (CVSS 9.8, Trend Micro Apex Central)
- [CVE-2026-0719](https://cve.now/CVE-2026-0719.md): Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication (CVSS 8.6, Red Hat Enterprise Linux · Red Hat OpenShift Dev Spaces (RH…)
- [CVE-2025-62877](https://cve.now/CVE-2025-62877.md): Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer (CVSS 9.8, SUSE harvester · github.com/harvester/harvester-installer)
- [CVE-2025-66001](https://cve.now/CVE-2025-66001.md): NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) (CVSS 8.8, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-15224](https://cve.now/CVE-2025-15224.md): libssh key passphrase bypass without agent set (CVSS 3.1, curl)
- [CVE-2025-15079](https://cve.now/CVE-2025-15079.md): libssh global known\_hosts override (CVSS 5.3, curl)
- [CVE-2025-14819](https://cve.now/CVE-2025-14819.md): OpenSSL partial chain store policy bypass (CVSS 5.3, curl)
- [CVE-2025-14524](https://cve.now/CVE-2025-14524.md): bearer token leak on cross-protocol redirect (CVSS 5.3, curl)
- [CVE-2025-14017](https://cve.now/CVE-2025-14017.md): broken TLS options for threaded LDAPS (CVSS 6.3, curl)
- [CVE-2025-13034](https://cve.now/CVE-2025-13034.md): No QUIC certificate pinning with GnuTLS (CVSS 5.9, curl)
- [CVE-2026-22242](https://cve.now/CVE-2026-22242.md): CoreShop Vulnerable to SQL Injection via Admin Reports (CVSS 4.9, CoreShop · coreshop/core-shop)
- [CVE-2026-21894](https://cve.now/CVE-2026-21894.md): n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks (CVSS 6.5, n8n-io n8n · n8n)
- [CVE-2026-21874](https://cve.now/CVE-2026-21874.md): NiceGUI has Redis connection leak via tab storage causes service degradation (CVSS 5.3, zauberzeug nicegui · nicegui)
- [CVE-2026-21873](https://cve.now/CVE-2026-21873.md): Zero-click XSS in all NiceGUI apps which uses \`ui.sub\_pages\` (CVSS 7.2, zauberzeug nicegui · nicegui)
- [CVE-2026-21872](https://cve.now/CVE-2026-21872.md): NiceGUI apps are vulnerable to XSS which uses \`ui.sub\_pages\` and render arbitrary user-provided links (CVSS 6.1, zauberzeug nicegui · nicegui)
- [CVE-2026-21871](https://cve.now/CVE-2026-21871.md): NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() (CVSS 6.1, zauberzeug nicegui · nicegui)
- [CVE-2025-14984](https://cve.now/CVE-2025-14984.md): Gutenverse Form \<= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, jegstudio Gutenverse Form – Contact Form Builder, Booking,…)
- [CVE-2026-0676](https://cve.now/CVE-2026-0676.md): WordPress Zorka theme \<= 1.5.7 - Broken Access Control vulnerability (CVSS 5.3, G5Theme Zorka)
- [CVE-2026-0674](https://cve.now/CVE-2026-0674.md): WordPress Campaign Monitor for WordPress plugin \<= 2.9.1 - Broken Access Control vulnerability (CVSS 4.3, Campaign Monitor for WordPress)
- [CVE-2025-69169](https://cve.now/CVE-2025-69169.md): WordPress Easy Media Download plugin \<= 1.1.11 - CSS Injection vulnerability (CVSS 5.4, Noor Alam Easy Media Download)
- [CVE-2025-68892](https://cve.now/CVE-2025-68892.md): WordPress Scroll rss excerpt plugin \<= 5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gopiplus@hotmail.com Scroll rss excerpt)
- [CVE-2025-68891](https://cve.now/CVE-2025-68891.md): WordPress WP App Bar plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ryan Sutana WP App Bar)
- [CVE-2025-68890](https://cve.now/CVE-2025-68890.md): WordPress e-shops plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hands01 e-shops)
- [CVE-2025-68889](https://cve.now/CVE-2025-68889.md): WordPress Pinpoll plugin \<= 4.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pinpoll)
- [CVE-2025-68887](https://cve.now/CVE-2025-68887.md): WordPress WP-BusinessDirectory plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CMSJunkie - WordPress Business Directory Plugins WP-Busines…)
- [CVE-2025-68875](https://cve.now/CVE-2025-68875.md): WordPress Flaming Password Reset plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jcaruso001 Flaming Password Reset)
- [CVE-2025-68874](https://cve.now/CVE-2025-68874.md): WordPress Visitor Stats Widget plugin \<= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shahjada Visitor Stats Widget)
- [CVE-2025-68873](https://cve.now/CVE-2025-68873.md): WordPress PRIMER by chloédigital plugin \<= 1.0.25 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PRIMER by chloédigital)
- [CVE-2025-68867](https://cve.now/CVE-2025-68867.md): WordPress Effect Maker plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, anibalwainstein Effect Maker)
- [CVE-2025-67937](https://cve.now/CVE-2025-67937.md): WordPress Hendon theme \< 1.7 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Hendon)
- [CVE-2025-67936](https://cve.now/CVE-2025-67936.md): WordPress Curly theme \< 3.3 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Curly)
- [CVE-2025-67935](https://cve.now/CVE-2025-67935.md): WordPress Optimize theme \< 2.4 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Optimize)
- [CVE-2025-67934](https://cve.now/CVE-2025-67934.md): WordPress Wellspring theme \< 2.8 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Wellspring)
- [CVE-2025-67933](https://cve.now/CVE-2025-67933.md): WordPress Taskbuilder plugin \<= 4.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Taskbuilder)
- [CVE-2025-67932](https://cve.now/CVE-2025-67932.md): WordPress Listeo Core plugin \< 2.0.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, purethemes Listeo Core)
- [CVE-2025-67931](https://cve.now/CVE-2025-67931.md): WordPress BulletProof Security plugin \<= 6.9 - Sensitive Data Exposure vulnerability (CVSS 7.5, AITpro BulletProof Security)
- [CVE-2025-67930](https://cve.now/CVE-2025-67930.md): WordPress eHive Search plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vernon Systems Limited eHive Search)
- [CVE-2025-67928](https://cve.now/CVE-2025-67928.md): WordPress Automotive Listings plugin \<= 18.6 - SQL Injection vulnerability (CVSS 9.3, themesuite Automotive Listings)
- [CVE-2025-67927](https://cve.now/CVE-2025-67927.md): WordPress Link Whisper Free plugin \<= 0.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Spencer Haws Link Whisper Free)
- [CVE-2025-67926](https://cve.now/CVE-2025-67926.md): WordPress Fluent Support plugin \<= 1.10.4 - Broken Access Control vulnerability (CVSS 6.5, Shahjahan Jewel Fluent Support)
- [CVE-2025-67925](https://cve.now/CVE-2025-67925.md): WordPress Corpkit theme \<= 2.0 - Local File Inclusion vulnerability (CVSS 7.5, zozothemes Corpkit)
- [CVE-2025-67924](https://cve.now/CVE-2025-67924.md): WordPress Corpkit theme \<= 2.0 - Arbitrary File Upload vulnerability (CVSS 9.9, zozothemes Corpkit)
- [CVE-2025-67922](https://cve.now/CVE-2025-67922.md): WordPress Grand Restaurant theme \< 7.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Restaurant)
- [CVE-2025-67921](https://cve.now/CVE-2025-67921.md): WordPress Lobo theme \< 2.8.6 - SQL Injection vulnerability (CVSS 8.5, VanKarWai Lobo)
- [CVE-2025-67920](https://cve.now/CVE-2025-67920.md): WordPress Neo Ocular theme \< 1.2 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Neo Ocular)
- [CVE-2025-67919](https://cve.now/CVE-2025-67919.md): WordPress Woffice Core plugin \<= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, WofficeIO Woffice Core)
- [CVE-2025-67918](https://cve.now/CVE-2025-67918.md): WordPress Woffice theme \<= 5.4.30 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WofficeIO Woffice)
- [CVE-2025-67917](https://cve.now/CVE-2025-67917.md): WordPress Traveler theme \<= 3.2.6 - Broken Access Control vulnerability (CVSS 6.5, shinetheme Traveler)
- [CVE-2025-67916](https://cve.now/CVE-2025-67916.md): WordPress Jobify theme \<= 4.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Astoundify Jobify)
- [CVE-2025-67915](https://cve.now/CVE-2025-67915.md): WordPress Timetics plugin \<= 1.0.46 - Broken Authentication vulnerability (CVSS 8.8, Arraytics Timetics)
- [CVE-2025-67914](https://cve.now/CVE-2025-67914.md): WordPress VidMov theme \<= 2.3.8 - Path Traversal vulnerability (CVSS 7.7, beeteam368 VidMov)
- [CVE-2025-67913](https://cve.now/CVE-2025-67913.md): WordPress Aruba HiSpeed Cache plugin \< 3.0.3 - Broken Access Control vulnerability (CVSS 6.5, Aruba.it Dev Aruba HiSpeed Cache)
- [CVE-2025-67911](https://cve.now/CVE-2025-67911.md): WordPress Newsletters plugin \<= 4.11 - PHP Object Injection vulnerability (CVSS 9.8, Tribulant Software Newsletters)
- [CVE-2025-67910](https://cve.now/CVE-2025-67910.md): WordPress Contentstudio plugin \<= 1.3.7 - Arbitrary File Upload vulnerability (CVSS 9.1, Contentstudio)
- [CVE-2025-27004](https://cve.now/CVE-2025-27004.md): WordPress Famous - Responsive Image And Video Grid Gallery WordPress Plugin plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Famous - Responsive Image And Video Grid Galle…)
- [CVE-2025-27002](https://cve.now/CVE-2025-27002.md): WordPress CountDown With Image or Video Background plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup CountDown With Image or Video Background)
- [CVE-2025-23993](https://cve.now/CVE-2025-23993.md): WordPress Felan Framework plugin \<= 1.1.3 - SQL Injection vulnerability (CVSS 9.3, RiceTheme Felan Framework)
- [CVE-2025-23504](https://cve.now/CVE-2025-23504.md): WordPress Felan Framework plugin \<= 1.1.3 - Account Takeover vulnerability (CVSS 9.8, RiceTheme Felan Framework)
- [CVE-2025-22728](https://cve.now/CVE-2025-22728.md): WordPress Workreap (theme's plugin) plugin \<= 3.3.6 - SQL Injection vulnerability (CVSS 8.5, AmentoTech Workreap)
- [CVE-2025-22726](https://cve.now/CVE-2025-22726.md): WordPress nK Themes Helper plugin \<= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, \_nK nK Themes Helper)
- [CVE-2025-22725](https://cve.now/CVE-2025-22725.md): WordPress WP Virtual Assistant plugin \<= 3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, loopus WP Virtual Assistant)
- [CVE-2025-22715](https://cve.now/CVE-2025-22715.md): WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin \<= 1.25 - Arbitrary Content Deletion vulnerability (CVSS 7.5, loopus WP Attractive Donations System - Easy Stripe & Paypa…)
- [CVE-2025-22713](https://cve.now/CVE-2025-22713.md): WordPress WooCommerce Orders & Customers Exporter plugin \<= 5.4 - SQL Injection vulnerability (CVSS 8.5, vanquish WooCommerce Orders & Customers Exporter)
- [CVE-2025-22712](https://cve.now/CVE-2025-22712.md): WordPress Typify theme \<= 3.0.2 - Local File Inclusion vulnerability (CVSS 8.1, QantumThemes Typify)
- [CVE-2025-22708](https://cve.now/CVE-2025-22708.md): WordPress Mitech theme \<= 2.3.4 - Local File Inclusion vulnerability (CVSS 8.1, ThemeMove Mitech)
- [CVE-2025-22707](https://cve.now/CVE-2025-22707.md): WordPress Moody theme \<= 2.7.3 - Local File Inclusion vulnerability (CVSS 8.1, ThemeMove Moody)
- [CVE-2025-22509](https://cve.now/CVE-2025-22509.md): WordPress Atlas theme \<= 2.1.0 - Local File Inclusion vulnerability (CVSS 8.1, TMRW-studio Atlas)
- [CVE-2025-14431](https://cve.now/CVE-2025-14431.md): WordPress Navian theme \<= 1.5.4 - Local File Inclusion vulnerability (CVSS 8.1, THEMELOGI Navian)
- [CVE-2025-14430](https://cve.now/CVE-2025-14430.md): WordPress Brook - Agency Business Creative theme \<= 2.9.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeMove Brook)
- [CVE-2025-14429](https://cve.now/CVE-2025-14429.md): WordPress AeroLand theme \<= 1.6.6 - Local File Inclusion vulnerability (CVSS 8.1, ThemeMove AeroLand)
- [CVE-2025-14360](https://cve.now/CVE-2025-14360.md): WordPress Blockons plugin \<= 1.2.19 - Broken Access Control vulnerability (CVSS 7.5, Kaira Blockons)
- [CVE-2025-14359](https://cve.now/CVE-2025-14359.md): WordPress Oshine theme \< 7.3.0 - Local File Inclusion vulnerability (CVSS 8.1, brandexponents Oshine)
- [CVE-2025-14358](https://cve.now/CVE-2025-14358.md): WordPress REHub Framework plugin \<= 19.9.5 - Broken Access Control vulnerability (CVSS 7.5, sizam REHub Framework)
- [CVE-2025-13504](https://cve.now/CVE-2025-13504.md): WordPress Real Estate Pro plugin \<= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e-plugins Real Estate Pro)
- [CVE-2025-12551](https://cve.now/CVE-2025-12551.md): WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e-plugins ListingHub)
- [CVE-2025-12550](https://cve.now/CVE-2025-12550.md): WordPress OchaHouse theme \<= 2.2.8 - Local File Inclusion vulnerability (CVSS 8.1, jwsthemes OchaHouse)
- [CVE-2025-12549](https://cve.now/CVE-2025-12549.md): WordPress Rozy - Flower Shop theme \<= 1.2.25 - Local File Inclusion vulnerability (CVSS 8.1, magentech Rozy - Flower Shop)
- [CVE-2026-0701](https://cve.now/CVE-2026-0701.md): code-projects Intern Membership Management System add\_admin.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2025-13679](https://cve.now/CVE-2025-13679.md): Tutor LMS \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor\_order\_details (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-0700](https://cve.now/CVE-2026-0700.md): code-projects Intern Membership Management System check\_admin.php sql injection (CVSS 6.9, code-projects Intern Membership Management System)
- [CVE-2026-0699](https://cve.now/CVE-2026-0699.md): code-projects Intern Membership Management System edit\_activity.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2026-0698](https://cve.now/CVE-2026-0698.md): code-projects Intern Membership Management System edit\_students.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2026-0697](https://cve.now/CVE-2026-0697.md): code-projects Intern Membership Management System edit\_admin.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2026-21427](https://cve.now/CVE-2026-21427.md): The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely (CVSS 7.8, PIONEER USB DAC Amplifier APS-DA101JS · PIONEER USB DAC… +8)
- [CVE-2026-0707](https://cve.now/CVE-2026-0707.md): Keycloak: keycloak authorization header parsing leading to potential security control bypass (CVSS 5.3, Red Hat build of Keycloak · org.keycloak:keycloak-parent)
- [CVE-2019-25296](https://cve.now/CVE-2019-25296.md): WP Cost Estimation \<= 9.642 - Missing Authorization to Arbitrary File Upload/Delete (CVSS 9.8, loopus WP Cost Estimation & Payment Forms Builder)
- [CVE-2025-12640](https://cve.now/CVE-2025-12640.md): Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager \<= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement (CVSS 4.3, premio Folders – Unlimited Folders to Organize Media Librar…)
- [CVE-2025-14275](https://cve.now/CVE-2025-14275.md): Jeg Elementor Kit \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2019-25295](https://cve.now/CVE-2019-25295.md): WP Cost Estimation \< 9.660 - Upload Directory Traversal (CVSS 6.5, loopus WP Cost Estimation & Payment Forms Builder)
- [CVE-2026-21883](https://cve.now/CVE-2026-21883.md): Bokeh server applications have Incomplete Origin Validation in WebSockets (CVSS 4.5, bokeh)
- [CVE-2026-21881](https://cve.now/CVE-2026-21881.md): Kanboard is Vulnerable to Reverse Proxy Authentication Bypass (CVSS 9.1, kanboard)
- [CVE-2026-21880](https://cve.now/CVE-2026-21880.md): Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure (CVSS 5.3, kanboard)
- [CVE-2026-21879](https://cve.now/CVE-2026-21879.md): Kanboard vulnerable to Open Redirect via protocol-relative URLs (CVSS 4.7, kanboard)
- [CVE-2026-21877](https://cve.now/CVE-2026-21877.md): n8n is vulnerable to Remote Code Execution via Arbitrary File Write (CVSS 10.0, n8n-io n8n · n8n)
- [CVE-2026-21868](https://cve.now/CVE-2026-21868.md): Flag Forge has ReDoS Vulnerability in User Profile Lookup API (CVSS 7.5, FlagForgeCTF flagForge)
- [CVE-2026-22035](https://cve.now/CVE-2026-22035.md): Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin (CVSS 7.8, greenshot)
- [CVE-2025-50334](https://cve.now/CVE-2025-50334.md): An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component (CVSS 7.5)
- [CVE-2025-56424](https://cve.now/CVE-2025-56424.md): An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service v (CVSS 7.5)
- [CVE-2025-56425](https://cve.now/CVE-2025-56425.md): An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version (CVSS 9.1)
- [CVE-2025-61246](https://cve.now/CVE-2025-61246.md): indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review\_action.php via the proId parameter. (CVSS 9.8)
- [CVE-2025-61546](https://cve.now/CVE-2025-61546.md): There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (CVSS 9.1)
- [CVE-2025-61547](https://cve.now/CVE-2025-61547.md): Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76 (CVSS 6.8)
- [CVE-2025-61548](https://cve.now/CVE-2025-61548.md): SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business (CVSS 9.8)
- [CVE-2025-61549](https://cve.now/CVE-2025-61549.md): Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg\_display.asp endpoint in edu Business Solutions Pr (CVSS 6.1)
- [CVE-2025-61550](https://cve.now/CVE-2025-61550.md): Cross-Site Scripting (XSS) is present on the ctl00\_Content01\_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx end (CVSS 5.4)
- [CVE-2025-63611](https://cve.now/CVE-2025-63611.md): Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /regis (CVSS 8.7)
- [CVE-2025-65518](https://cve.now/CVE-2025-65518.md): Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. (CVSS 7.5)
- [CVE-2025-65731](https://cve.now/CVE-2025-65731.md): An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical acce (CVSS 6.8)
- [CVE-2025-66913](https://cve.now/CVE-2025-66913.md): JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. (CVSS 9.8)
- [CVE-2025-66916](https://cve.now/CVE-2025-66916.md): The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpre (CVSS 9.4)
- [CVE-2025-67089](https://cve.now/CVE-2025-67089.md): A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. (CVSS 8.1)
- [CVE-2025-67090](https://cve.now/CVE-2025-67090.md): The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. (CVSS 5.1)
- [CVE-2025-67091](https://cve.now/CVE-2025-67091.md): An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. (CVSS 6.5)
- [CVE-2025-67325](https://cve.now/CVE-2025-67325.md): Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achiev (CVSS 9.8)
- [CVE-2025-67825](https://cve.now/CVE-2025-67825.md): An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. (CVSS 5.5)
- [CVE-2025-68715](https://cve.now/CVE-2025-68715.md): An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/se (CVSS 9.1)
- [CVE-2025-68716](https://cve.now/CVE-2025-68716.md): KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. (CVSS 8.4)
- [CVE-2025-68717](https://cve.now/CVE-2025-68717.md): KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. (CVSS 9.4)
- [CVE-2025-68718](https://cve.now/CVE-2025-68718.md): KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:1234567 (CVSS 5.4)
- [CVE-2025-68719](https://cve.now/CVE-2025-68719.md): KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.