CVEs published January 9, 2026
125 CVEs were published on January 9, 2026: 16 critical, 28 high.
- Published
- 125
- Critical
- 16
- High
- 28
- Medium
- 73
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- GitLab
- 7
- Samsung Mobile Devices
- 7
- GestSup
- 5
- Dell PowerProtect Data Domain with Data Domain Operating… +2
- 4
- Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- 4
- Vivotek IP7137
- 4
- RainyGao DocSys
- 3
- Sangfor Operation and Maintenance Management System
- 3
- shabti Frontend Admin by DynamiApps
- 3
- themeum Tutor LMS – eLearning and online course solution
- 3
Critical 16
- CVE-2025-15501Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injectionSangfor Operation and Maintenance Management System
- CVE-2026-22584Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage ExecutSalesforce Uni2TS · uni2ts
- CVE-2025-15500Sangfor Operation and Maintenance Management System HTTP POST Request getHis os command injectionSangfor Operation and Maintenance Management System
- CVE-2020-36875AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code ExecutionAccessAlly
- CVE-2025-69426Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCERUCKUS Networks vRIoT IOT Controller
- CVE-2025-69425Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCERUCKUS Networks vRIoT IoT Controller
- CVE-2025-14598CVE-2025-14598BeeS Software Solutions BET ePortal
- CVE-2025-66050No password set for administrative account in Vivotek IP7137 camerasVivotek IP7137
- CVE-2025-7072Hardcoded credentials in KAON CG3000T/CG3000CT routersKAON CG3000T · KAON CG3000TC
- CVE-2025-64093Unauthenticated Remote Code Execution via the device hostnameZenitel ICX500 · Zenitel ICX510
- CVE-2025-64090Authenticated Remote Code Execution in device hostnameZenitel TCIS-3+
- CVE-2025-14741Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Elementshabti Frontend Admin by DynamiApps
- CVE-2025-70974Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a JavaAlibaba Fastjson · com.alibaba:fastjson
- CVE-2025-14736Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Fieldshabti Frontend Admin by DynamiApps
- CVE-2025-69542A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07.
- CVE-2025-70161EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection.
High 28
- CVE-2025-15499Sangfor Operation and Maintenance Management System VersionController.java uploadCN os command injectionSangfor Operation and Maintenance Management System
- CVE-2026-0830Command Injection in Kiro GitLab Merge Request HelperAWS Kiro IDE
- CVE-2026-22196GestSup < 3.2.60 SQL Injection in Ticket CreationGestSup
- CVE-2026-22197GestSup < 3.2.60 Multiple SQL Injections in Asset ListGestSup
- CVE-2026-22195GestSup < 3.2.60 SQL Injection in Search BarGestSup
- CVE-2026-22194GestSup <= 3.2.60 CSRF Allows Privileged ActionsGestSup
- CVE-2025-66052Command injection in Vivotek IP7137 camerasVivotek IP7137
- CVE-2025-66049Unprotected RTSP stream in Vivotek IP7137 camerasVivotek IP7137
- CVE-2026-22082Insecure Session ID Management Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2026-22081Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2026-22080Insecure Transmission Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2026-22079Cleartext Transmission Vulnerability in Tenda Wireless RoutersTenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CVE-2025-9222Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-13772Missing Authorization in GitLabGitLab
- CVE-2025-13761Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-64092Unauthenticated SQL injection via GET request parametersZenitel ICX500 · Zenitel ICX510
- CVE-2025-64091Authenticated Remote Code Execution in the NTP-configurationZenitel TCIS-3+
- CVE-2025-69195Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urlswget2
- CVE-2025-69194Wget2: arbitrary file write via metalink path traversal in gnu wget2wget2
- CVE-2025-14657Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'arraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2025-14937Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'shabti Frontend Admin by DynamiApps
- CVE-2025-15055SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parametersveronalabs SlimStat Analytics
- CVE-2025-15057SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameterveronalabs SlimStat Analytics
- CVE-2026-20971Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.Samsung Mobile Devices
- CVE-2025-56225fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loadin
- CVE-2025-66744In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, all
- CVE-2025-67070A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-
- CVE-2025-67133An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component
Medium, low and unrated 81
- CVE-2025-46297A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-62487Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files.com.palantir.acme:gotham-default-apps-bundle · com.palan… +1
- CVE-2025-46298The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-46299A memory initialization issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-46286A logic issue was addressed with improved validation.Apple iOS and iPadOS
- CVE-2025-15035Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75TP-Link Systems Archer AXE75
- CVE-2025-15496guchengwuyue yshopmall jobs getPage sql injectionguchengwuyue yshopmall
- CVE-2025-15495BiggiDroid Simple PHP CMS editsite.php unrestricted uploadBiggiDroid Simple PHP CMS
- CVE-2025-15494RainyGao DocSys UserMapper.xml sql injectionRainyGao DocSys
- CVE-2025-15493RainyGao DocSys ReposAuthMapper.xml sql injectionRainyGao DocSys
- CVE-2026-22198GestSup < 3.2.60 Stored XSS in API Error LogsGestSup
- CVE-2025-46645Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 releaseDell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2025-46643Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 releaseDell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2025-15492RainyGao DocSys GroupMemberMapper.xml sql injectionRainyGao DocSys
- CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLsWikimedia Foundation MediaWiki - CampaignEvents extension
- CVE-2025-46676Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 releaseDell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2026-0803PHPGurukul Online Course Registration System enroll.php sql injectionPHPGurukul Online Course Registration System
- CVE-2025-46644Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 releaseDell PowerProtect Data Domain with Data Domain Operating… +2
- CVE-2025-66051Path traversal in Vivotek IP7137 camerasVivotek IP7137
- CVE-2025-11453Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinganand_kumar Header and Footer Scripts
- CVE-2025-13908The Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesalobaidi The Tooltip
- CVE-2025-13862Menu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesfurqan-khanzada Menu Card
- CVE-2025-14172WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flushinfosatech WP Page Permalink Extension
- CVE-2025-13717Contact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameterashishajani Contact Form vCard Generator
- CVE-2025-13704Autogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameteramirshk Autogen Headers Menu
- CVE-2025-13892MG AdvancedOptions <= 1.2 - Reflected Cross-Site Scriptingmountaingrafix MG AdvancedOptions
- CVE-2025-13897Client Testimonial Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Fieldamu02aftab Client Testimonial Slider
- CVE-2025-13854Curved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessoniz Curved Text
- CVE-2025-13701Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']beshkin Shabat Keeper
- CVE-2025-13967Woodpecker for WordPress <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attributewoodpeckerleadform Woodpecker for WordPress
- CVE-2025-13852Debt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdebtcom Debt.com Business in a Box
- CVE-2025-13893Lesson Plan Book <= 1.3 - Reflected Cross-Site Scriptingburtrw Lesson Plan Book
- CVE-2025-13903PullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesctietze PullQuote
- CVE-2025-3950Exposure of Private Personal Information to an Unauthorized Actor in GitLabGitLab
- CVE-2025-10569Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-11246Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-13781Missing Authorization in GitLabGitLab
- CVE-2025-13895Top Position Google Finance <= 0.1.0 - Reflected Cross-Site Scriptingtop-position Top Position Google Finance
- CVE-2025-13900WP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attributethemelocation WP Popup Magic
- CVE-2025-13853Nearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeslnbadmin1 Nearby Now Reviews
- CVE-2025-13729Entry Views <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodegreenshady Entry Views
- CVE-2026-0627AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Uploadmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2025-13753WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creationwptb WP Table Builder – Drag & Drop Table Builder
- CVE-2025-13935Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completionthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-13934Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypassthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-13628Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modificationthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-14146Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposurewpdevelop Booking Calendar
- CVE-2026-21409Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3.Ricoh Company RICOH Streamline NX
- CVE-2025-14574weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposurewedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2025-14893IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' ParameterIndieWeb
- CVE-2025-14718Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow ManipulationSchedule Post Changes With PublishPress Future: Unpublish,…
- CVE-2025-14720Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actionsameliabooking Booking for Appointments and Events Calendar…
- CVE-2026-0563WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcodepagup WP Google Street View (with 360° virtual tour) & Goog…
- CVE-2025-14782Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Exportwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-14980BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposurewpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
- CVE-2025-15019BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingpagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) opt…
- CVE-2026-20976Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.Samsung Mobile Galaxy Store
- CVE-2026-20975Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbSamsung Mobile Samsung Cloud
- CVE-2026-20974Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass CarrieSamsung Mobile Devices
- CVE-2026-20973Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-20972Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.Samsung Mobile Devices
- CVE-2026-20970Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.Samsung Mobile Devices
- CVE-2026-20969Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege.Samsung Mobile Devices
- CVE-2026-20968Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2025-14803Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSSNEX-Forms
- CVE-2025-13749Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tamperingcreativemotion Clearfy Cache – WordPress optimization plugi…
- CVE-2025-14886Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modificationshoheitanaka Japanized for WooCommerce
- CVE-2025-66315ZTE MF258K Pro Version Server has a Configuration Defect VulnerabilityZTE MF258K
- CVE-2026-22712ApprovedRevs allows bypassing the inline CSS sanitizerThe Wikimedia Foundation Mediawiki - ApprovedRevs Extension
- CVE-2026-22713Stored XSS through edit summaries in GrowthExperimentsThe Wikimedia Foundation Mediawiki - GrowthExperiments Exte…
- CVE-2025-51626SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint.
- CVE-2025-60538A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.github.com/go-shiori/shiori
- CVE-2025-66715A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DLL file.
- CVE-2025-67004** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directorie
- CVE-2025-67278An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP req
- CVE-2025-67279An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application st
- CVE-2025-67280In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user
- CVE-2025-67281In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user
- CVE-2025-67282In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download
- CVE-2025-67810In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitra
- CVE-2025-67811Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users.