# CVEs published 2026-01-09

125 CVEs were published on January 9, 2026: 16 critical, 28 high. Days are UTC.

- [CVE-2025-15501](https://cve.now/CVE-2025-15501.md): Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection (CVSS 9.3, Sangfor Operation and Maintenance Management System)
- [CVE-2026-22584](https://cve.now/CVE-2026-22584.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Execut (CVSS 9.8, Salesforce Uni2TS · uni2ts)
- [CVE-2025-15500](https://cve.now/CVE-2025-15500.md): Sangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection (CVSS 9.3, Sangfor Operation and Maintenance Management System)
- [CVE-2025-15499](https://cve.now/CVE-2025-15499.md): Sangfor Operation and Maintenance Management System VersionController.java uploadCN os command injection (CVSS 8.7, Sangfor Operation and Maintenance Management System)
- [CVE-2025-46297](https://cve.now/CVE-2025-46297.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-62487](https://cve.now/CVE-2025-62487.md): Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files. (CVSS 3.5, com.palantir.acme:gotham-default-apps-bundle · com.palan… +1)
- [CVE-2025-46298](https://cve.now/CVE-2025-46298.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-46299](https://cve.now/CVE-2025-46299.md): A memory initialization issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-46286](https://cve.now/CVE-2025-46286.md): A logic issue was addressed with improved validation. (CVSS 4.3, Apple iOS and iPadOS)
- [CVE-2026-0830](https://cve.now/CVE-2026-0830.md): Command Injection in Kiro GitLab Merge Request Helper (CVSS 8.4, AWS Kiro IDE)
- [CVE-2025-15035](https://cve.now/CVE-2025-15035.md): Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75 (CVSS 6.9, TP-Link Systems Archer AXE75)
- [CVE-2025-15496](https://cve.now/CVE-2025-15496.md): guchengwuyue yshopmall jobs getPage sql injection (CVSS 5.3, guchengwuyue yshopmall)
- [CVE-2025-15495](https://cve.now/CVE-2025-15495.md): BiggiDroid Simple PHP CMS editsite.php unrestricted upload (CVSS 5.1, BiggiDroid Simple PHP CMS)
- [CVE-2020-36875](https://cve.now/CVE-2020-36875.md): AccessAlly \< 3.3.2 Unauthenticated Arbitrary PHP Code Execution (CVSS 9.3, AccessAlly)
- [CVE-2025-15494](https://cve.now/CVE-2025-15494.md): RainyGao DocSys UserMapper.xml sql injection (CVSS 5.3, RainyGao DocSys)
- [CVE-2025-15493](https://cve.now/CVE-2025-15493.md): RainyGao DocSys ReposAuthMapper.xml sql injection (CVSS 5.3, RainyGao DocSys)
- [CVE-2026-22196](https://cve.now/CVE-2026-22196.md): GestSup \< 3.2.60 SQL Injection in Ticket Creation (CVSS 7.7, GestSup)
- [CVE-2026-22198](https://cve.now/CVE-2026-22198.md): GestSup \< 3.2.60 Stored XSS in API Error Logs (CVSS 5.1, GestSup)
- [CVE-2026-22197](https://cve.now/CVE-2026-22197.md): GestSup \< 3.2.60 Multiple SQL Injections in Asset List (CVSS 7.5, GestSup)
- [CVE-2026-22195](https://cve.now/CVE-2026-22195.md): GestSup \< 3.2.60 SQL Injection in Search Bar (CVSS 7.7, GestSup)
- [CVE-2026-22194](https://cve.now/CVE-2026-22194.md): GestSup \<= 3.2.60 CSRF Allows Privileged Actions (CVSS 8.9, GestSup)
- [CVE-2025-69426](https://cve.now/CVE-2025-69426.md): Ruckus vRIoT IoT Controller \< 3.0.0.0 Hardcoded SSH Credentials RCE (CVSS 10.0, RUCKUS Networks vRIoT IOT Controller)
- [CVE-2025-46645](https://cve.now/CVE-2025-46645.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release (CVSS 6.5, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-69425](https://cve.now/CVE-2025-69425.md): Ruckus vRIoT IoT Controller \< 3.0.0.0 Hardcoded Tokens RCE (CVSS 10.0, RUCKUS Networks vRIoT IoT Controller)
- [CVE-2025-46643](https://cve.now/CVE-2025-46643.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release (CVSS 2.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-15492](https://cve.now/CVE-2025-15492.md): RainyGao DocSys GroupMemberMapper.xml sql injection (CVSS 5.3, RainyGao DocSys)
- [CVE-2026-0817](https://cve.now/CVE-2026-0817.md): CampaignEvents API missing authorization exposes meeting and chat URLs (CVSS 5.3, Wikimedia Foundation MediaWiki - CampaignEvents extension)
- [CVE-2025-46676](https://cve.now/CVE-2025-46676.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release (CVSS 2.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2026-0803](https://cve.now/CVE-2026-0803.md): PHPGurukul Online Course Registration System enroll.php sql injection (CVSS 5.3, PHPGurukul Online Course Registration System)
- [CVE-2025-46644](https://cve.now/CVE-2025-46644.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release (CVSS 6.0, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-14598](https://cve.now/CVE-2025-14598.md): CVE-2025-14598 (CVSS 9.8, BeeS Software Solutions BET ePortal)
- [CVE-2025-66052](https://cve.now/CVE-2025-66052.md): Command injection in Vivotek IP7137 cameras (CVSS 8.6, Vivotek IP7137)
- [CVE-2025-66051](https://cve.now/CVE-2025-66051.md): Path traversal in Vivotek IP7137 cameras (CVSS 6.9, Vivotek IP7137)
- [CVE-2025-66050](https://cve.now/CVE-2025-66050.md): No password set for administrative account in Vivotek IP7137 cameras (CVSS 9.3, Vivotek IP7137)
- [CVE-2025-66049](https://cve.now/CVE-2025-66049.md): Unprotected RTSP stream in Vivotek IP7137 cameras (CVSS 8.7, Vivotek IP7137)
- [CVE-2025-7072](https://cve.now/CVE-2025-7072.md): Hardcoded credentials in KAON CG3000T/CG3000CT routers (CVSS 9.3, KAON CG3000T · KAON CG3000TC)
- [CVE-2026-22082](https://cve.now/CVE-2026-22082.md): Insecure Session ID Management Vulnerability in Tenda Wireless Routers (CVSS 8.8, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2026-22081](https://cve.now/CVE-2026-22081.md): Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers (CVSS 8.8, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2025-11453](https://cve.now/CVE-2025-11453.md): Header and Footer Scripts \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, anand\_kumar Header and Footer Scripts)
- [CVE-2025-13908](https://cve.now/CVE-2025-13908.md): The Tooltip \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, alobaidi The Tooltip)
- [CVE-2025-13862](https://cve.now/CVE-2025-13862.md): Menu Card \<= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, furqan-khanzada Menu Card)
- [CVE-2025-14172](https://cve.now/CVE-2025-14172.md): WP Page Permalink Extension \<= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush (CVSS 6.5, infosatech WP Page Permalink Extension)
- [CVE-2025-13717](https://cve.now/CVE-2025-13717.md): Contact Form vCard Generator \<= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter (CVSS 5.3, ashishajani Contact Form vCard Generator)
- [CVE-2025-13704](https://cve.now/CVE-2025-13704.md): Autogen Headers Menu \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head\_class' Shortcode Parameter (CVSS 6.4, amirshk Autogen Headers Menu)
- [CVE-2025-13892](https://cve.now/CVE-2025-13892.md): MG AdvancedOptions \<= 1.2 - Reflected Cross-Site Scripting (CVSS 6.1, mountaingrafix MG AdvancedOptions)
- [CVE-2025-13897](https://cve.now/CVE-2025-13897.md): Client Testimonial Slider \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft\_testimonial\_meta\_name' Metabox Field (CVSS 6.4, amu02aftab Client Testimonial Slider)
- [CVE-2025-13854](https://cve.now/CVE-2025-13854.md): Curved Text \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, soniz Curved Text)
- [CVE-2025-13701](https://cve.now/CVE-2025-13701.md): Shabat Keeper \<= 0.4.4 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, beshkin Shabat Keeper)
- [CVE-2025-13967](https://cve.now/CVE-2025-13967.md): Woodpecker for WordPress \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form\_name' Shortcode Attribute (CVSS 6.4, woodpeckerleadform Woodpecker for WordPress)
- [CVE-2025-13852](https://cve.now/CVE-2025-13852.md): Debt.com Business in a Box \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, debtcom Debt.com Business in a Box)
- [CVE-2025-13893](https://cve.now/CVE-2025-13893.md): Lesson Plan Book \<= 1.3 - Reflected Cross-Site Scripting (CVSS 6.1, burtrw Lesson Plan Book)
- [CVE-2025-13903](https://cve.now/CVE-2025-13903.md): PullQuote \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ctietze PullQuote)
- [CVE-2026-22080](https://cve.now/CVE-2026-22080.md): Insecure Transmission Vulnerability in Tenda Wireless Routers (CVSS 8.7, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2026-22079](https://cve.now/CVE-2026-22079.md): Cleartext Transmission Vulnerability in Tenda Wireless Routers (CVSS 8.7, Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router)
- [CVE-2025-64093](https://cve.now/CVE-2025-64093.md): Unauthenticated Remote Code Execution via the device hostname (CVSS 10.0, Zenitel ICX500 · Zenitel ICX510)
- [CVE-2025-3950](https://cve.now/CVE-2025-3950.md): Exposure of Private Personal Information to an Unauthorized Actor in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-9222](https://cve.now/CVE-2025-9222.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-10569](https://cve.now/CVE-2025-10569.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-11246](https://cve.now/CVE-2025-11246.md): Insufficient Granularity of Access Control in GitLab (CVSS 5.4, GitLab)
- [CVE-2025-13772](https://cve.now/CVE-2025-13772.md): Missing Authorization in GitLab (CVSS 7.1, GitLab)
- [CVE-2025-13761](https://cve.now/CVE-2025-13761.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab)
- [CVE-2025-13781](https://cve.now/CVE-2025-13781.md): Missing Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-64092](https://cve.now/CVE-2025-64092.md): Unauthenticated SQL injection via GET request parameters (CVSS 7.5, Zenitel ICX500 · Zenitel ICX510)
- [CVE-2025-64091](https://cve.now/CVE-2025-64091.md): Authenticated Remote Code Execution in the NTP-configuration (CVSS 8.6, Zenitel TCIS-3+)
- [CVE-2025-64090](https://cve.now/CVE-2025-64090.md): Authenticated Remote Code Execution in device hostname (CVSS 10.0, Zenitel TCIS-3+)
- [CVE-2025-13895](https://cve.now/CVE-2025-13895.md): Top Position Google Finance \<= 0.1.0 - Reflected Cross-Site Scripting (CVSS 6.1, top-position Top Position Google Finance)
- [CVE-2025-13900](https://cve.now/CVE-2025-13900.md): WP Popup Magic \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (CVSS 6.4, themelocation WP Popup Magic)
- [CVE-2025-13853](https://cve.now/CVE-2025-13853.md): Nearby Now Reviews \<= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, lnbadmin1 Nearby Now Reviews)
- [CVE-2025-13729](https://cve.now/CVE-2025-13729.md): Entry Views \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, greenshady Entry Views)
- [CVE-2026-0627](https://cve.now/CVE-2026-0627.md): AMP for WP \<= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2025-69195](https://cve.now/CVE-2025-69195.md): Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls (CVSS 7.6, wget2)
- [CVE-2025-69194](https://cve.now/CVE-2025-69194.md): Wget2: arbitrary file write via metalink path traversal in gnu wget2 (CVSS 8.8, wget2)
- [CVE-2025-14657](https://cve.now/CVE-2025-14657.md): Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) \<= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post\_settings' (CVSS 7.2, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2025-13753](https://cve.now/CVE-2025-13753.md): WP Table Builder \<= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation (CVSS 4.3, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2025-13935](https://cve.now/CVE-2025-13935.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-13934](https://cve.now/CVE-2025-13934.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-14741](https://cve.now/CVE-2025-14741.md): Frontend Admin by DynamiApps \<= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element (CVSS 9.1, shabti Frontend Admin by DynamiApps)
- [CVE-2025-13628](https://cve.now/CVE-2025-13628.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-14937](https://cve.now/CVE-2025-14937.md): Frontend Admin by DynamiApps \<= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update\_field' (CVSS 7.2, shabti Frontend Admin by DynamiApps)
- [CVE-2025-14146](https://cve.now/CVE-2025-14146.md): Booking Calendar \<= 10.14.10 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, wpdevelop Booking Calendar)
- [CVE-2026-21409](https://cve.now/CVE-2026-21409.md): Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. (CVSS 5.9, Ricoh Company RICOH Streamline NX)
- [CVE-2025-70974](https://cve.now/CVE-2025-70974.md): Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java (CVSS 10.0, Alibaba Fastjson · com.alibaba:fastjson)
- [CVE-2025-14574](https://cve.now/CVE-2025-14574.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.1.15 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)
- [CVE-2025-14893](https://cve.now/CVE-2025-14893.md): IndieWeb \<= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter (CVSS 6.4, IndieWeb)
- [CVE-2025-15055](https://cve.now/CVE-2025-15055.md): SlimStat Analytics \<= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2025-15057](https://cve.now/CVE-2025-15057.md): SlimStat Analytics \<= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2025-14718](https://cve.now/CVE-2025-14718.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation (CVSS 5.4, Schedule Post Changes With PublishPress Future: Unpublish,…)
- [CVE-2025-14720](https://cve.now/CVE-2025-14720.md): Booking for Appointments and Events Calendar – Amelia \<= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions (CVSS 5.3, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2026-0563](https://cve.now/CVE-2026-0563.md): WP Google Street View (with 360° virtual tour) & Google maps + Local SEO \<= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv\_map' Shortcode (CVSS 6.4, pagup WP Google Street View (with 360° virtual tour) & Goog…)
- [CVE-2025-14782](https://cve.now/CVE-2025-14782.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2025-14980](https://cve.now/CVE-2025-14980.md): BetterDocs \<= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 6.5, wpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…)
- [CVE-2025-15019](https://cve.now/CVE-2025-15019.md): BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) opt…)
- [CVE-2025-14736](https://cve.now/CVE-2025-14736.md): Frontend Admin by DynamiApps \<= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-20976](https://cve.now/CVE-2026-20976.md): Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script. (CVSS 5.1, Samsung Mobile Galaxy Store)
- [CVE-2026-20975](https://cve.now/CVE-2026-20975.md): Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arb (CVSS 2.1, Samsung Mobile Samsung Cloud)
- [CVE-2026-20974](https://cve.now/CVE-2026-20974.md): Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrie (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2026-20973](https://cve.now/CVE-2026-20973.md): Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory. (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2026-20972](https://cve.now/CVE-2026-20972.md): Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. (CVSS 4.8, Samsung Mobile Devices)
- [CVE-2026-20971](https://cve.now/CVE-2026-20971.md): Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2026-20970](https://cve.now/CVE-2026-20970.md): Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2026-20969](https://cve.now/CVE-2026-20969.md): Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. (CVSS 2.3, Samsung Mobile Devices)
- [CVE-2026-20968](https://cve.now/CVE-2026-20968.md): Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2025-14803](https://cve.now/CVE-2025-14803.md): Nex-Forms Express WP Form Builder \< 9.1.8 - Authenticated Stored XSS (CVSS 6.8, NEX-Forms)
- [CVE-2025-13749](https://cve.now/CVE-2025-13749.md): Clearfy \<= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering (CVSS 4.3, creativemotion Clearfy Cache – WordPress optimization plugi…)
- [CVE-2025-14886](https://cve.now/CVE-2025-14886.md): Japanized for WooCommerce \<= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification (CVSS 5.3, shoheitanaka Japanized for WooCommerce)
- [CVE-2025-66315](https://cve.now/CVE-2025-66315.md): ZTE MF258K Pro Version Server has a Configuration Defect Vulnerability (CVSS 4.3, ZTE MF258K)
- [CVE-2026-22712](https://cve.now/CVE-2026-22712.md): ApprovedRevs allows bypassing the inline CSS sanitizer (CVSS 2.3, The Wikimedia Foundation Mediawiki - ApprovedRevs Extension)
- [CVE-2026-22713](https://cve.now/CVE-2026-22713.md): Stored XSS through edit summaries in GrowthExperiments (CVSS 2.3, The Wikimedia Foundation Mediawiki - GrowthExperiments Exte…)
- [CVE-2025-51626](https://cve.now/CVE-2025-51626.md): SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel\_order.php endpoint. (CVSS 6.5)
- [CVE-2025-56225](https://cve.now/CVE-2025-56225.md): fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid\_synth\_monopoly.c, that can be triggered when loadin (CVSS 7.5)
- [CVE-2025-60538](https://cve.now/CVE-2025-60538.md): A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. (CVSS 6.5, github.com/go-shiori/shiori)
- [CVE-2025-66715](https://cve.now/CVE-2025-66715.md): A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DLL file. (CVSS 6.5)
- [CVE-2025-66744](https://cve.now/CVE-2025-66744.md): In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, all (CVSS 7.5)
- [CVE-2025-67004](https://cve.now/CVE-2025-67004.md): \*\* Disputed \*\* An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directorie (CVSS 6.5)
- [CVE-2025-67070](https://cve.now/CVE-2025-67070.md): A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi- (CVSS 8.2)
- [CVE-2025-67133](https://cve.now/CVE-2025-67133.md): An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component (CVSS 7.5)
- [CVE-2025-67278](https://cve.now/CVE-2025-67278.md): An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP req (CVSS 6.5)
- [CVE-2025-67279](https://cve.now/CVE-2025-67279.md): An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application st (CVSS 5.3)
- [CVE-2025-67280](https://cve.now/CVE-2025-67280.md): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user (CVSS 5.4)
- [CVE-2025-67281](https://cve.now/CVE-2025-67281.md): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user (CVSS 5.4)
- [CVE-2025-67282](https://cve.now/CVE-2025-67282.md): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download (CVSS 5.4)
- [CVE-2025-67810](https://cve.now/CVE-2025-67810.md): In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitra (CVSS 6.5)
- [CVE-2025-67811](https://cve.now/CVE-2025-67811.md): Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. (CVSS 6.5)
- [CVE-2025-69542](https://cve.now/CVE-2025-69542.md): A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. (CVSS 9.8)
- [CVE-2025-70161](https://cve.now/CVE-2025-70161.md): EDIMAX BR-6208AC V2\_1.02 is vulnerable to Command Injection. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.