CVEs published January 16, 2026
140 CVEs were published on January 16, 2026: 11 critical, 55 high.
- Published
- 140
- Critical
- 11
- High
- 55
- Medium
- 66
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 58
Most affected products
- LabRedesCefetRJ WeGIA
- 10
- AVEVA Process Optimization
- 7
- TheLibrarian.io
- 4
- Apple iOS and iPadOS
- 3
- Delta Electronics DIAView
- 3
- Stackideas.com EasyDiscuss extension for Joomla
- 3
- TOA Multiple Network Cameras TRIFORA 3 series
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Apple macOS
- 2
- ConnectWise PSA
- 2
Critical 11
- CVE-2026-23800WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerabilityModular DS
- CVE-2026-23744REC in MCPJam inspector due to HTTP Endpoint exposesMCPJam inspector · @mcpjam/inspector
- CVE-2012-10064Omni Secure Files < 0.1.14 Unauthenticated Arbitrary File UploadOmnilogic Omni Secure Files
- CVE-2026-23722WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.LabRedesCefetRJ WeGIA
- CVE-2026-23523Dive allows One-click Remote Code Execution through Deep Links for MCP InstallOpenAgentPlatform Dive
- CVE-2026-21624Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for JoomlaStackideas.com EasyDiscuss extension for Joomla
- CVE-2026-21623Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for JoomlaStackideas.com EasyDiscuss extension for Joomla
- CVE-2025-60021Apache bRPC: Remote command injection vulnerability in heap builtin serviceApache Software Foundation Apache bRPC
- CVE-2025-62581DIAView - Authentication Bypass VulnerabilityDelta Electronics DIAView
- CVE-2025-62582DIAView - Authentication Bypass VulnerabilityDelta Electronics DIAView
- CVE-2025-61937AVEVA Process Optimization Code InjectionAVEVA Process Optimization
High 55
- CVE-2026-22865Gradle's failure to disable repositories failing to answer can expose builds to malicious artifactsgradle
- CVE-2026-22816Gradle fails to disable repositories which can expose builds to malicious artifactsgradle
- CVE-2026-23745node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitizationisaacs node-tar · tar
- CVE-2026-21223Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2026-20960PowerApps Desktop Client Remote Code Execution VulnerabilityMicrosoft Power Apps Desktop Client
- CVE-2026-23742Skipper arbitrary code execution through lua filterszalando skipper · github.com/zalando/skipper
- CVE-2026-23735Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modulesgraphql-hive graphql-modules · graphql-modules
- CVE-2026-23723WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameterLabRedesCefetRJ WeGIA
- CVE-2021-47847Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service PathDisksorter Disk Sorter Server
- CVE-2021-47845Spy Emergency 25.0.650 - Unquoted Service PathSpy-Emergency Spy Emergency
- CVE-2021-47833WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service PathGearboxcomputers WifiHotSpot
- CVE-2021-47829DHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service PathWeird-Solutions DHCP Broadband
- CVE-2021-47828BOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service PathWeird-Solutions BOOTP Turbo
- CVE-2021-47826Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service PathAcer Backup Manager Module
- CVE-2021-47825Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service PathAcer Updater Service
- CVE-2021-47823ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service PathAcer ePowerSvc
- CVE-2021-47822DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service PathDiskBoss Service
- CVE-2026-23535wlc Path traversal: Unsanitized API slugs in download commandWeblateOrg wlc · wlc
- CVE-2026-23490pyasn1 has a DoS vulnerability in decoderpyasn1
- CVE-2025-48647In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation.Google Devices
- CVE-2025-15032CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blankThe Browser Company of New York Dia
- CVE-2026-0629Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI CamerasTP-Link Systems VIGI InSight Sx45 Series · TP-Link Syst… +32
- CVE-2024-44238The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS
- CVE-2026-23529Arbitrary File Read in Google BigQuery Sink connectorAiven-Open bigquery-connector-for-apache-kafka
- CVE-2026-0695Stored XSS in Time Entry Audit TrailConnectWise PSA
- CVE-2025-14510ABB Ability OPTIMAX Authentication Bypass in Single-Sign OnABB Ability OPTIMAX
- CVE-2026-0615CVE-2026-0615TheLibrarian.io
- CVE-2026-0616CVE-2026-0616TheLibrarian.io
- CVE-2026-0613CVE-2026-0613TheLibrarian.io
- CVE-2026-0612CVE-2026-0612TheLibrarian.io
- CVE-2025-14894CVE-2025-14894bee interactive Livewire Filemanager · livewire-filemanager…
- CVE-2025-68675Apache Airflow: proxy credentials for various providers might leak in task logsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2025-59870Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security riskHCL Software MyXalytics
- CVE-2025-68438Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncatedApache Software Foundation Apache Airflow · apache-airflow
- CVE-2025-14844Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposurestellarwp Membership Plugin – Restrict Content
- CVE-2025-12007Supermicro BMC firmware update validation bypassSMCI X13SEM-F
- CVE-2025-12006Supermicro BMC firmware update validation bypassSMCI X12STW-F
- CVE-2026-20759OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a loggedTOA Multiple Network Cameras TRIFORA 3 series
- CVE-2026-0975DIAView - Command Injection VulnerabilityDelta Electronics DIAView
- CVE-2025-12957All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypassplugins360 All-in-One Video Gallery
- CVE-2026-1023Gotac｜Statistics Database System - Missing AuthenticationGotac Statistics Database System
- CVE-2026-1022Gotac｜Statistics Database System - Arbitrary File ReadGotac Statistics Database System
- CVE-2025-64769AVEVA Process Optimization Cleartext Transmission of Sensitive InformationAVEVA Process Optimization
- CVE-2025-65117AVEVA Process Optimization Use of Potentially Dangerous FunctionAVEVA Process Optimization
- CVE-2025-64729AVEVA Process Optimization Missing AuthorizationAVEVA Process Optimization
- CVE-2025-65118AVEVA Process Optimization Uncontrolled Search Path ElementAVEVA Process Optimization
- CVE-2025-61943AVEVA Process Optimization SQL InjectionAVEVA Process Optimization
- CVE-2025-64691AVEVA Process Optimization Code InjectionAVEVA Process Optimization
- CVE-2025-24528In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() inMIT Kerberos
- CVE-2025-31510In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (intlemonldap-ng LemonLDAP::NG
- CVE-2025-62291In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 thstrongSwan
- CVE-2025-68921SteelSeries Nahimic 3 1.10.7 allows Directory traversal.
- CVE-2025-68924In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remUmbraco Forms · UmbracoForms
- CVE-2025-70746Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function.
- CVE-2025-71020Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function.
Medium, low and unrated 74
- CVE-2025-15529Open5GS s5c-handler.c sgwc_s5c_handle_create_session_response denial of serviceOpen5GS
- CVE-2025-15528Open5GS GTPv2 Bearer Response denial of serviceOpen5GS
- CVE-2026-23643CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scriptingcakephp · cakephp/cakephp
- CVE-2019-25297Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 Stored XSSAssaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Sta…
- CVE-2026-23731WeGIA Clickjacking VulnerabilityLabRedesCefetRJ WeGIA
- CVE-2026-23730WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)LabRedesCefetRJ WeGIA
- CVE-2026-23729WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)LabRedesCefetRJ WeGIA
- CVE-2026-23728WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)LabRedesCefetRJ WeGIA
- CVE-2026-23727WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)LabRedesCefetRJ WeGIA
- CVE-2026-23726WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)LabRedesCefetRJ WeGIA
- CVE-2026-23725WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information PageLabRedesCefetRJ WeGIA
- CVE-2026-23724WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration PageLabRedesCefetRJ WeGIA
- CVE-2026-23645SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Uploadsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-23634Pepr Overly Permissive RBAC ClusterRole in Admin Modedefenseunicorns pepr · pepr
- CVE-2021-47844Xmind 2020 - Persistent Cross-Site ScriptingXmind
- CVE-2021-47842StudyMD 0.3.2 - Persistent Cross-Site Scriptingjotron StudyMD
- CVE-2021-47841SnipCommand 0.1.0 - Persistent Cross-Site Scriptinggurayyarar SnipCommand
- CVE-2021-47840Moeditor 0.2.0 - Persistent Cross-Site ScriptingMoeditor
- CVE-2021-47839Marky 0.0.1 - Persistent Cross-Site Scriptingvesparny Marky
- CVE-2021-47838Markright 1.0 - Persistent Cross-Site Scriptingdvcrn Markright
- CVE-2021-47837Markdownify 1.2.0 - Persistent Cross-Site Scriptingamitmerchant1990 Markdownify
- CVE-2021-47836Markdown Explorer 0.1.1 - Persistent Cross-Site Scriptingjersou Markdown Explorer
- CVE-2021-47835Freeter 1.2.1 - Persistent Cross-Site ScriptingFreeter
- CVE-2021-47834Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)Schlix CMS
- CVE-2021-47831Sandboxie 5.49.7 - Denial of ServiceSandboxie-Plus Sandboxie
- CVE-2021-47827WebSSH for iOS 14.16.10 - 'mashREPL' Denial of ServiceWebSSH for iOS
- CVE-2021-47824iDailyDiary 4.30 - Denial of Service (PoC)Splinterware iDailyDiary
- CVE-2021-47821RarmaRadio 2.72.8 - Denial of ServiceRaimersoft RarmaRadio
- CVE-2021-47820Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)Ubeeinteractive Ubee EVW327
- CVE-2021-47818DupTerminator 1.4.5639.37199 - Denial of ServiceDupTerminator
- CVE-2021-47816Thecus N4800Eco Nas Server Control Panel - Command InjectionThecus N4800Eco Nas Server Control Panel
- CVE-2025-31186A permissions issue was addressed with additional restrictions.Apple Xcode
- CVE-2025-24090A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS
- CVE-2025-43508A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2024-44210This issue was addressed with improved permissions checking.Apple macOS
- CVE-2025-24089A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS
- CVE-2024-54556This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2026-23528Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboarddask distributed · distributed
- CVE-2026-0949PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage ChEnterpriseDB Postgres Enterprise Manager
- CVE-2026-22782RustFS RPC signature verification logs shared secretrustfs
- CVE-2025-29943Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentiallyAMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Series… +3
- CVE-2026-21625Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for JoomlaStackideas.com EasyDiscuss extension for Joomla
- CVE-2025-15104Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRFThe Nu Html Checker · nu.validator:validator +1
- CVE-2026-0696Session Cookies Missing HttpOnly AttributeConnectWise PSA
- CVE-2025-14435Application-Level DoS via infinite re-render loop in user profile handlingMattermost · github.com/mattermost/mattermost-server
- CVE-2025-14822DoS from quadratic complexity in model.ParseHashtagsMattermost · github.com/mattermost/mattermost-server
- CVE-2025-14757Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypassstylemix Cost Calculator Builder
- CVE-2026-0913User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcodespecialk User Submitted Posts – Enable Users to Submit Post…
- CVE-2026-1004Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposurewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2026-22876Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation.TOA Multiple Network Cameras TRIFORA 3 series
- CVE-2026-20894Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation.TOA Multiple Network Cameras TRIFORA 3 series
- CVE-2025-14375RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via classNamerebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…
- CVE-2026-1003GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletionroxnor GetGenie – AI Content Writer with Keyword Research &…
- CVE-2025-14793DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgerytorstenbulk DK PDF – WordPress PDF Generator
- CVE-2025-14853LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Updatesmings LEAV Last Email Address Validator
- CVE-2026-0939Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulationlinknacional Rede Itaú for WooCommerce — Payment PIX, Credi…
- CVE-2026-0942Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletionlinknacional Rede Itaú for WooCommerce — Payment PIX, Credi…
- CVE-2026-0916Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcodekeesiemeijer Related Posts by Taxonomy
- CVE-2026-23769lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigureNAVER lucy-xss-filter
- CVE-2026-23768lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListenNAVER lucy-xss-filter
- CVE-2026-0858Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of inet.sourceforge.plantuml:plantuml
- CVE-2025-14384All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosuresmub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- CVE-2026-1000MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data DeletionMailerLite – WooCommerce integration
- CVE-2025-15370Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticatorpaultgoodchild Shield: Blocks Bots, Protects Users, and Pre…
- CVE-2025-12641Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotionawesomesupport Awesome Support – WordPress HelpDesk & Suppo…
- CVE-2025-15526Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameterradykal Fancy Product Designer
- CVE-2025-15527WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposurebrechtvds WP Recipe Maker
- CVE-2025-14982Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposurewpdevelop Booking Calendar
- CVE-2025-24531In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered byOpenSC project pam_pkcs11
- CVE-2025-43904In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator.SchedMD Slurm
- CVE-2025-51602mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMVideoLAN VLC media player
- CVE-2025-56451Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main
- CVE-2025-61873Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.bestpractical Request Tracker
- CVE-2025-69581An issue was discovered in Chamillo LMS 1.11.2.