# CVEs published 2026-01-16

140 CVEs were published on January 16, 2026: 11 critical, 55 high. Days are UTC.

- [CVE-2026-22865](https://cve.now/CVE-2026-22865.md): Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts (CVSS 8.6, gradle)
- [CVE-2026-22816](https://cve.now/CVE-2026-22816.md): Gradle fails to disable repositories which can expose builds to malicious artifacts (CVSS 8.6, gradle)
- [CVE-2025-15529](https://cve.now/CVE-2025-15529.md): Open5GS s5c-handler.c sgwc\_s5c\_handle\_create\_session\_response denial of service (CVSS 6.9, Open5GS)
- [CVE-2025-15528](https://cve.now/CVE-2025-15528.md): Open5GS GTPv2 Bearer Response denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-23745](https://cve.now/CVE-2026-23745.md): node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization (CVSS 8.2, isaacs node-tar · tar)
- [CVE-2026-21223](https://cve.now/CVE-2026-21223.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2026-20960](https://cve.now/CVE-2026-20960.md): PowerApps Desktop Client Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Power Apps Desktop Client)
- [CVE-2026-23800](https://cve.now/CVE-2026-23800.md): WordPress Modular DS plugin \<= 2.5.2 - Privilege Escalation vulnerability (CVSS 10.0, Modular DS)
- [CVE-2026-23643](https://cve.now/CVE-2026-23643.md): CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting (CVSS 5.4, cakephp · cakephp/cakephp)
- [CVE-2019-25297](https://cve.now/CVE-2019-25297.md): Poll, Survey & Quiz Maker Plugin by Opinion Stage \< 19.6.25 Stored XSS (CVSS 5.1, Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Sta…)
- [CVE-2026-23744](https://cve.now/CVE-2026-23744.md): REC in MCPJam inspector due to HTTP Endpoint exposes (CVSS 9.8, MCPJam inspector · @mcpjam/inspector)
- [CVE-2012-10064](https://cve.now/CVE-2012-10064.md): Omni Secure Files \< 0.1.14 Unauthenticated Arbitrary File Upload (CVSS 9.3, Omnilogic Omni Secure Files)
- [CVE-2026-23742](https://cve.now/CVE-2026-23742.md): Skipper arbitrary code execution through lua filters (CVSS 8.8, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-23735](https://cve.now/CVE-2026-23735.md): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules (CVSS 8.7, graphql-hive graphql-modules · graphql-modules)
- [CVE-2026-23731](https://cve.now/CVE-2026-23731.md): WeGIA Clickjacking Vulnerability (CVSS 4.3, LabRedesCefetRJ WeGIA)
- [CVE-2026-23730](https://cve.now/CVE-2026-23730.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle) (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-23729](https://cve.now/CVE-2026-23729.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle) (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-23728](https://cve.now/CVE-2026-23728.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle) (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-23727](https://cve.now/CVE-2026-23727.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle) (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-23726](https://cve.now/CVE-2026-23726.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle) (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-23725](https://cve.now/CVE-2026-23725.md): WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page (CVSS 5.3, LabRedesCefetRJ WeGIA)
- [CVE-2026-23724](https://cve.now/CVE-2026-23724.md): WeGIA Stored Cross-Site Scripting (XSS) – atendido\_idatendido Parameter on Occurrence Registration Page (CVSS 4.3, LabRedesCefetRJ WeGIA)
- [CVE-2026-23722](https://cve.now/CVE-2026-23722.md): WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing. (CVSS 9.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-23723](https://cve.now/CVE-2026-23723.md): WeGIA has a Critical SQL Injection in Atendido\_ocorrenciaControle via id\_memorando parameter (CVSS 7.2, LabRedesCefetRJ WeGIA)
- [CVE-2026-23645](https://cve.now/CVE-2026-23645.md): SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload (CVSS 5.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-23634](https://cve.now/CVE-2026-23634.md): Pepr Overly Permissive RBAC ClusterRole in Admin Mode (CVSS 0.0, defenseunicorns pepr · pepr)
- [CVE-2021-47847](https://cve.now/CVE-2021-47847.md): Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path (CVSS 8.5, Disksorter Disk Sorter Server)
- [CVE-2021-47845](https://cve.now/CVE-2021-47845.md): Spy Emergency 25.0.650 - Unquoted Service Path (CVSS 8.5, Spy-Emergency Spy Emergency)
- [CVE-2021-47844](https://cve.now/CVE-2021-47844.md): Xmind 2020 - Persistent Cross-Site Scripting (CVSS 5.1, Xmind)
- [CVE-2021-47842](https://cve.now/CVE-2021-47842.md): StudyMD 0.3.2 - Persistent Cross-Site Scripting (CVSS 5.1, jotron StudyMD)
- [CVE-2021-47841](https://cve.now/CVE-2021-47841.md): SnipCommand 0.1.0 - Persistent Cross-Site Scripting (CVSS 5.1, gurayyarar SnipCommand)
- [CVE-2021-47840](https://cve.now/CVE-2021-47840.md): Moeditor 0.2.0 - Persistent Cross-Site Scripting (CVSS 5.1, Moeditor)
- [CVE-2021-47839](https://cve.now/CVE-2021-47839.md): Marky 0.0.1 - Persistent Cross-Site Scripting (CVSS 5.1, vesparny Marky)
- [CVE-2021-47838](https://cve.now/CVE-2021-47838.md): Markright 1.0 - Persistent Cross-Site Scripting (CVSS 5.1, dvcrn Markright)
- [CVE-2021-47837](https://cve.now/CVE-2021-47837.md): Markdownify 1.2.0 - Persistent Cross-Site Scripting (CVSS 5.1, amitmerchant1990 Markdownify)
- [CVE-2021-47836](https://cve.now/CVE-2021-47836.md): Markdown Explorer 0.1.1 - Persistent Cross-Site Scripting (CVSS 5.1, jersou Markdown Explorer)
- [CVE-2021-47835](https://cve.now/CVE-2021-47835.md): Freeter 1.2.1 - Persistent Cross-Site Scripting (CVSS 5.1, Freeter)
- [CVE-2021-47834](https://cve.now/CVE-2021-47834.md): Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated) (CVSS 5.1, Schlix CMS)
- [CVE-2021-47833](https://cve.now/CVE-2021-47833.md): WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path (CVSS 8.5, Gearboxcomputers WifiHotSpot)
- [CVE-2021-47831](https://cve.now/CVE-2021-47831.md): Sandboxie 5.49.7 - Denial of Service (CVSS 4.6, Sandboxie-Plus Sandboxie)
- [CVE-2021-47829](https://cve.now/CVE-2021-47829.md): DHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service Path (CVSS 8.5, Weird-Solutions DHCP Broadband)
- [CVE-2021-47828](https://cve.now/CVE-2021-47828.md): BOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service Path (CVSS 8.5, Weird-Solutions BOOTP Turbo)
- [CVE-2021-47827](https://cve.now/CVE-2021-47827.md): WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (CVSS 4.6, WebSSH for iOS)
- [CVE-2021-47826](https://cve.now/CVE-2021-47826.md): Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path (CVSS 8.5, Acer Backup Manager Module)
- [CVE-2021-47825](https://cve.now/CVE-2021-47825.md): Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service Path (CVSS 8.5, Acer Updater Service)
- [CVE-2021-47824](https://cve.now/CVE-2021-47824.md): iDailyDiary 4.30 - Denial of Service (PoC) (CVSS 4.6, Splinterware iDailyDiary)
- [CVE-2021-47823](https://cve.now/CVE-2021-47823.md): ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path (CVSS 8.5, Acer ePowerSvc)
- [CVE-2021-47822](https://cve.now/CVE-2021-47822.md): DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path (CVSS 8.5, DiskBoss Service)
- [CVE-2021-47821](https://cve.now/CVE-2021-47821.md): RarmaRadio 2.72.8 - Denial of Service (CVSS 4.6, Raimersoft RarmaRadio)
- [CVE-2021-47820](https://cve.now/CVE-2021-47820.md): Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF) (CVSS 5.1, Ubeeinteractive Ubee EVW327)
- [CVE-2021-47818](https://cve.now/CVE-2021-47818.md): DupTerminator 1.4.5639.37199 - Denial of Service (CVSS 4.6, DupTerminator)
- [CVE-2021-47816](https://cve.now/CVE-2021-47816.md): Thecus N4800Eco Nas Server Control Panel - Command Injection (CVSS 5.3, Thecus N4800Eco Nas Server Control Panel)
- [CVE-2026-23535](https://cve.now/CVE-2026-23535.md): wlc Path traversal: Unsanitized API slugs in download command (CVSS 8.1, WeblateOrg wlc · wlc)
- [CVE-2026-23490](https://cve.now/CVE-2026-23490.md): pyasn1 has a DoS vulnerability in decoder (CVSS 7.5, pyasn1)
- [CVE-2025-48647](https://cve.now/CVE-2025-48647.md): In cpm\_fwtp\_msg\_handler of cpm/google/lib/tracepoint/cpm\_fwtp\_ipc.c, there is a possible memory overwrite due to improper input validation. (CVSS 7.8, Google Devices)
- [CVE-2025-15032](https://cve.now/CVE-2025-15032.md): CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank (CVSS 7.4, The Browser Company of New York Dia)
- [CVE-2026-0629](https://cve.now/CVE-2026-0629.md): Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras (CVSS 8.7, TP-Link Systems VIGI InSight Sx45 Series · TP-Link Syst… +32)
- [CVE-2025-31186](https://cve.now/CVE-2025-31186.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple Xcode)
- [CVE-2025-24090](https://cve.now/CVE-2025-24090.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2025-43508](https://cve.now/CVE-2025-43508.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple macOS)
- [CVE-2024-44210](https://cve.now/CVE-2024-44210.md): This issue was addressed with improved permissions checking. (CVSS 3.3, Apple macOS)
- [CVE-2025-24089](https://cve.now/CVE-2025-24089.md): A permissions issue was addressed with additional restrictions. (CVSS 5.3, Apple iOS and iPadOS)
- [CVE-2024-54556](https://cve.now/CVE-2024-54556.md): This issue was addressed through improved state management. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-44238](https://cve.now/CVE-2024-44238.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-23529](https://cve.now/CVE-2026-23529.md): Arbitrary File Read in Google BigQuery Sink connector (CVSS 7.7, Aiven-Open bigquery-connector-for-apache-kafka)
- [CVE-2026-23528](https://cve.now/CVE-2026-23528.md): Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard (CVSS 5.3, dask distributed · distributed)
- [CVE-2026-23523](https://cve.now/CVE-2026-23523.md): Dive allows One-click Remote Code Execution through Deep Links for MCP Install (CVSS 9.7, OpenAgentPlatform Dive)
- [CVE-2026-0949](https://cve.now/CVE-2026-0949.md): PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Ch (CVSS 6.5, EnterpriseDB Postgres Enterprise Manager)
- [CVE-2026-22782](https://cve.now/CVE-2026-22782.md): RustFS RPC signature verification logs shared secret (CVSS 2.9, rustfs)
- [CVE-2025-29943](https://cve.now/CVE-2025-29943.md): Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially (CVSS 4.6, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Series… +3)
- [CVE-2026-21625](https://cve.now/CVE-2026-21625.md): Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla (CVSS 4.8, Stackideas.com EasyDiscuss extension for Joomla)
- [CVE-2026-21624](https://cve.now/CVE-2026-21624.md): Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla (CVSS 9.4, Stackideas.com EasyDiscuss extension for Joomla)
- [CVE-2026-21623](https://cve.now/CVE-2026-21623.md): Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla (CVSS 9.4, Stackideas.com EasyDiscuss extension for Joomla)
- [CVE-2025-15104](https://cve.now/CVE-2025-15104.md): Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRF (CVSS 6.9, The Nu Html Checker · nu.validator:validator +1)
- [CVE-2026-0696](https://cve.now/CVE-2026-0696.md): Session Cookies Missing HttpOnly Attribute (CVSS 6.5, ConnectWise PSA)
- [CVE-2026-0695](https://cve.now/CVE-2026-0695.md): Stored XSS in Time Entry Audit Trail (CVSS 8.7, ConnectWise PSA)
- [CVE-2025-14510](https://cve.now/CVE-2025-14510.md): ABB Ability OPTIMAX Authentication Bypass in Single-Sign On (CVSS 8.1, ABB Ability OPTIMAX)
- [CVE-2026-0615](https://cve.now/CVE-2026-0615.md): CVE-2026-0615 (CVSS 7.3, TheLibrarian.io)
- [CVE-2026-0616](https://cve.now/CVE-2026-0616.md): CVE-2026-0616 (CVSS 7.5, TheLibrarian.io)
- [CVE-2026-0613](https://cve.now/CVE-2026-0613.md): CVE-2026-0613 (CVSS 7.5, TheLibrarian.io)
- [CVE-2026-0612](https://cve.now/CVE-2026-0612.md): CVE-2026-0612 (CVSS 7.5, TheLibrarian.io)
- [CVE-2025-14894](https://cve.now/CVE-2025-14894.md): CVE-2025-14894 (CVSS 7.5, bee interactive Livewire Filemanager · livewire-filemanager…)
- [CVE-2025-14435](https://cve.now/CVE-2025-14435.md): Application-Level DoS via infinite re-render loop in user profile handling (CVSS 6.8, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2025-68675](https://cve.now/CVE-2025-68675.md): Apache Airflow: proxy credentials for various providers might leak in task logs (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2025-59870](https://cve.now/CVE-2025-59870.md): Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk (CVSS 7.4, HCL Software MyXalytics)
- [CVE-2025-68438](https://cve.now/CVE-2025-68438.md): Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2025-14844](https://cve.now/CVE-2025-14844.md): Membership Plugin – Restrict Content \<= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure (CVSS 8.2, stellarwp Membership Plugin – Restrict Content)
- [CVE-2025-14822](https://cve.now/CVE-2025-14822.md): DoS from quadratic complexity in model.ParseHashtags (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2025-12007](https://cve.now/CVE-2025-12007.md): Supermicro BMC firmware update validation bypass (CVSS 8.4, SMCI X13SEM-F)
- [CVE-2025-60021](https://cve.now/CVE-2025-60021.md): Apache bRPC: Remote command injection vulnerability in heap builtin service (CVSS 9.8, Apache Software Foundation Apache bRPC)
- [CVE-2025-14757](https://cve.now/CVE-2025-14757.md): Cost Calculator Builder \<= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass (CVSS 5.3, stylemix Cost Calculator Builder)
- [CVE-2025-12006](https://cve.now/CVE-2025-12006.md): Supermicro BMC firmware update validation bypass (CVSS 7.2, SMCI X12STW-F)
- [CVE-2026-0913](https://cve.now/CVE-2026-0913.md): User Submitted Posts \<= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp\_access' Shortcode (CVSS 6.4, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2026-1004](https://cve.now/CVE-2026-1004.md): Essential Addons for Elementor \<= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2026-22876](https://cve.now/CVE-2026-22876.md): Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. (CVSS 6.5, TOA Multiple Network Cameras TRIFORA 3 series)
- [CVE-2026-20894](https://cve.now/CVE-2026-20894.md): Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. (CVSS 4.8, TOA Multiple Network Cameras TRIFORA 3 series)
- [CVE-2026-20759](https://cve.now/CVE-2026-20759.md): OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged (CVSS 8.8, TOA Multiple Network Cameras TRIFORA 3 series)
- [CVE-2025-14375](https://cve.now/CVE-2025-14375.md): RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging \<= 5.0.10 - Reflected Cross-Site Scripting via className (CVSS 6.1, rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…)
- [CVE-2026-1003](https://cve.now/CVE-2026-1003.md): GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools \<= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion (CVSS 4.3, roxnor GetGenie – AI Content Writer with Keyword Research &…)
- [CVE-2025-14793](https://cve.now/CVE-2025-14793.md): DK PDF – WordPress PDF Generator \<= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery (CVSS 5.0, torstenbulk DK PDF – WordPress PDF Generator)
- [CVE-2025-14853](https://cve.now/CVE-2025-14853.md): LEAV Last Email Address Validator \<= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, smings LEAV Last Email Address Validator)
- [CVE-2026-0939](https://cve.now/CVE-2026-0939.md): Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit \<= 5.1.2 - Unauthenticated Order Status Manipulation (CVSS 5.3, linknacional Rede Itaú for WooCommerce — Payment PIX, Credi…)
- [CVE-2026-0942](https://cve.now/CVE-2026-0942.md): Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit \<= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion (CVSS 5.3, linknacional Rede Itaú for WooCommerce — Payment PIX, Credi…)
- [CVE-2026-0916](https://cve.now/CVE-2026-0916.md): Related Posts by Taxonomy \<= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related\_posts\_by\_tax' Shortcode (CVSS 6.4, keesiemeijer Related Posts by Taxonomy)
- [CVE-2026-0975](https://cve.now/CVE-2026-0975.md): DIAView - Command Injection Vulnerability (CVSS 7.8, Delta Electronics DIAView)
- [CVE-2026-23769](https://cve.now/CVE-2026-23769.md): lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigure (CVSS 6.5, NAVER lucy-xss-filter)
- [CVE-2026-23768](https://cve.now/CVE-2026-23768.md): lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListen (CVSS 6.1, NAVER lucy-xss-filter)
- [CVE-2026-0858](https://cve.now/CVE-2026-0858.md): Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of i (CVSS 5.1, net.sourceforge.plantuml:plantuml)
- [CVE-2025-14384](https://cve.now/CVE-2025-14384.md): All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic \<= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure (CVSS 4.3, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2026-1000](https://cve.now/CVE-2026-1000.md): MailerLite - WooCommerce integration \<= 3.1.3 - Missing Authorization to Data Deletion (CVSS 6.5, MailerLite – WooCommerce integration)
- [CVE-2025-15370](https://cve.now/CVE-2025-15370.md): Shield Security \<= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator (CVSS 4.3, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2025-12957](https://cve.now/CVE-2025-12957.md): All-in-One Video Gallery \<= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass (CVSS 8.8, plugins360 All-in-One Video Gallery)
- [CVE-2025-12641](https://cve.now/CVE-2025-12641.md): Awesome Support – WordPress HelpDesk & Support Plugin \<= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion (CVSS 6.5, awesomesupport Awesome Support – WordPress HelpDesk & Suppo…)
- [CVE-2025-15526](https://cve.now/CVE-2025-15526.md): Fancy Product Designer | WooCommerce WordPress \<= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter (CVSS 5.3, radykal Fancy Product Designer)
- [CVE-2025-15527](https://cve.now/CVE-2025-15527.md): WP Recipe Maker \<= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 4.3, brechtvds WP Recipe Maker)
- [CVE-2025-14982](https://cve.now/CVE-2025-14982.md): Booking Calendar \<= 10.14.11 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3, wpdevelop Booking Calendar)
- [CVE-2026-1023](https://cve.now/CVE-2026-1023.md): Gotac｜Statistics Database System - Missing Authentication (CVSS 8.7, Gotac Statistics Database System)
- [CVE-2026-1022](https://cve.now/CVE-2026-1022.md): Gotac｜Statistics Database System - Arbitrary File Read (CVSS 8.7, Gotac Statistics Database System)
- [CVE-2025-62581](https://cve.now/CVE-2025-62581.md): DIAView - Authentication Bypass Vulnerability (CVSS 9.8, Delta Electronics DIAView)
- [CVE-2025-62582](https://cve.now/CVE-2025-62582.md): DIAView - Authentication Bypass Vulnerability (CVSS 9.8, Delta Electronics DIAView)
- [CVE-2025-64769](https://cve.now/CVE-2025-64769.md): AVEVA Process Optimization Cleartext Transmission of Sensitive Information (CVSS 7.1, AVEVA Process Optimization)
- [CVE-2025-65117](https://cve.now/CVE-2025-65117.md): AVEVA Process Optimization Use of Potentially Dangerous Function (CVSS 7.4, AVEVA Process Optimization)
- [CVE-2025-64729](https://cve.now/CVE-2025-64729.md): AVEVA Process Optimization Missing Authorization (CVSS 8.1, AVEVA Process Optimization)
- [CVE-2025-65118](https://cve.now/CVE-2025-65118.md): AVEVA Process Optimization Uncontrolled Search Path Element (CVSS 8.8, AVEVA Process Optimization)
- [CVE-2025-61943](https://cve.now/CVE-2025-61943.md): AVEVA Process Optimization SQL Injection (CVSS 8.4, AVEVA Process Optimization)
- [CVE-2025-64691](https://cve.now/CVE-2025-64691.md): AVEVA Process Optimization Code Injection (CVSS 8.8, AVEVA Process Optimization)
- [CVE-2025-61937](https://cve.now/CVE-2025-61937.md): AVEVA Process Optimization Code Injection (CVSS 10.0, AVEVA Process Optimization)
- [CVE-2025-24528](https://cve.now/CVE-2025-24528.md): In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in (CVSS 7.1, MIT Kerberos)
- [CVE-2025-24531](https://cve.now/CVE-2025-24531.md): In OpenSC pam\_pkcs11 before 0.6.13, pam\_sm\_authenticate() wrongly returns PAM\_IGNORE in many error situations (such as an error triggered by (CVSS 6.7, OpenSC project pam\_pkcs11)
- [CVE-2025-31510](https://cve.now/CVE-2025-31510.md): In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (int (CVSS 7.2, lemonldap-ng LemonLDAP::NG)
- [CVE-2025-43904](https://cve.now/CVE-2025-43904.md): In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator. (CVSS 4.2, SchedMD Slurm)
- [CVE-2025-51602](https://cve.now/CVE-2025-51602.md): mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MM (CVSS 4.8, VideoLAN VLC media player)
- [CVE-2025-56451](https://cve.now/CVE-2025-56451.md): Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main (CVSS 6.1)
- [CVE-2025-61873](https://cve.now/CVE-2025-61873.md): Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. (CVSS 2.6, bestpractical Request Tracker)
- [CVE-2025-62291](https://cve.now/CVE-2025-62291.md): In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 th (CVSS 8.1, strongSwan)
- [CVE-2025-68921](https://cve.now/CVE-2025-68921.md): SteelSeries Nahimic 3 1.10.7 allows Directory traversal. (CVSS 7.8)
- [CVE-2025-68924](https://cve.now/CVE-2025-68924.md): In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for rem (CVSS 7.5, Umbraco Forms · UmbracoForms)
- [CVE-2025-69581](https://cve.now/CVE-2025-69581.md): An issue was discovered in Chamillo LMS 1.11.2. (CVSS 5.5)
- [CVE-2025-70746](https://cve.now/CVE-2025-70746.md): Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. (CVSS 7.5)
- [CVE-2025-71020](https://cve.now/CVE-2025-71020.md): Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub\_4C408 function. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.