CVEs published January 17, 2026
39 CVEs were published on January 17, 2026: 2 critical, 1 high.
- Published
- 39
- Critical
- 2
- High
- 1
- Medium
- 35
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Absolute Security Secure Access
- 3
- Open5GS
- 3
- bastillion-io Bastillion
- 2
- cubewp1211 CubeWP Framework
- 2
- LigeroSmart
- 2
- xiweicheng TMS
- 2
- andy_moyle Church Admin
- 1
- Awesome Motive YouTube Feed Pro
- 1
- bdthemes Spin Wheel – Interactive spinning wheel that offer…
- 1
- bplugins Team Section Block – Showcase Team Members with La…
- 1
Critical 2
- CVE-2025-10484Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication BypassFmeAddons Registration & Login with Mobile Phone Number for…
- CVE-2025-15403RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_ordermetagauss RegistrationMagic – Custom Registration Forms, Us…
High 1
Medium, low and unrated 36
- CVE-2026-1105EasyCMS UserAction.class.php sql injectionEasyCMS
- CVE-2026-1066kalcaddle kodbox Compression zip command injectionkalcaddle kodbox
- CVE-2026-1064bastillion-io Bastillion System Management SystemKtrl.java command injectionbastillion-io Bastillion
- CVE-2026-1063bastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injectionbastillion-io Bastillion
- CVE-2026-1062xiweicheng TMS HtmlUtil.java summary server-side request forgeryxiweicheng TMS
- CVE-2026-1061xiweicheng TMS FileController.java upload unrestricted uploadxiweicheng TMS
- CVE-2026-1059FeMiner wms chkuser.php sql injectionFeMiner wms
- CVE-2026-1050risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injectionrisesoft-y9 Digital-Infrastructure · net.risesoft:risenet-y…
- CVE-2026-1049LigeroSmart index.pl cross site scriptingLigeroSmart
- CVE-2026-1048LigeroSmart index.pl cross site scriptingLigeroSmart
- CVE-2025-15532Open5GS Timer resource consumptionOpen5GS
- CVE-2025-15531Open5GS context.c sgwc_bearer_add assertionOpen5GS
- CVE-2025-15530Open5GS s11-handler.c assertionOpen5GS
- CVE-2025-8615CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcodecubewp1211 CubeWP Framework
- CVE-2025-14078PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulationshoheitanaka PAYGENT for WooCommerce
- CVE-2026-0725Integrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configurationcyberlord92 Integrate Dynamics 365 CRM
- CVE-2025-12129CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposurecubewp1211 CubeWP Framework
- CVE-2026-0808Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameterbdthemes Spin Wheel – Interactive spinning wheel that offer…
- CVE-2026-0691CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parametercreativemindssolutions CM E-Mail Blacklist – Simple email f…
- CVE-2025-12984Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injectionmonetizemore Advanced Ads – Ad Manager & AdSense
- CVE-2026-0833Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Linkbplugins Team Section Block – Showcase Team Members with La…
- CVE-2025-12825User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposurezealopensource User Registration Using Contact Form
- CVE-2025-12168Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletionmemsource Phrase TMS Integration for WordPress
- CVE-2025-14029Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameterjackdewey Community Events
- CVE-2025-14463Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creationnaa986 Payment Button for PayPal
- CVE-2025-13725Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameterthimpress Thim Blocks
- CVE-2026-0682Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameterandy_moyle Church Admin
- CVE-2026-0820RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orderssweetdaisy86 RepairBuddy – Repair Shop CRM & Booking Plugin…
- CVE-2025-12002Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path TraversalAwesome Motive YouTube Feed Pro
- CVE-2025-12718Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relaysaadiqbal Quick Contact Form
- CVE-2025-14632Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Uploadwpchill Filr – Secure document library
- CVE-2025-14450Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulationwpswings Wallet System for WooCommerce – Digital Wallet, Bu…
- CVE-2025-14075WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameterthimpress WP Hotel Booking
- CVE-2026-0519Information Disclosure in Secure Access Between 12.70 and 14.20Absolute Security Secure Access
- CVE-2026-0518XSS in Secure Access Consoles prior to 14.20Absolute Security Secure Access
- CVE-2026-0517Denial of Service in Secure Access Servers Prior to 14.20.Absolute Security Secure Access