CVEs published January 22, 2026
443 CVEs were published on January 22, 2026: 41 critical, 229 high. 1 is now in CISA KEV.
- Published
- 443
- Critical
- 41
- High
- 229
- Medium
- 166
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 109
Most affected products
- horilla-opensource horilla
- 7
- Gitea Open Source Git Server · github.com/go-gitea/gitea +1
- 5
- GitLab
- 5
- Dell PowerScale OneFS
- 4
- mastodon
- 4
- AivahThemes Anona
- 3
- Altium AES
- 3
- Autodesk Fusion
- 3
- e-plugins Hospital Doctor Directory
- 3
- e-plugins Hotel Listing
- 3
Critical 41
- CVE-2026-21264Microsoft Account Spoofing VulnerabilityMicrosoft Account
- CVE-2026-24307M365 Copilot Information Disclosure VulnerabilityMicrosoft 365 Copilot
- CVE-2026-24305Azure Entra ID Elevation of Privilege VulnerabilityMicrosoft Entra
- CVE-2026-24306Azure Front Door Elevation of Privilege VulnerabilityMicrosoft Azure Front Door
- CVE-2025-54816EVMAPA Missing Authentication for Critical FunctionEVMAPA
- CVE-2026-20912Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureGitea Open Source Git Server · github.com/go-gitea/gitea +1
- CVE-2026-20897Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)Gitea Open Source Git Server · github.com/go-gitea/gitea +1
- CVE-2026-20750Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)Gitea Open Source Git Server · github.com/go-gitea/gitea +1
- CVE-2026-1201Authorization Bypass Through User-Controlled Key in Hubitat Elevation HubsHubitat Elevation C3 · Hubitat Elevation C4 +3
- CVE-2025-69312WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerabilityXpro Elementor Addons
- CVE-2025-69101WordPress Workreap Core plugin <= 3.4.1 - Broken Authentication vulnerabilityAmentoTech Workreap Core
- CVE-2025-69079WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerabilityThemeREX Sound | Musical Instruments Online Store
- CVE-2025-69052WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerabilityFmeAddons Registration & Login with Mobile Phone Number for…
- CVE-2025-68986WordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerabilityzozothemes Miion
- CVE-2025-68910WordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerabilityblazethemes Blogzee
- CVE-2025-68909WordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerabilityblazethemes Blogistic
- CVE-2025-68869WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerabilityLazyCoders LazyTasks
- CVE-2025-68857WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerabilityichurakov Paid Downloads
- CVE-2025-68034WordPress CleverReach® WP plugin <= 1.5.21 - SQL Injection vulnerabilityCleverReach® WP
- CVE-2025-68018WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerabilityStackWC Order Listener for WooCommerce
- CVE-2025-68015WordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerabilityVollstart Event Tickets with Ticket Scanner
- CVE-2025-68001WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerabilitygaridium g-FFL Checkout
- CVE-2025-67968WordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityInspiryThemes Real Homes CRM
- CVE-2025-67945WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerabilityMailerLite – WooCommerce integration
- CVE-2025-67944WordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerabilityNelio Software Nelio AB Testing
- CVE-2025-67617WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerabilitythemeton Consult Aid
- CVE-2025-62056WordPress News Event theme <= 1.0.1 - Arbitrary File Upload vulnerabilityblazethemes News Event
- CVE-2025-62050WordPress Blogmatic theme <= 1.0.3 - Arbitrary File Upload vulnerabilityblazethemes Blogmatic
- CVE-2025-50002WordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerabilityFarost Energia
- CVE-2025-49055WordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerabilitykamleshyadav WP Lead Capturing Pages
- CVE-2025-64097NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Forcenerves-hub nerves_hub_web
- CVE-2026-23760SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APISmarterTools SmarterMail
- CVE-2025-67684Remote Code Execution via Local File Inclusion in Quick.CartOpenSolution Quick.Cart
- CVE-2026-1331AMASTAR Technology｜MeetingHub - Arbitrary File UploadAMASTAR Technology MeetingHub
- CVE-2026-0920LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameterchoijun LA-Studio Element Kit for Elementor
- CVE-2026-24042Appsmith public apps can execute unpublished actions (viewMode confusion)appsmithorg appsmith
- CVE-2026-24002pyodide sandbox option is insecuregristlabs grist-core
- CVE-2026-23966sm-crypto Affected by Private Key Recovery in SM2-PKEJuneAndGreen sm-crypto · sm-crypto
- CVE-2025-56590An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10.
- CVE-2025-69764Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid s
- CVE-2025-69828File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary
High 229
- CVE-2026-20613The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extractApple Container · Apple Containerization
- CVE-2026-24132Orval Mock Generation Code Injection via constorval-labs orval · @orval/mock
- CVE-2026-21521Word Copilot Information Disclosure VulnerabilityMicrosoft 365 Word Copilot
- CVE-2026-21227Azure Logic Apps Elevation of Privilege VulnerabilityMicrosoft Azure Logic Apps
- CVE-2026-21524Azure Data Explorer Information Disclosure VulnerabilityMicrosoft Azure Data Explorer
- CVE-2026-21520Copilot Studio Information Disclosure VulnerabilityMicrosoft Copilot Studio
- CVE-2026-24129Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Executionruntipi
- CVE-2025-53968EVMAPA Improper Restriction of Excessive Authentication AttemptsEVMAPA
- CVE-2025-55705EVMAPA Insufficient Session ExpirationEVMAPA
- CVE-2026-24124Dragonfly Manager Job API Allows Unauthenticated Accessdragonflyoss dragonfly · d7y.io/dragonfly/v2
- CVE-2026-20736Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership CheckGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-24058Soft Serve has Critical Authentication Bypasscharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2026-23988Rufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handlingpbatard rufus
- CVE-2026-23954Incus container image templating arbitrary host file read and writelxc incus · github.com/lxc/incus/v6/cmd/incusd +2
- CVE-2025-14751Unverified Password Change in Weintek cMT X Series HMI EasyWeb ServiceWeintek cMT3072XH · Weintek cMT-SVRX-820 +1
- CVE-2025-14750External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb ServiceWeintek cMT3072XH · Weintek cMT-SVRX-820 +1
- CVE-2026-23953Incus container environment configuration newline injectionlxc incus · github.com/lxc/incus/v6 +1
- CVE-2026-1260Invalid Memory Access in Sentencepiece,Google Sentencepiece · sentencepiece
- CVE-2026-0535Stored XSS in Electronic Library Component DescriptionAutodesk Fusion
- CVE-2026-0534Stored XSS in the value of a part attributeAutodesk Fusion
- CVE-2026-0533Stored XSS in Fusion desktop when attempting to delete a fileAutodesk Fusion
- CVE-2023-7335EduSoho < 22.4.7 Arbitrary File Read via classroom-course-statisticsHangzhou Kuozhi Network Technology Co. EduSoho
- CVE-2026-24390WordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerabilityQantumThemes Kentha Elementor Widgets
- CVE-2026-24367WordPress Traveler theme < 3.2.8 - SQL Injection vulnerabilityshinetheme Traveler
- CVE-2026-23978WordPress Gyan Elements plugin <= 2.2.1 - Local File Inclusion vulnerabilitySoftwebmedia Gyan Elements
- CVE-2026-23975WordPress Golo theme < 1.7.5 - Local File Inclusion vulnerabilityuxper Golo
- CVE-2026-22470WordPress FireStorm Professional Real Estate plugin <= 2.7.11 - SQL Injection vulnerabilityFireStorm Plugins FireStorm Professional Real Estate
- CVE-2026-22464WordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerabilitywphocus My auctions allegro
- CVE-2026-22402WordPress Triply theme <= 2.4.7 - Local File Inclusion vulnerabilitypavothemes Triply
- CVE-2026-22401WordPress Freshio theme <= 2.4.2 - Local File Inclusion vulnerabilitypavothemes Freshio
- CVE-2026-22355WordPress Simple XML Sitemap plugin <= 1.3 - CSRF to Stored XSS vulnerabilitygregmolnar Simple XML Sitemap
- CVE-2025-69321WordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Spa
- CVE-2025-69320WordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Magazine
- CVE-2025-69319WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerabilityBeaver Builder
- CVE-2025-69318WordPress JobWP plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerabilityHossni Mubarak JobWP
- CVE-2025-69317WordPress CarSpot theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityscriptsbundle CarSpot
- CVE-2025-69316WordPress TableOn plugin <= 1.0.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityRealMag777 TableOn
- CVE-2025-69314WordPress Werkstatt theme < 4.8.3 - Local File Inclusion vulnerabilityfuelthemes Werkstatt
- CVE-2025-69313WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerabilityWPXPO PostX
- CVE-2025-69311WordPress Broadstreet Ads plugin <= 1.52.1 - Broken Access Control vulnerabilityBroadstreet Ads
- CVE-2025-69293WordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerabilitye-plugins Final User
- CVE-2025-69292WordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerabilitye-plugins WP Membership
- CVE-2025-69193WordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerabilitye-plugins WP Membership
- CVE-2025-69192WordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerabilitye-plugins Real Estate Pro
- CVE-2025-69191WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerabilitye-plugins ListingHub
- CVE-2025-69190WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerabilitye-plugins Listihub
- CVE-2025-69188WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerabilitye-plugins fitness-trainer
- CVE-2025-69187WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerabilitye-plugins Final User
- CVE-2025-69186WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerabilitye-plugins Hospital Doctor Directory
- CVE-2025-69185WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerabilitye-plugins Hotel Listing
- CVE-2025-69184WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerabilitye-plugins Institutions Directory
- CVE-2025-69183WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerabilitye-plugins Hospital Doctor Directory
- CVE-2025-69182WordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerabilitye-plugins Institutions Directory
- CVE-2025-69181WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerabilitye-plugins Lawyer Directory
- CVE-2025-69180WordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerabilitythemepassion Ultra Portfolio
- CVE-2025-69102WordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityBoopathi Rajan WP Test Email
- CVE-2025-69100WordPress North theme <= 5.7.5 - Local File Inclusion vulnerabilityfuelthemes North
- CVE-2025-69099WordPress North theme <= 5.7.5 - PHP Object Injection vulnerabilityfuelthemes North
- CVE-2025-69098WordPress Hide My WP plugin <= 6.2.12 - Reflected Cross Site Scripting (XSS) vulnerabilitywpWave Hide My WP
- CVE-2025-69097WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerabilityVibeThemes WPLMS
- CVE-2025-69078WordPress Malta theme <= 1.3.3 - Local File Inclusion vulnerabilityAncoraThemes Malta
- CVE-2025-69077WordPress Hobo theme <= 1.0.10 - Local File Inclusion vulnerabilityAncoraThemes Hobo
- CVE-2025-69076WordPress Modern Housewife theme <= 1.0.12 - Local File Inclusion vulnerabilityAncoraThemes Modern Housewife
- CVE-2025-69075WordPress Yolox theme <= 1.0.15 - Local File Inclusion vulnerabilityAncoraThemes Yolox
- CVE-2025-69074WordPress Pearson Specter theme <= 1.11.3 - Local File Inclusion vulnerabilityAncoraThemes Pearson Specter
- CVE-2025-69073WordPress Piqes theme <= 1.0.11 - Local File Inclusion vulnerabilityAncoraThemes Piqes
- CVE-2025-69072WordPress Prider theme <= 1.1.3.1 - Local File Inclusion vulnerabilityAncoraThemes Prider
- CVE-2025-69071WordPress TanTum theme <= 1.1.13 - Local File Inclusion vulnerabilityAncoraThemes TanTum
- CVE-2025-69070WordPress Tornados theme <= 2.1 - Local File Inclusion vulnerabilityAncoraThemes Tornados
- CVE-2025-69068WordPress Muji theme <= 1.2.0 - Local File Inclusion vulnerabilityAncoraThemes Muji
- CVE-2025-69067WordPress Tails theme <= 1.4.12 - Local File Inclusion vulnerabilityAncoraThemes Tails
- CVE-2025-69066WordPress Indoor Plants theme <= 1.2.7 - Local File Inclusion vulnerabilityAncoraThemes Indoor Plants
- CVE-2025-69065WordPress Snow Mountain theme <= 1.4.3 - Local File Inclusion vulnerabilityAncoraThemes Snow Mountain
- CVE-2025-69064WordPress Pets Land theme <= 1.2.8 - Local File Inclusion vulnerabilityAncoraThemes Pets Land
- CVE-2025-69062WordPress Weedles theme <= 1.1.12 - Local File Inclusion vulnerabilityAncoraThemes Weedles
- CVE-2025-69061WordPress MoveMe theme <= 1.2.15 - Local File Inclusion vulnerabilityAncoraThemes MoveMe
- CVE-2025-69060WordPress uReach theme <= 1.3.3 - Local File Inclusion vulnerabilityAncoraThemes uReach
- CVE-2025-69059WordPress DiveIt theme <= 1.4.3 - Local File Inclusion vulnerabilityAncoraThemes DiveIt
- CVE-2025-69058WordPress PartyMaker theme <= 1.1.15 - Local File Inclusion vulnerabilityAncoraThemes PartyMaker
- CVE-2025-69057WordPress Eldon theme <= 1.0 - Local File Inclusion vulnerabilityEdge-Themes Eldon
- CVE-2025-69056WordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitye-plugins Hotel Listing
- CVE-2025-69054WordPress Super Logos Showcase plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityhighwarden Super Logos Showcase
- CVE-2025-69053WordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Universal Video Player
- CVE-2025-69051WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityCridioStudio ListingPro Reviews
- CVE-2025-69050WordPress Overworld theme <= 1.3 - Local File Inclusion vulnerabilityEdge-Themes Overworld
- CVE-2025-69049WordPress Töbel theme <= 1.6 - Local File Inclusion vulnerabilityElated-Themes Töbel
- CVE-2025-69048WordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Universal Video Player
- CVE-2025-69047WordPress MaxShop theme <= 3.6.20 - Local File Inclusion vulnerabilitymagentech MaxShop
- CVE-2025-69046WordPress iRecco Core plugin <= 1.3.6 - Local File Inclusion vulnerabilityWebGeniusLab iRecco Core
- CVE-2025-69045WordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerabilityFooEvents for WooCommerce
- CVE-2025-69044WordPress Vango theme <= 1.3.3 - Local File Inclusion vulnerabilitygoalthemes Vango
- CVE-2025-69043WordPress Rashy theme <= 1.1.3 - Local File Inclusion vulnerabilitygoalthemes Rashy
- CVE-2025-69042WordPress Lindo theme <= 1.2.5 - Local File Inclusion vulnerabilitygoalthemes Lindo
- CVE-2025-69041WordPress Dekoro theme <= 1.0.7 - Local File Inclusion vulnerabilitygoalthemes Dekoro
- CVE-2025-69040WordPress Bfres theme <= 1.2.1 - Local File Inclusion vulnerabilitygoalthemes Bfres
- CVE-2025-69039WordPress Bailly theme <= 1.3.4 - Local File Inclusion vulnerabilitygoalthemes Bailly
- CVE-2025-69038WordPress Hyori theme <= 1.3.6 - Local File Inclusion vulnerabilitygoalthemes Hyori
- CVE-2025-69037WordPress Pippo theme <= 1.2.3 - Local File Inclusion vulnerabilitygoalthemes Pippo
- CVE-2025-69036WordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerabilitystrongholdthemes Tech Life CPT
- CVE-2025-69035WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerabilityStrongholdthemes Dental Care CPT
- CVE-2025-69005WordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerabilityElated-Themes Search & Go
- CVE-2025-69004WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerabilityXpeedStudio Bajaar - Highly Customizable WooCommerce WordPr…
- CVE-2025-69003WordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityQantumThemes KenthaRadio
- CVE-2025-69002WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerabilitydesignthemes OneLife
- CVE-2025-68999WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerabilityHappyMonster Happy Addons for Elementor
- CVE-2025-68913WordPress Miion theme <= 1.2.7 - Local File Inclusion vulnerabilityzozothemes Miion
- CVE-2025-68912WordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerabilityHarmonic Design HDForms
- CVE-2025-68908WordPress Barberry theme <= 2.9.9.87 - Local File Inclusion vulnerabilitytemash Barberry
- CVE-2025-68907WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerabilityAivahThemes Hostme
- CVE-2025-68906WordPress JNews - Video plugin <= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityjegtheme JNews - Video
- CVE-2025-68905WordPress JNews - Pay Writer plugin <= 11.0.0 - Local File Inclusion vulnerabilityjegtheme JNews - Pay Writer
- CVE-2025-68904WordPress JNews - Frontend Submit plugin <= 11.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityjegtheme JNews - Frontend Submit
- CVE-2025-68903WordPress Anona theme <= 8.0 - PHP Object Injection vulnerabilityAivahThemes Anona
- CVE-2025-68902WordPress Anona theme <= 8.0 - Arbitrary File Download vulnerabilityAivahThemes Anona
- CVE-2025-68901WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerabilityAivahThemes Anona
- CVE-2025-68899WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerabilitydesignthemes Vivagh
- CVE-2025-68894WordPress ShoutOut plugin <= 4.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityshoutoutglobal ShoutOut
- CVE-2025-68884WordPress WP Simple Redirect plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityArevico WP Simple Redirect
- CVE-2025-68883WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityextremeidea bidorbuy Store Integrator
- CVE-2025-68882WordPress Scalenut plugin <= 1.1.5 - Broken Access Control vulnerabilityScalenut
- CVE-2025-68881WordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerabilitySaad Iqbal AppExperts
- CVE-2025-68871WordPress Dooodl plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilitynoCreativity Dooodl
- CVE-2025-68866WordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerabilitywoofer696 Dinatur
- CVE-2025-68864WordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerabilityInfility Global
- CVE-2025-68859WordPress Syntax Highlighter Compress plugin <= 3.0.83.3 - Reflected Cross Site Scripting (XSS) vulnerabilityagmorpheus Syntax Highlighter Compress
- CVE-2025-68858WordPress wpCAS plugin <= 1.07 - Cross Site Scripting (XSS) vulnerabilityCasey Bisson wpCAS
- CVE-2025-68849WordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFrank Corso Quote Master
- CVE-2025-68839WordPress Easy Theme Options plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRemi Corson Easy Theme Options
- CVE-2025-68838WordPress MemberPress Discord Addon plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityexpresstechsoftware MemberPress Discord Addon
- CVE-2025-68835WordPress Ravpage plugin <= 2.33 - Reflected Cross Site Scripting (XSS) vulnerabilitymatiskiba Ravpage
- CVE-2025-68538WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Craft
- CVE-2025-68520WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods DotLife
- CVE-2025-68518WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Hoteller
- CVE-2025-68510WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerabilityThemeGoods Photography
- CVE-2025-68059WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerabilitye-plugins Hotel Listing
- CVE-2025-68058WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerabilitye-plugins Institutions Directory
- CVE-2025-68057WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerabilitye-plugins Hospital Doctor Directory
- CVE-2025-68047WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerabilityArraytics Eventin
- CVE-2025-68041WordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerabilitycodisto Omnichannel for WooCommerce
- CVE-2025-68035WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerabilitytabbyai Tabby Checkout
- CVE-2025-68030WordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerabilityWP Messiah Frontis Blocks
- CVE-2025-68027WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerabilityThemefic Hydra Booking
- CVE-2025-68017WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerabilityAntideo Email Validator
- CVE-2025-68012WordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerabilityDmytro Shteflyuk CodeColorer
- CVE-2025-68011WordPress GLS Shipping for WooCommerce plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerabilityGLS Shipping for WooCommerce
- CVE-2025-68010WordPress Netgsm plugin <= 2.9.63 - Cross Site Scripting (XSS) vulnerabilityNetgsm
- CVE-2025-68008WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitymndpsingh287 WP Mail
- CVE-2025-68004WordPress My Post Order plugin <= 1.2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityKapil Chugh My Post Order
- CVE-2025-67967WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerabilitye-plugins Lawyer Directory
- CVE-2025-67966WordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerabilitye-plugins Lawyer Directory
- CVE-2025-67964WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerabilityfavethemes Homey Core
- CVE-2025-67963WordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerabilityovatheme Movie Booking
- CVE-2025-67960WordPress WorkScout-Core plugin <= 1.7.06 - Cross Site Scripting (XSS) vulnerabilitypurethemes WorkScout-Core
- CVE-2025-67959WordPress WorkScout theme <= 4.1.07 - Cross Site Scripting (XSS) vulnerabilitypurethemes WorkScout
- CVE-2025-67957WordPress Listivo Core plugin <= 2.3.77 - Local File Inclusion vulnerabilityTangibleWP Listivo Core
- CVE-2025-67956WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerabilitywpeverest User Registration
- CVE-2025-67955WordPress MyHome Core plugin <= 4.1.0 - Local File Inclusion vulnerabilityTangibleWP MyHome Core
- CVE-2025-67953WordPress Booking Activities plugin <= 1.16.44 - Privilege Escalation vulnerabilityBooking Activities Team Booking Activities
- CVE-2025-67952WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Tour
- CVE-2025-67949WordPress Hostiko theme < 94.3.6 - Cross Site Scripting (XSS) vulnerabilitydesigningmedia Hostiko
- CVE-2025-67947WordPress AdForest Elementor plugin <= 3.0.11 - Cross Site Scripting (XSS) vulnerabilityscriptsbundle AdForest Elementor
- CVE-2025-67946WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerabilityscriptsbundle AdForest
- CVE-2025-67943WordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerabilitywphocus My auctions allegro
- CVE-2025-67941WordPress The Aisle theme < 2.9.1 - Local File Inclusion vulnerabilityElated-Themes The Aisle
- CVE-2025-67940WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerabilityMikado-Themes Powerlift
- CVE-2025-67938WordPress Biagiotti theme < 3.5.2 - Local File Inclusion vulnerabilityMikado-Themes Biagiotti
- CVE-2025-67923WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2025-67620WordPress Anon theme <= 2.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityCleverSoft Anon
- CVE-2025-67619WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerabilitydesignthemes Kids Heaven
- CVE-2025-67616WordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerabilityBZOTheme Mella
- CVE-2025-67615WordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerabilitybslthemes Myour
- CVE-2025-67614WordPress TheNa theme <= 1.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityforeverpinetree TheNa
- CVE-2025-63017WordPress WerkStatt plugin plugin <= 1.6.6 - Local File Inclusion vulnerabilityfuelthemes WerkStatt Plugin
- CVE-2025-54003WordPress Depot theme <= 1.16 - Local File Inclusion vulnerabilityMikado-Themes Depot
- CVE-2025-53240WordPress WordPress Photo Gallery plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerabilityadamlabs WordPress Photo Gallery
- CVE-2025-52762WordPress flexo-posts-manager Plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerabilityflexostudio flexo-posts-manager
- CVE-2025-52746WordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerabilityayecode Restaurante
- CVE-2025-50007WordPress xSmart theme <= 1.2.9.4 - Privilege Escalation vulnerabilityJthemes xSmart
- CVE-2025-50006WordPress xSmart theme <= 1.2.9.4 - Reflected Cross Site Scripting (XSS) vulnerabilityJthemes xSmart
- CVE-2025-50004WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerabilityartbees JupiterX Core
- CVE-2025-50003WordPress Amuli theme <= 2.3.0 - Local File Inclusion vulnerabilityaxiomthemes Amuli
- CVE-2025-49994WordPress Athens theme <= 1.1.6 - Local File Inclusion vulnerabilityovatheme Athens
- CVE-2025-49249WordPress Drone theme <= 1.40 - Reflected Cross Site Scripting (XSS) vulnerabilityApusTheme Drone
- CVE-2025-49066WordPress Accordion Slider PRO plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Accordion Slider PRO
- CVE-2025-49050WordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerabilitykamleshyadav WP Lead Capturing Pages
- CVE-2025-49049WordPress DZS Video Gallery plugin <= 12.39 - SQL Injection vulnerabilityZoomIt DZS Video Gallery
- CVE-2025-49046WordPress xPromoter plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup xPromoter
- CVE-2025-49045WordPress Super Interactive Maps plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityhighwarden Super Interactive Maps
- CVE-2025-49043WordPress Magic Responsive Slider and Carousel WordPress plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Magic Responsive Slider and Carousel WordPress
- CVE-2025-48094WordPress Magic Slider plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Magic Slider
- CVE-2025-47666WordPress Image&Video FullScreen Background plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup Image&Video FullScreen Background
- CVE-2025-47474WordPress Anarkali theme <= 1.0.9 - Local File Inclusion vulnerabilityNinetheme Anarkali
- CVE-2025-32123WordPress HTML5 Video Player with Playlist & Multiple Skins plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup HTML5 Video Player with Playlist & Multiple Sk…
- CVE-2025-27005WordPress HTML5 Video Player plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityLambertGroup HTML5 Video Player
- CVE-2026-23763VB-Audio Matrix Drivers Local Privilege Escalation via Kernel Memory ExposureVB-Audio Software Matrix
- CVE-2026-22278Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability.Dell PowerScale OneFS
- CVE-2025-36588Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL InjDell Unisphere for PowerMax
- CVE-2026-24009Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usagedocling-project docling-core · docling-core
- CVE-2025-65098Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization BypassbaptisteArno typebot.io · @typebot.io/js
- CVE-2026-1329Tenda AX1803 WifiGuestSet fromGetWifiGuestBasic stack-based overflowTenda AX1803
- CVE-2026-1328Totolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflowTotolink NR1800X
- CVE-2025-13928Incorrect Authorization in GitLabGitLab
- CVE-2025-13927Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-0723Unchecked Return Value in GitLabGitLab
- CVE-2026-1324Sangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injectionSangfor Operation and Maintenance Management System
- CVE-2025-14295Automated Logic WebCTRL and Carrier i-Vu Session FixationAutomated Logic WebCTRL · Carrier i-Vu
- CVE-2025-10856Arbitrary File Upload in Solvera Software's TeknoeraSolvera Software Services Trade Teknoera
- CVE-2025-10855IDOR in Solvera Software's TeknoeraSolvera Software Services Trade Teknoera
- CVE-2025-10024IDOR in EXERT Computer Technologies' Education Management SystemEXERT Computer Technologies Software Ltd. Education Managem…
- CVE-2025-4764SQLi in Aida Computer's HotspotAida Computer Information Technology Hotel Guest Hotspot
- CVE-2026-1330HAMASTAR Technology｜MeetingHub - Arbitrary File ReadHAMASTAR Technology MeetingHub
- CVE-2026-24049wheel Allows Arbitrary File Permission Modification via Path Traversalpypa wheel · wheel
- CVE-2026-24038Horilla HR has 2FA Bypass through its OTP Handling Logichorilla-opensource horilla
- CVE-2026-24010Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeoverhorilla-opensource horilla
- CVE-2026-24006Seroval affected by Denial of Service via Deeply Nested Objectslxsmnsyc seroval · seroval
- CVE-2026-23965sm-crypto Affected by Signature Forgery in SM2-DSAJuneAndGreen sm-crypto · sm-crypto
- CVE-2026-23967sm-crypto Affected by Signature Malleability in SM2-DSAJuneAndGreen sm-crypto · sm-crypto
- CVE-2026-23962Mastodon vulnerable to Denial of Service from a single post (client/server)mastodon
- CVE-2026-23958DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeoverdataease
- CVE-2026-23699AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability.Ruijie Networks Co. AP180(JA) V1.xx · Ruijie Networks Co… +7
- CVE-2025-27380HTML Injection Leading to Script Execution in Altium Enterprise ServerAltium AES
- CVE-2026-23957seroval is vulnerable to Denial of Service via array serializationlxsmnsyc seroval · seroval
- CVE-2026-23956seroval affected by Denial of Service via RegExp serializationlxsmnsyc seroval · seroval
- CVE-2025-27378SQL Injection in AES Due to Inactive SQL Parsing ConfigurationAltium AES
- CVE-2025-56589A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the
- CVE-2025-66428An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.
- CVE-2025-67221The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.orjson
- CVE-2025-69821An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connecti
- CVE-2025-69822An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate priv
Medium, low and unrated 173
- CVE-2025-9290Authentication Weakness on Omada Controllers, Gateways and Access PointsTP-Link Systems Omada Software Controller · TP-Link Syst… +7
- CVE-2026-24130Moonraker with LDAP Enabled Allows Malicious Search Filter InjectionArksine moonraker · moonraker
- CVE-2025-25051AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a PasswordAutomationDirect CLICK Programmable Logic Controller
- CVE-2025-67652AutomationDirect CLICK Programmable Logic Controller Weak Encoding for PasswordAutomationDirect CLICK Programmable Logic Controller
- CVE-2026-24117Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLsigstore rekor · github.com/sigstore/rekor
- CVE-2026-20904Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changesGitea Open Source Git Server · github.com/go-gitea/gitea +1
- CVE-2026-20888Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)Gitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-20883Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information DisclosureGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-20800Notification API Leaks Private Repository Issue Titles After Collaborator Permission RevocationGitea Open Source Git Server · github.com/go-gitea/gitea +1
- CVE-2026-0798Gitea Release Email Notifications Leak Private Repository Release Details After Access RevocationGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2025-9289Cross-Site Scripting (XSS) on Omada ControllersTP-Link Systems Omada Software Controller · TP-Link Syst… +1
- CVE-2026-23831Rekor COSE v0.0.1 Canonicalize crashes when passed empty Messagesigstore rekor · github.com/sigstore/rekor
- CVE-2025-22234Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigationSpring Security · org.springframework.security:spring-secur…
- CVE-2026-22281Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starDell PowerScale OneFS
- CVE-2025-68609Authentication bypass in Aries due to misconfigurationcom.palantir.aries:aries
- CVE-2026-22280Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starDell PowerScale OneFS
- CVE-2026-22279Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability.Dell PowerScale OneFS
- CVE-2026-22359WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityAA-Team Wordpress Movies Bulk Importer
- CVE-2026-24389WordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityWP Chill Gallery PhotoBlocks
- CVE-2026-24388WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerabilityLudwig You WPMasterToolKit
- CVE-2026-24387WordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerabilityArul Prasad J WP Quick Post Duplicator
- CVE-2026-24386WordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerabilityElement Invader – Template Kits for Elementor
- CVE-2026-24384WordPress Merge + Minify + Refresh plugin <= 2.14 - Cross Site Request Forgery (CSRF) vulnerabilitylaunchinteractive Merge + Minify + Refresh
- CVE-2026-24383WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilitybPlugins B Slider
- CVE-2026-24381WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerabilityThemeGoods PhotoMe
- CVE-2026-24380WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerabilityMetagauss EventPrime
- CVE-2026-24379WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerabilitywpjobportal WP Job Portal
- CVE-2026-24377WordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exposure vulnerabilityPOSIMYTH Nexter Blocks
- CVE-2026-24374WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss RegistrationMagic
- CVE-2026-24371WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerabilitybookingalgorithms BA Book Everything
- CVE-2026-24368WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerabilityThemeOne The Grid
- CVE-2026-24366WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerabilityYITHEMES YITH WooCommerce Request A Quote
- CVE-2026-24365WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerabilitystoreapps Stock Manager for WooCommerce
- CVE-2026-24361WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerabilityThimPress LearnPress – Course Review
- CVE-2026-24360WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2026-24358WordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2026-24357WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerabilityBrecht WP Recipe Maker
- CVE-2026-24356WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerabilityRoxnor GetGenie
- CVE-2026-24355WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez Theme - Functionality
- CVE-2026-24354WordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Shortcodes & Performance
- CVE-2026-24353WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerabilitywpeverest User Registration
- CVE-2026-23976WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerabilityWP Chill Modula Image Gallery
- CVE-2026-23974WordPress Golo theme < 1.7.5 - Broken Access Control vulnerabilityuxper Golo
- CVE-2026-22483WordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerabilitywinkm89 teachPress
- CVE-2026-22482WordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerabilitywbolt.com IMGspider
- CVE-2026-22481WordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerabilityRasedul Haque Rumi BD Courier Order Ratio Checker
- CVE-2026-22472WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerabilityhassantafreshi Easy Form Builder
- CVE-2026-22469WordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerabilitymwtemplates DeepDigital
- CVE-2026-22468WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerabilityAbsolutePlugins Absolute Addons For Elementor
- CVE-2026-22466WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerabilityChandni Patel WP MapIt
- CVE-2026-22463WordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityMicro.company Form to Chat App
- CVE-2026-22462WordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerabilityrichardevcom Add Polylang support for Customizer
- CVE-2026-22461WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerabilityWebAppick CTX Feed
- CVE-2026-22458WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerabilityMikado-Themes Wanderland
- CVE-2026-22450WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerabilitySelect-Themes Don Peppe
- CVE-2026-22447WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerabilitySelect-Themes Prowess
- CVE-2026-22445WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerabilityProptech Plugin Apimo Connector
- CVE-2026-22430WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Verdure
- CVE-2026-22426WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerabilityElated-Themes Sweet Jane
- CVE-2026-22411WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Dolcino
- CVE-2026-22409WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Justicia
- CVE-2026-22407WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Roam
- CVE-2026-22406WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Overton
- CVE-2026-22404WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Innovio
- CVE-2026-22400WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Holmes
- CVE-2026-22398WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Fleur
- CVE-2026-22396WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Fiorello
- CVE-2026-22393WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Curly
- CVE-2026-22391WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Cocco
- CVE-2026-22388WordPress Owl Carousel WP plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityImran Emu Owl Carousel WP
- CVE-2026-22382WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerabilityMikado-Themes PawFriends - Pet Shop and Veterinary WordPres…
- CVE-2026-22360WordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilityAA-Team SearchAzon
- CVE-2026-22358WordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerabilitySmartDataSoft Electrician - Electrical Service WordPress
- CVE-2026-22353WordPress teachPress plugin <= 9.0.12 - Cross Site Scripting (XSS) vulnerabilitywinkm89 teachPress
- CVE-2026-22349WordPress Menu In Post plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilitylinux4me2 Menu In Post
- CVE-2026-22348WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerabilityTasos Fel Civic Cookie Control
- CVE-2026-22347WordPress Carousel Horizontal Posts Content Slider plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerabilitysubhansanjaya Carousel Horizontal Posts Content Slider
- CVE-2025-69315WordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerabilityNSquared Simply Schedule Appointments
- CVE-2025-69300WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2025-69095WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerabilitydesignthemes Reservation Plugin
- CVE-2025-69055WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerabilitySeaTheme BM Content Builder
- CVE-2025-69001WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerabilityShahjahan Jewel FluentForm
- CVE-2025-68911WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerabilitysolacewp Solace
- CVE-2025-68900WordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerabilityKriesi Enfold
- CVE-2025-68898WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilitycjjparadoxmax Synergy Project Manager
- CVE-2025-68896WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerabilityvrpr WDV One Page Docs
- CVE-2025-68558WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerabilityaverta Depicter Slider
- CVE-2025-68507WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerabilityIcegram
- CVE-2025-68073WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerabilityNinja Team GDPR CCPA Compliance Support
- CVE-2025-68072WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerabilityMerv Barrett Easy Property Listings
- CVE-2025-68046WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerabilityThemeHunk Contact Form & Lead Form Elementor Builder
- CVE-2025-68039WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerabilityChris Simmons WP BackItUp
- CVE-2025-68020WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerabilityWANotifier Notifier
- CVE-2025-68019WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerabilitycleverplugins SEO Booster
- CVE-2025-68016WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerabilityOnepay Sri Lanka onepay Payment Gateway For WooCommerce
- CVE-2025-68013WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerabilitycardpaysolutions Payment Gateway Authorize.Net CIM for WooC…
- CVE-2025-68009WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerabilityCodeless Slider Templates
- CVE-2025-68007WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerabilityEvent Espresso 4 Decaf
- CVE-2025-68006WordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerabilityDeetronix Booking Ultra Pro
- CVE-2025-68003WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerabilityrenatoatshown Shown Connector
- CVE-2025-67961WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerabilityMarco van Wieren WPO365
- CVE-2025-67958WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerabilityTaxCloud for WooCommerce
- CVE-2025-67954WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerabilityDimitri Grassi Salon booking system
- CVE-2025-67942WordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerabilitypeachpayments Peach Payments Gateway
- CVE-2025-67939WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerabilityTickera
- CVE-2025-67626WordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilityAngel Costa WP SEO Search
- CVE-2025-66143WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerabilitymerkulove Crumber
- CVE-2025-66142WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerabilitymerkulove Comparimager for Elementor
- CVE-2025-66141WordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerabilitymerkulove Scroller
- CVE-2025-66140WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerabilitymerkulove Uper for Elementor
- CVE-2025-66139WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilitymerkulove Audier For Elementor
- CVE-2025-66138WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerabilitymerkulove Motionger for Elementor
- CVE-2025-66137WordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerabilitymerkulove Searcher for Elementor
- CVE-2025-66136WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerabilitymerkulove Carter for Elementor
- CVE-2025-66135WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerabilitymerkulove Imager for Elementor
- CVE-2025-64252WordPress ANAC XML Viewer plugin <= 1.8.2 - Server Side Request Forgery (SSRF) vulnerabilityMarco Milesi ANAC XML Viewer
- CVE-2025-63051WordPress REHub Framework plugin < 19.9.9.4 - Sensitive Data Exposure vulnerabilitysizam REHub Framework
- CVE-2025-63026WordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Restaurant Theme Elements for Elementor
- CVE-2025-63019WordPress Cookies and Content Security Policy plugin <= 2.34 - Sensitive Data Exposure vulnerabilityJohan Jonk Stenström Cookies and Content Security Policy
- CVE-2025-63018WordPress Bard theme <= 2.229 - Broken Access Control vulnerabilitywproyal Bard
- CVE-2025-62754WordPress Payment Gateway bKash for WC plugin <= 3.1.0 - Broken Access Control vulnerabilityKapil Paul Payment Gateway bKash for WC
- CVE-2025-62741WordPress Pool Services theme <= 3.3 - Server Side Request Forgery (SSRF) vulnerabilitySmartDataSoft Pool Services
- CVE-2025-62106WordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerabilityMario Peshev WP-CRM System
- CVE-2025-62077WordPress Affiliate Link Tracker plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilitySEOSEON EUROPE S.L Affiliate Link Tracker
- CVE-2025-5805WordPress Electron theme <= 1.8.2 - Broken Access Control vulnerabilityNinetheme Electron
- CVE-2025-54002WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerabilityJthemes xSmart
- CVE-2025-50005WordPress tagDiv Composer plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerabilitytagDiv Composer
- CVE-2025-49375WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerabilitycozythemes HomeLancer
- CVE-2025-49336WordPress Pondol BBS plugin <= 1.1.8.4 - Cross Site Scripting (XSS) vulnerabilityPondol BBS
- CVE-2025-47600WordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerabilityxtemos WoodMart
- CVE-2025-47555WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Tutor LMS
- CVE-2025-47500WordPress Stackable plugin <= 3.19.5 - Cross Site Scripting (XSS) vulnerabilityBenjamin Intal Stackable
- CVE-2025-31413WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerabilitybdthemes Element Pack Elementor Addons
- CVE-2026-23761VB-Audio Voicemeeter & Matrix Drivers DoS via Improper FILE_OBJECT FsContext InitializationVB-Audio Software Voicemeeter · VB-Audio Software Matrix
- CVE-2026-23762VB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCacheVB-Audio Software Voicemeeter · VB-Audio Software Matrix
- CVE-2026-23764VB-Audio Voicemeeter & Matrix Drivers DoS via Corrupted IoAllocateMdl LengthVB-Audio Software Voicemeeter · VB-Audio Software Matrix
- CVE-2025-32057Misconfigured SSL/TLS communication of Redbend service for Infotainment ECUBosch Infotainment system ECU
- CVE-2025-32056Anti-Theft Bypass for Infotainment ECUBosch Infotainment system ECU
- CVE-2025-15523TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.appInkscape
- CVE-2026-1327Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injectionTotolink NR1800X
- CVE-2026-1102Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-1326Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injectionTotolink NR1800X
- CVE-2025-12738Enumeration of restricted property valueneo4j Enterprise Edition
- CVE-2026-1325Sangfor Operation and Maintenance Security Management System edit_pwd_mall password recoverySangfor Operation and Maintenance Security Management System
- CVE-2025-67683Reflected XSS in Quick.CartOpenSolution Quick.Cart
- CVE-2025-13335Loop with Unreachable Exit Condition ('Infinite Loop') in GitLabGitLab
- CVE-2026-1225Malicious logback.xml configuration file allows instantiation of arbitrary classesQOS.CH Sarl Logback-core · ch.qos.logback:logback-core
- CVE-2026-1332HAMASTAR Technology｜MeetingHub - Missing AuthenticationHAMASTAR Technology MeetingHub
- CVE-2025-4763XSS in Aida Computer's HotspotAida Computer Information Technology Hotel Guest Hotspot
- CVE-2026-24332Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because Discord WebSocket API service
- CVE-2025-71176pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial opytest
- CVE-2026-24039Horilla's Improper Access Control Allows Employees to Auto-Approve Documentshorilla-opensource horilla
- CVE-2026-24037Horilla HRM has XSS Bypass through Project Namehorilla-opensource horilla
- CVE-2026-24036Horilla Exposes Unpublished Job Disclosures through Unauthenticated APIhorilla-opensource horilla
- CVE-2026-24055Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linkinglangfuse
- CVE-2026-24035Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employeehorilla-opensource horilla
- CVE-2026-24034Horilla has File Upload XSShorilla-opensource horilla
- CVE-2026-24001jsdiff has a Denial of Service vulnerability in parsePatch and applyPatchkpdecker jsdiff · diff
- CVE-2026-23992go-tuf improperly validates the configured threshold for delegationstheupdateframework go-tuf · github.com/theupdateframework/g…
- CVE-2026-23991go-tuf affected by client DoS via malformed server responsetheupdateframework go-tuf · github.com/theupdateframework/g…
- CVE-2026-23959CoreShop Vulnerable to SQL Injection via Admin customer-company-modifierCoreShop · coreshop/core-shop
- CVE-2026-23964Mastodon has insufficient access control to push notification settingsmastodon
- CVE-2026-23963Mastodon missing length limits on list names, filter names, and filter keywordsmastodon
- CVE-2026-23961Mastodon may allow a remote suspension bypassmastodon
- CVE-2025-27379Stored Cross-Site Scripting in AES BOM ViewerAltium AES
- CVE-2026-23952ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image loadImageMagick · Magick.NET-Q8-x64 +18
- CVE-2026-23951SumatraPDF's Integer Underflow in PalmDbReader Leads to Crashsumatrapdfreader sumatrapdf
- CVE-2025-27377Missing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle AttacksAltium Designer
- CVE-2026-23946Tendenci has Authenticated Remote Code Execution via Pickle Deserializationtendenci
- CVE-2026-23893openCryptoki has improper link resolution before file access (link following)opencryptoki
- CVE-2025-69612A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.
- CVE-2025-69820Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath fungithub.com/beam-cloud/beta9 · aws/aws-sdk-php
- CVE-2025-70899PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms.