# CVEs published 2026-01-22

443 CVEs were published on January 22, 2026: 41 critical, 229 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-20613](https://cve.now/CVE-2026-20613.md): The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extract (CVSS 7.8, Apple Container · Apple Containerization)
- [CVE-2026-24132](https://cve.now/CVE-2026-24132.md): Orval Mock Generation Code Injection via const (CVSS 7.7, orval-labs orval · @orval/mock)
- [CVE-2025-9290](https://cve.now/CVE-2025-9290.md): Authentication Weakness on Omada Controllers, Gateways and Access Points (CVSS 6.0, TP-Link Systems Omada Software Controller · TP-Link Syst… +7)
- [CVE-2026-24130](https://cve.now/CVE-2026-24130.md): Moonraker with LDAP Enabled Allows Malicious Search Filter Injection (CVSS 2.7, Arksine moonraker · moonraker)
- [CVE-2026-21264](https://cve.now/CVE-2026-21264.md): Microsoft Account Spoofing Vulnerability (CVSS 9.3, Microsoft Account)
- [CVE-2026-21521](https://cve.now/CVE-2026-21521.md): Word Copilot Information Disclosure Vulnerability (CVSS 7.4, Microsoft 365 Word Copilot)
- [CVE-2026-21227](https://cve.now/CVE-2026-21227.md): Azure Logic Apps Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Azure Logic Apps)
- [CVE-2026-24307](https://cve.now/CVE-2026-24307.md): M365 Copilot Information Disclosure Vulnerability (CVSS 9.3, Microsoft 365 Copilot)
- [CVE-2026-24305](https://cve.now/CVE-2026-24305.md): Azure Entra ID Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Entra)
- [CVE-2026-21524](https://cve.now/CVE-2026-21524.md): Azure Data Explorer Information Disclosure Vulnerability (CVSS 7.4, Microsoft Azure Data Explorer)
- [CVE-2026-24306](https://cve.now/CVE-2026-24306.md): Azure Front Door Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Azure Front Door)
- [CVE-2026-21520](https://cve.now/CVE-2026-21520.md): Copilot Studio Information Disclosure Vulnerability (CVSS 7.5, Microsoft Copilot Studio)
- [CVE-2026-24129](https://cve.now/CVE-2026-24129.md): Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution (CVSS 8.1, runtipi)
- [CVE-2025-54816](https://cve.now/CVE-2025-54816.md): EVMAPA Missing Authentication for Critical Function (CVSS 9.4, EVMAPA)
- [CVE-2025-53968](https://cve.now/CVE-2025-53968.md): EVMAPA Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, EVMAPA)
- [CVE-2025-55705](https://cve.now/CVE-2025-55705.md): EVMAPA Insufficient Session Expiration (CVSS 7.3, EVMAPA)
- [CVE-2025-25051](https://cve.now/CVE-2025-25051.md): AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password (CVSS 6.1, AutomationDirect CLICK Programmable Logic Controller)
- [CVE-2026-24124](https://cve.now/CVE-2026-24124.md): Dragonfly Manager Job API Allows Unauthenticated Access (CVSS 8.9, dragonflyoss dragonfly · d7y.io/dragonfly/v2)
- [CVE-2025-67652](https://cve.now/CVE-2025-67652.md): AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password (CVSS 6.1, AutomationDirect CLICK Programmable Logic Controller)
- [CVE-2026-24117](https://cve.now/CVE-2026-24117.md): Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL (CVSS 5.3, sigstore rekor · github.com/sigstore/rekor)
- [CVE-2026-20912](https://cve.now/CVE-2026-20912.md): Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure (CVSS 9.1, Gitea Open Source Git Server · github.com/go-gitea/gitea +1)
- [CVE-2026-20904](https://cve.now/CVE-2026-20904.md): Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes (CVSS 6.5, Gitea Open Source Git Server · github.com/go-gitea/gitea +1)
- [CVE-2026-20897](https://cve.now/CVE-2026-20897.md): Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) (CVSS 9.1, Gitea Open Source Git Server · github.com/go-gitea/gitea +1)
- [CVE-2026-20888](https://cve.now/CVE-2026-20888.md): Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) (CVSS 4.3, Gitea Open Source Git Server · code.gitea.io/gitea +1)
- [CVE-2026-20883](https://cve.now/CVE-2026-20883.md): Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure (CVSS 6.5, Gitea Open Source Git Server · code.gitea.io/gitea +1)
- [CVE-2026-20800](https://cve.now/CVE-2026-20800.md): Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation (CVSS 6.5, Gitea Open Source Git Server · github.com/go-gitea/gitea +1)
- [CVE-2026-20750](https://cve.now/CVE-2026-20750.md): Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) (CVSS 9.1, Gitea Open Source Git Server · github.com/go-gitea/gitea +1)
- [CVE-2026-20736](https://cve.now/CVE-2026-20736.md): Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-0798](https://cve.now/CVE-2026-0798.md): Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation (CVSS 3.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-24058](https://cve.now/CVE-2026-24058.md): Soft Serve has Critical Authentication Bypass (CVSS 8.1, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2026-23988](https://cve.now/CVE-2026-23988.md): Rufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling (CVSS 7.3, pbatard rufus)
- [CVE-2026-1201](https://cve.now/CVE-2026-1201.md): Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs (CVSS 9.4, Hubitat Elevation C3 · Hubitat Elevation C4 +3)
- [CVE-2025-9289](https://cve.now/CVE-2025-9289.md): Cross-Site Scripting (XSS) on Omada Controllers (CVSS 5.7, TP-Link Systems Omada Software Controller · TP-Link Syst… +1)
- [CVE-2026-23954](https://cve.now/CVE-2026-23954.md): Incus container image templating arbitrary host file read and write (CVSS 8.7, lxc incus · github.com/lxc/incus/v6/cmd/incusd +2)
- [CVE-2025-14751](https://cve.now/CVE-2025-14751.md): Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service (CVSS 8.7, Weintek cMT3072XH · Weintek cMT-SVRX-820 +1)
- [CVE-2025-14750](https://cve.now/CVE-2025-14750.md): External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service (CVSS 8.7, Weintek cMT3072XH · Weintek cMT-SVRX-820 +1)
- [CVE-2026-23953](https://cve.now/CVE-2026-23953.md): Incus container environment configuration newline injection (CVSS 8.7, lxc incus · github.com/lxc/incus/v6 +1)
- [CVE-2026-23831](https://cve.now/CVE-2026-23831.md): Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message (CVSS 5.3, sigstore rekor · github.com/sigstore/rekor)
- [CVE-2025-22234](https://cve.now/CVE-2025-22234.md): Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation (CVSS 5.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22281](https://cve.now/CVE-2026-22281.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions star (CVSS 3.5, Dell PowerScale OneFS)
- [CVE-2025-68609](https://cve.now/CVE-2025-68609.md): Authentication bypass in Aries due to misconfiguration (CVSS 6.6, com.palantir.aries:aries)
- [CVE-2026-22280](https://cve.now/CVE-2026-22280.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions star (CVSS 5.0, Dell PowerScale OneFS)
- [CVE-2026-22279](https://cve.now/CVE-2026-22279.md): Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. (CVSS 4.3, Dell PowerScale OneFS)
- [CVE-2026-1260](https://cve.now/CVE-2026-1260.md): Invalid Memory Access in Sentencepiece, (CVSS 8.5, Google Sentencepiece · sentencepiece)
- [CVE-2026-0535](https://cve.now/CVE-2026-0535.md): Stored XSS in Electronic Library Component Description (CVSS 8.1, Autodesk Fusion)
- [CVE-2026-0534](https://cve.now/CVE-2026-0534.md): Stored XSS in the value of a part attribute (CVSS 8.1, Autodesk Fusion)
- [CVE-2026-0533](https://cve.now/CVE-2026-0533.md): Stored XSS in Fusion desktop when attempting to delete a file (CVSS 8.1, Autodesk Fusion)
- [CVE-2026-22359](https://cve.now/CVE-2026-22359.md): WordPress Wordpress Movies Bulk Importer plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AA-Team Wordpress Movies Bulk Importer)
- [CVE-2023-7335](https://cve.now/CVE-2023-7335.md): EduSoho \< 22.4.7 Arbitrary File Read via classroom-course-statistics (CVSS 8.7, Hangzhou Kuozhi Network Technology Co. EduSoho)
- [CVE-2026-24390](https://cve.now/CVE-2026-24390.md): WordPress Kentha Elementor Widgets plugin \< 3.1 - Local File Inclusion vulnerability (CVSS 7.5, QantumThemes Kentha Elementor Widgets)
- [CVE-2026-24389](https://cve.now/CVE-2026-24389.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Chill Gallery PhotoBlocks)
- [CVE-2026-24388](https://cve.now/CVE-2026-24388.md): WordPress WPMasterToolKit plugin \<= 2.14.0 - Broken Access Control vulnerability (CVSS 4.3, Ludwig You WPMasterToolKit)
- [CVE-2026-24387](https://cve.now/CVE-2026-24387.md): WordPress WP Quick Post Duplicator plugin \<= 2.1 - Broken Access Control vulnerability (CVSS 4.3, Arul Prasad J WP Quick Post Duplicator)
- [CVE-2026-24386](https://cve.now/CVE-2026-24386.md): WordPress Element Invader – Template Kits for Elementor plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 4.3, Element Invader – Template Kits for Elementor)
- [CVE-2026-24384](https://cve.now/CVE-2026-24384.md): WordPress Merge + Minify + Refresh plugin \<= 2.14 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, launchinteractive Merge + Minify + Refresh)
- [CVE-2026-24383](https://cve.now/CVE-2026-24383.md): WordPress B Slider plugin \<= 2.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins B Slider)
- [CVE-2026-24381](https://cve.now/CVE-2026-24381.md): WordPress PhotoMe theme \< 5.7.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, ThemeGoods PhotoMe)
- [CVE-2026-24380](https://cve.now/CVE-2026-24380.md): WordPress EventPrime plugin \<= 4.2.8.0 - Broken Access Control vulnerability (CVSS 5.3, Metagauss EventPrime)
- [CVE-2026-24379](https://cve.now/CVE-2026-24379.md): WordPress WP Job Portal plugin \<= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, wpjobportal WP Job Portal)
- [CVE-2026-24377](https://cve.now/CVE-2026-24377.md): WordPress Nexter Blocks plugin \<= 4.6.3 - Sensitive Data Exposure vulnerability (CVSS 4.3, POSIMYTH Nexter Blocks)
- [CVE-2026-24374](https://cve.now/CVE-2026-24374.md): WordPress RegistrationMagic plugin \<= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Metagauss RegistrationMagic)
- [CVE-2026-24371](https://cve.now/CVE-2026-24371.md): WordPress BA Book Everything plugin \<= 1.8.16 - Broken Access Control vulnerability (CVSS 4.3, bookingalgorithms BA Book Everything)
- [CVE-2026-24368](https://cve.now/CVE-2026-24368.md): WordPress The Grid plugin \<= 2.8.0 - Broken Access Control vulnerability (CVSS 5.3, ThemeOne The Grid)
- [CVE-2026-24367](https://cve.now/CVE-2026-24367.md): WordPress Traveler theme \< 3.2.8 - SQL Injection vulnerability (CVSS 8.5, shinetheme Traveler)
- [CVE-2026-24366](https://cve.now/CVE-2026-24366.md): WordPress YITH WooCommerce Request A Quote plugin \<= 2.46.0 - Broken Access Control vulnerability (CVSS 5.3, YITHEMES YITH WooCommerce Request A Quote)
- [CVE-2026-24365](https://cve.now/CVE-2026-24365.md): WordPress Stock Manager for WooCommerce plugin \< 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, storeapps Stock Manager for WooCommerce)
- [CVE-2026-24361](https://cve.now/CVE-2026-24361.md): WordPress LearnPress – Course Review plugin \<= 4.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThimPress LearnPress – Course Review)
- [CVE-2026-24360](https://cve.now/CVE-2026-24360.md): WordPress Seriously Simple Podcasting plugin \<= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2026-24358](https://cve.now/CVE-2026-24358.md): WordPress Quiz And Survey Master plugin \<= 10.3.3 - Broken Access Control vulnerability (CVSS 4.3, ExpressTech Systems Quiz And Survey Master)
- [CVE-2026-24357](https://cve.now/CVE-2026-24357.md): WordPress WP Recipe Maker plugin \<= 10.2.4 - Broken Access Control vulnerability (CVSS 4.3, Brecht WP Recipe Maker)
- [CVE-2026-24356](https://cve.now/CVE-2026-24356.md): WordPress GetGenie plugin \<= 4.3.0 - Broken Access Control vulnerability (CVSS 4.9, Roxnor GetGenie)
- [CVE-2026-24355](https://cve.now/CVE-2026-24355.md): WordPress Houzez Theme - Functionality plugin \<= 4.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, favethemes Houzez Theme - Functionality)
- [CVE-2026-24354](https://cve.now/CVE-2026-24354.md): WordPress Penci Shortcodes & Performance plugin \<= 6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PenciDesign Penci Shortcodes & Performance)
- [CVE-2026-24353](https://cve.now/CVE-2026-24353.md): WordPress User Registration plugin \<= 4.4.9 - Arbitrary Shortcode Execution vulnerability (CVSS 4.3, wpeverest User Registration)
- [CVE-2026-23978](https://cve.now/CVE-2026-23978.md): WordPress Gyan Elements plugin \<= 2.2.1 - Local File Inclusion vulnerability (CVSS 7.5, Softwebmedia Gyan Elements)
- [CVE-2026-23976](https://cve.now/CVE-2026-23976.md): WordPress Modula Image Gallery plugin \<= 2.13.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Chill Modula Image Gallery)
- [CVE-2026-23975](https://cve.now/CVE-2026-23975.md): WordPress Golo theme \< 1.7.5 - Local File Inclusion vulnerability (CVSS 7.5, uxper Golo)
- [CVE-2026-23974](https://cve.now/CVE-2026-23974.md): WordPress Golo theme \< 1.7.5 - Broken Access Control vulnerability (CVSS 5.3, uxper Golo)
- [CVE-2026-22483](https://cve.now/CVE-2026-22483.md): WordPress teachPress plugin \<= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, winkm89 teachPress)
- [CVE-2026-22482](https://cve.now/CVE-2026-22482.md): WordPress IMGspider plugin \<= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, wbolt.com IMGspider)
- [CVE-2026-22481](https://cve.now/CVE-2026-22481.md): WordPress BD Courier Order Ratio Checker plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 4.3, Rasedul Haque Rumi BD Courier Order Ratio Checker)
- [CVE-2026-22472](https://cve.now/CVE-2026-22472.md): WordPress Easy Form Builder plugin \<= 3.9.6 - Broken Access Control vulnerability (CVSS 4.3, hassantafreshi Easy Form Builder)
- [CVE-2026-22470](https://cve.now/CVE-2026-22470.md): WordPress FireStorm Professional Real Estate plugin \<= 2.7.11 - SQL Injection vulnerability (CVSS 7.6, FireStorm Plugins FireStorm Professional Real Estate)
- [CVE-2026-22469](https://cve.now/CVE-2026-22469.md): WordPress DeepDigital theme \<= 1.0.2 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, mwtemplates DeepDigital)
- [CVE-2026-22468](https://cve.now/CVE-2026-22468.md): WordPress Absolute Addons For Elementor plugin \<= 1.0.14 - Broken Access Control vulnerability (CVSS 4.3, AbsolutePlugins Absolute Addons For Elementor)
- [CVE-2026-22466](https://cve.now/CVE-2026-22466.md): WordPress WP MapIt plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 4.3, Chandni Patel WP MapIt)
- [CVE-2026-22464](https://cve.now/CVE-2026-22464.md): WordPress My auctions allegro plugin \<= 3.6.33 - Local File Inclusion vulnerability (CVSS 7.5, wphocus My auctions allegro)
- [CVE-2026-22463](https://cve.now/CVE-2026-22463.md): WordPress Form to Chat App plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Micro.company Form to Chat App)
- [CVE-2026-22462](https://cve.now/CVE-2026-22462.md): WordPress Add Polylang support for Customizer plugin \<= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, richardevcom Add Polylang support for Customizer)
- [CVE-2026-22461](https://cve.now/CVE-2026-22461.md): WordPress CTX Feed plugin \<= 6.6.18 - Broken Access Control vulnerability (CVSS 5.3, WebAppick CTX Feed)
- [CVE-2026-22458](https://cve.now/CVE-2026-22458.md): WordPress Wanderland theme \<= 1.5 - Broken Access Control vulnerability (CVSS 4.3, Mikado-Themes Wanderland)
- [CVE-2026-22450](https://cve.now/CVE-2026-22450.md): WordPress Don Peppe theme \<= 1.3 - Broken Access Control vulnerability (CVSS 4.3, Select-Themes Don Peppe)
- [CVE-2026-22447](https://cve.now/CVE-2026-22447.md): WordPress Prowess theme \<= 1.8.1 - Broken Access Control vulnerability (CVSS 4.3, Select-Themes Prowess)
- [CVE-2026-22445](https://cve.now/CVE-2026-22445.md): WordPress Apimo Connector plugin \<= 2.6.5.2 - Broken Access Control vulnerability (CVSS 5.3, Proptech Plugin Apimo Connector)
- [CVE-2026-22430](https://cve.now/CVE-2026-22430.md): WordPress Verdure theme \<= 1.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Verdure)
- [CVE-2026-22426](https://cve.now/CVE-2026-22426.md): WordPress Sweet Jane theme \<= 1.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Elated-Themes Sweet Jane)
- [CVE-2026-22411](https://cve.now/CVE-2026-22411.md): WordPress Dolcino theme \<= 1.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Dolcino)
- [CVE-2026-22409](https://cve.now/CVE-2026-22409.md): WordPress Justicia theme \<= 1.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Justicia)
- [CVE-2026-22407](https://cve.now/CVE-2026-22407.md): WordPress Roam theme \<= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Roam)
- [CVE-2026-22406](https://cve.now/CVE-2026-22406.md): WordPress Overton theme \<= 1.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Overton)
- [CVE-2026-22404](https://cve.now/CVE-2026-22404.md): WordPress Innovio theme \<= 1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Innovio)
- [CVE-2026-22402](https://cve.now/CVE-2026-22402.md): WordPress Triply theme \<= 2.4.7 - Local File Inclusion vulnerability (CVSS 7.5, pavothemes Triply)
- [CVE-2026-22401](https://cve.now/CVE-2026-22401.md): WordPress Freshio theme \<= 2.4.2 - Local File Inclusion vulnerability (CVSS 7.5, pavothemes Freshio)
- [CVE-2026-22400](https://cve.now/CVE-2026-22400.md): WordPress Holmes theme \<= 1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Holmes)
- [CVE-2026-22398](https://cve.now/CVE-2026-22398.md): WordPress Fleur theme \<= 2.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Fleur)
- [CVE-2026-22396](https://cve.now/CVE-2026-22396.md): WordPress Fiorello theme \<= 1.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Fiorello)
- [CVE-2026-22393](https://cve.now/CVE-2026-22393.md): WordPress Curly theme \<= 3.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Curly)
- [CVE-2026-22391](https://cve.now/CVE-2026-22391.md): WordPress Cocco theme \<= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Mikado-Themes Cocco)
- [CVE-2026-22388](https://cve.now/CVE-2026-22388.md): WordPress Owl Carousel WP plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Imran Emu Owl Carousel WP)
- [CVE-2026-22382](https://cve.now/CVE-2026-22382.md): WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme \<= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Mikado-Themes PawFriends - Pet Shop and Veterinary WordPres…)
- [CVE-2026-22360](https://cve.now/CVE-2026-22360.md): WordPress SearchAzon plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AA-Team SearchAzon)
- [CVE-2026-22358](https://cve.now/CVE-2026-22358.md): WordPress Electrician - Electrical Service WordPress theme \<= 5.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, SmartDataSoft Electrician - Electrical Service WordPress)
- [CVE-2026-22355](https://cve.now/CVE-2026-22355.md): WordPress Simple XML Sitemap plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, gregmolnar Simple XML Sitemap)
- [CVE-2026-22353](https://cve.now/CVE-2026-22353.md): WordPress teachPress plugin \<= 9.0.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, winkm89 teachPress)
- [CVE-2026-22349](https://cve.now/CVE-2026-22349.md): WordPress Menu In Post plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, linux4me2 Menu In Post)
- [CVE-2026-22348](https://cve.now/CVE-2026-22348.md): WordPress Civic Cookie Control plugin \<= 1.53 - Broken Access Control vulnerability (CVSS 5.3, Tasos Fel Civic Cookie Control)
- [CVE-2026-22347](https://cve.now/CVE-2026-22347.md): WordPress Carousel Horizontal Posts Content Slider plugin \<= 3.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, subhansanjaya Carousel Horizontal Posts Content Slider)
- [CVE-2025-69321](https://cve.now/CVE-2025-69321.md): WordPress Grand Spa theme \<= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Spa)
- [CVE-2025-69320](https://cve.now/CVE-2025-69320.md): WordPress Grand Magazine theme \<= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Magazine)
- [CVE-2025-69319](https://cve.now/CVE-2025-69319.md): WordPress Beaver Builder plugin \<= 2.9.4.1 - Arbitrary Code Execution vulnerability (CVSS 7.5, Beaver Builder)
- [CVE-2025-69318](https://cve.now/CVE-2025-69318.md): WordPress JobWP plugin \<= 2.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hossni Mubarak JobWP)
- [CVE-2025-69317](https://cve.now/CVE-2025-69317.md): WordPress CarSpot theme \< 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scriptsbundle CarSpot)
- [CVE-2025-69316](https://cve.now/CVE-2025-69316.md): WordPress TableOn plugin \<= 1.0.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RealMag777 TableOn)
- [CVE-2025-69315](https://cve.now/CVE-2025-69315.md): WordPress Simply Schedule Appointments plugin \<= 1.6.9.15 - Broken Access Control vulnerability (CVSS 6.5, NSquared Simply Schedule Appointments)
- [CVE-2025-69314](https://cve.now/CVE-2025-69314.md): WordPress Werkstatt theme \< 4.8.3 - Local File Inclusion vulnerability (CVSS 8.1, fuelthemes Werkstatt)
- [CVE-2025-69313](https://cve.now/CVE-2025-69313.md): WordPress PostX plugin \<= 5.0.3 - Broken Access Control vulnerability (CVSS 7.5, WPXPO PostX)
- [CVE-2025-69312](https://cve.now/CVE-2025-69312.md): WordPress Xpro Elementor Addons plugin \<= 1.4.19.1 - Arbitrary File Upload vulnerability (CVSS 9.1, Xpro Elementor Addons)
- [CVE-2025-69311](https://cve.now/CVE-2025-69311.md): WordPress Broadstreet Ads plugin \<= 1.52.1 - Broken Access Control vulnerability (CVSS 7.6, Broadstreet Ads)
- [CVE-2025-69300](https://cve.now/CVE-2025-69300.md): WordPress Premium Addons for Elementor plugin \<= 4.11.63 - Settings Change vulnerability (CVSS 5.4, Leap13 Premium Addons for Elementor)
- [CVE-2025-69293](https://cve.now/CVE-2025-69293.md): WordPress Final User plugin \<= 1.2.5 - Privilege Escalation vulnerability (CVSS 8.8, e-plugins Final User)
- [CVE-2025-69292](https://cve.now/CVE-2025-69292.md): WordPress WP Membership plugin \<= 1.6.4 - Privilege Escalation vulnerability (CVSS 8.8, e-plugins WP Membership)
- [CVE-2025-69193](https://cve.now/CVE-2025-69193.md): WordPress WP Membership plugin \<= 1.6.4 - Broken Access Control vulnerability (CVSS 7.3, e-plugins WP Membership)
- [CVE-2025-69192](https://cve.now/CVE-2025-69192.md): WordPress Real Estate Pro plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Real Estate Pro)
- [CVE-2025-69191](https://cve.now/CVE-2025-69191.md): WordPress ListingHub plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 7.3, e-plugins ListingHub)
- [CVE-2025-69190](https://cve.now/CVE-2025-69190.md): WordPress Listihub theme \<= 1.0.6 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Listihub)
- [CVE-2025-69188](https://cve.now/CVE-2025-69188.md): WordPress fitness-trainer plugin \<= 1.7.1 - Broken Access Control vulnerability (CVSS 7.3, e-plugins fitness-trainer)
- [CVE-2025-69187](https://cve.now/CVE-2025-69187.md): WordPress Final User plugin \<= 1.2.5 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Final User)
- [CVE-2025-69186](https://cve.now/CVE-2025-69186.md): WordPress Hospital Doctor Directory plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Hospital Doctor Directory)
- [CVE-2025-69185](https://cve.now/CVE-2025-69185.md): WordPress Hotel Listing plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Hotel Listing)
- [CVE-2025-69184](https://cve.now/CVE-2025-69184.md): WordPress Institutions Directory plugin \<= 1.3.4 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Institutions Directory)
- [CVE-2025-69183](https://cve.now/CVE-2025-69183.md): WordPress Hospital Doctor Directory plugin \<= 1.3.9 - Privilege Escalation vulnerability (CVSS 8.8, e-plugins Hospital Doctor Directory)
- [CVE-2025-69182](https://cve.now/CVE-2025-69182.md): WordPress Institutions Directory plugin \<= 1.3.4 - Privilege Escalation vulnerability (CVSS 8.8, e-plugins Institutions Directory)
- [CVE-2025-69181](https://cve.now/CVE-2025-69181.md): WordPress Lawyer Directory plugin \<= 1.3.4 - Broken Access Control vulnerability (CVSS 7.3, e-plugins Lawyer Directory)
- [CVE-2025-69180](https://cve.now/CVE-2025-69180.md): WordPress Ultra Portfolio plugin \<= 6.7 - SQL Injection vulnerability (CVSS 8.5, themepassion Ultra Portfolio)
- [CVE-2025-69102](https://cve.now/CVE-2025-69102.md): WordPress WP Test Email plugin \<= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Boopathi Rajan WP Test Email)
- [CVE-2025-69101](https://cve.now/CVE-2025-69101.md): WordPress Workreap Core plugin \<= 3.4.1 - Broken Authentication vulnerability (CVSS 9.8, AmentoTech Workreap Core)
- [CVE-2025-69100](https://cve.now/CVE-2025-69100.md): WordPress North theme \<= 5.7.5 - Local File Inclusion vulnerability (CVSS 8.1, fuelthemes North)
- [CVE-2025-69099](https://cve.now/CVE-2025-69099.md): WordPress North theme \<= 5.7.5 - PHP Object Injection vulnerability (CVSS 8.8, fuelthemes North)
- [CVE-2025-69098](https://cve.now/CVE-2025-69098.md): WordPress Hide My WP plugin \<= 6.2.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpWave Hide My WP)
- [CVE-2025-69097](https://cve.now/CVE-2025-69097.md): WordPress WPLMS plugin \<= 1.9.9.5.4 - Arbitrary File Deletion vulnerability (CVSS 8.6, VibeThemes WPLMS)
- [CVE-2025-69095](https://cve.now/CVE-2025-69095.md): WordPress Reservation Plugin plugin \<= 1.7 - Settings Change vulnerability (CVSS 6.5, designthemes Reservation Plugin)
- [CVE-2025-69079](https://cve.now/CVE-2025-69079.md): WordPress Sound | Musical Instruments Online Store theme \<= 1.6.9 - Deserialization of untrusted data vulnerability (CVSS 9.8, ThemeREX Sound | Musical Instruments Online Store)
- [CVE-2025-69078](https://cve.now/CVE-2025-69078.md): WordPress Malta theme \<= 1.3.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Malta)
- [CVE-2025-69077](https://cve.now/CVE-2025-69077.md): WordPress Hobo theme \<= 1.0.10 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Hobo)
- [CVE-2025-69076](https://cve.now/CVE-2025-69076.md): WordPress Modern Housewife theme \<= 1.0.12 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Modern Housewife)
- [CVE-2025-69075](https://cve.now/CVE-2025-69075.md): WordPress Yolox theme \<= 1.0.15 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Yolox)
- [CVE-2025-69074](https://cve.now/CVE-2025-69074.md): WordPress Pearson Specter theme \<= 1.11.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Pearson Specter)
- [CVE-2025-69073](https://cve.now/CVE-2025-69073.md): WordPress Piqes theme \<= 1.0.11 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Piqes)
- [CVE-2025-69072](https://cve.now/CVE-2025-69072.md): WordPress Prider theme \<= 1.1.3.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Prider)
- [CVE-2025-69071](https://cve.now/CVE-2025-69071.md): WordPress TanTum theme \<= 1.1.13 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes TanTum)
- [CVE-2025-69070](https://cve.now/CVE-2025-69070.md): WordPress Tornados theme \<= 2.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Tornados)
- [CVE-2025-69068](https://cve.now/CVE-2025-69068.md): WordPress Muji theme \<= 1.2.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Muji)
- [CVE-2025-69067](https://cve.now/CVE-2025-69067.md): WordPress Tails theme \<= 1.4.12 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Tails)
- [CVE-2025-69066](https://cve.now/CVE-2025-69066.md): WordPress Indoor Plants theme \<= 1.2.7 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Indoor Plants)
- [CVE-2025-69065](https://cve.now/CVE-2025-69065.md): WordPress Snow Mountain theme \<= 1.4.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Snow Mountain)
- [CVE-2025-69064](https://cve.now/CVE-2025-69064.md): WordPress Pets Land theme \<= 1.2.8 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Pets Land)
- [CVE-2025-69062](https://cve.now/CVE-2025-69062.md): WordPress Weedles theme \<= 1.1.12 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Weedles)
- [CVE-2025-69061](https://cve.now/CVE-2025-69061.md): WordPress MoveMe theme \<= 1.2.15 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes MoveMe)
- [CVE-2025-69060](https://cve.now/CVE-2025-69060.md): WordPress uReach theme \<= 1.3.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes uReach)
- [CVE-2025-69059](https://cve.now/CVE-2025-69059.md): WordPress DiveIt theme \<= 1.4.3 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes DiveIt)
- [CVE-2025-69058](https://cve.now/CVE-2025-69058.md): WordPress PartyMaker theme \<= 1.1.15 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes PartyMaker)
- [CVE-2025-69057](https://cve.now/CVE-2025-69057.md): WordPress Eldon theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Eldon)
- [CVE-2025-69056](https://cve.now/CVE-2025-69056.md): WordPress Hotel Listing plugin \<= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e-plugins Hotel Listing)
- [CVE-2025-69055](https://cve.now/CVE-2025-69055.md): WordPress BM Content Builder plugin \< 3.16.3.3 - Arbitrary File Download vulnerability (CVSS 6.5, SeaTheme BM Content Builder)
- [CVE-2025-69054](https://cve.now/CVE-2025-69054.md): WordPress Super Logos Showcase plugin \<= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, highwarden Super Logos Showcase)
- [CVE-2025-69053](https://cve.now/CVE-2025-69053.md): WordPress Universal Video Player plugin \<= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Universal Video Player)
- [CVE-2025-69052](https://cve.now/CVE-2025-69052.md): WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin \<= 1.3.1 - Broken Access Control vulnerability (CVSS 9.8, FmeAddons Registration & Login with Mobile Phone Number for…)
- [CVE-2025-69051](https://cve.now/CVE-2025-69051.md): WordPress ListingPro Reviews theme \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CridioStudio ListingPro Reviews)
- [CVE-2025-69050](https://cve.now/CVE-2025-69050.md): WordPress Overworld theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Overworld)
- [CVE-2025-69049](https://cve.now/CVE-2025-69049.md): WordPress Töbel theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Töbel)
- [CVE-2025-69048](https://cve.now/CVE-2025-69048.md): WordPress Universal Video Player plugin \<= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Universal Video Player)
- [CVE-2025-69047](https://cve.now/CVE-2025-69047.md): WordPress MaxShop theme \<= 3.6.20 - Local File Inclusion vulnerability (CVSS 8.1, magentech MaxShop)
- [CVE-2025-69046](https://cve.now/CVE-2025-69046.md): WordPress iRecco Core plugin \<= 1.3.6 - Local File Inclusion vulnerability (CVSS 8.1, WebGeniusLab iRecco Core)
- [CVE-2025-69045](https://cve.now/CVE-2025-69045.md): WordPress FooEvents for WooCommerce plugin \<= 1.20.4 - SQL Injection vulnerability (CVSS 8.5, FooEvents for WooCommerce)
- [CVE-2025-69044](https://cve.now/CVE-2025-69044.md): WordPress Vango theme \<= 1.3.3 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Vango)
- [CVE-2025-69043](https://cve.now/CVE-2025-69043.md): WordPress Rashy theme \<= 1.1.3 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Rashy)
- [CVE-2025-69042](https://cve.now/CVE-2025-69042.md): WordPress Lindo theme \<= 1.2.5 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Lindo)
- [CVE-2025-69041](https://cve.now/CVE-2025-69041.md): WordPress Dekoro theme \<= 1.0.7 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Dekoro)
- [CVE-2025-69040](https://cve.now/CVE-2025-69040.md): WordPress Bfres theme \<= 1.2.1 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Bfres)
- [CVE-2025-69039](https://cve.now/CVE-2025-69039.md): WordPress Bailly theme \<= 1.3.4 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Bailly)
- [CVE-2025-69038](https://cve.now/CVE-2025-69038.md): WordPress Hyori theme \<= 1.3.6 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Hyori)
- [CVE-2025-69037](https://cve.now/CVE-2025-69037.md): WordPress Pippo theme \<= 1.2.3 - Local File Inclusion vulnerability (CVSS 8.1, goalthemes Pippo)
- [CVE-2025-69036](https://cve.now/CVE-2025-69036.md): WordPress Tech Life CPT plugin \<= 16.4 - PHP Object Injection vulnerability (CVSS 8.8, strongholdthemes Tech Life CPT)
- [CVE-2025-69035](https://cve.now/CVE-2025-69035.md): WordPress Dental Care CPT plugin \< 21.6 - PHP Object Injection vulnerability (CVSS 8.8, Strongholdthemes Dental Care CPT)
- [CVE-2025-69005](https://cve.now/CVE-2025-69005.md): WordPress Search & Go theme \<= 2.8 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Search & Go)
- [CVE-2025-69004](https://cve.now/CVE-2025-69004.md): WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme \<= 2.1.0 - Local File Inclusion vulnerability (CVSS 8.1, XpeedStudio Bajaar - Highly Customizable WooCommerce WordPr…)
- [CVE-2025-69003](https://cve.now/CVE-2025-69003.md): WordPress KenthaRadio theme \<= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, QantumThemes KenthaRadio)
- [CVE-2025-69002](https://cve.now/CVE-2025-69002.md): WordPress OneLife theme \<= 3.9 - PHP Object Injection vulnerability (CVSS 8.8, designthemes OneLife)
- [CVE-2025-69001](https://cve.now/CVE-2025-69001.md): WordPress FluentForm plugin \<= 6.1.11 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, Shahjahan Jewel FluentForm)
- [CVE-2025-68999](https://cve.now/CVE-2025-68999.md): WordPress Happy Addons for Elementor plugin \<= 3.20.4 - SQL Injection vulnerability (CVSS 8.5, HappyMonster Happy Addons for Elementor)
- [CVE-2025-68986](https://cve.now/CVE-2025-68986.md): WordPress Miion theme \<= 1.2.7 - Arbitrary File Upload vulnerability (CVSS 9.9, zozothemes Miion)
- [CVE-2025-68913](https://cve.now/CVE-2025-68913.md): WordPress Miion theme \<= 1.2.7 - Local File Inclusion vulnerability (CVSS 7.5, zozothemes Miion)
- [CVE-2025-68912](https://cve.now/CVE-2025-68912.md): WordPress HDForms plugin \<= 1.6.1 - Arbitrary File Deletion vulnerability (CVSS 8.6, Harmonic Design HDForms)
- [CVE-2025-68911](https://cve.now/CVE-2025-68911.md): WordPress Solace theme \<= 2.1.16 - Broken Access Control vulnerability (CVSS 6.5, solacewp Solace)
- [CVE-2025-68910](https://cve.now/CVE-2025-68910.md): WordPress Blogzee theme \<= 1.0.5 - Arbitrary File Upload vulnerability (CVSS 9.9, blazethemes Blogzee)
- [CVE-2025-68909](https://cve.now/CVE-2025-68909.md): WordPress Blogistic theme \<= 1.0.5 - Arbitrary File Upload vulnerability (CVSS 9.9, blazethemes Blogistic)
- [CVE-2025-68908](https://cve.now/CVE-2025-68908.md): WordPress Barberry theme \<= 2.9.9.87 - Local File Inclusion vulnerability (CVSS 8.1, temash Barberry)
- [CVE-2025-68907](https://cve.now/CVE-2025-68907.md): WordPress Hostme v2 theme \<= 7.0 - Arbitrary File Deletion vulnerability (CVSS 7.5, AivahThemes Hostme)
- [CVE-2025-68906](https://cve.now/CVE-2025-68906.md): WordPress JNews - Video plugin \<= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jegtheme JNews - Video)
- [CVE-2025-68905](https://cve.now/CVE-2025-68905.md): WordPress JNews - Pay Writer plugin \<= 11.0.0 - Local File Inclusion vulnerability (CVSS 7.5, jegtheme JNews - Pay Writer)
- [CVE-2025-68904](https://cve.now/CVE-2025-68904.md): WordPress JNews - Frontend Submit plugin \<= 11.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jegtheme JNews - Frontend Submit)
- [CVE-2025-68903](https://cve.now/CVE-2025-68903.md): WordPress Anona theme \<= 8.0 - PHP Object Injection vulnerability (CVSS 8.8, AivahThemes Anona)
- [CVE-2025-68902](https://cve.now/CVE-2025-68902.md): WordPress Anona theme \<= 8.0 - Arbitrary File Download vulnerability (CVSS 7.5, AivahThemes Anona)
- [CVE-2025-68901](https://cve.now/CVE-2025-68901.md): WordPress Anona theme \<= 8.0 - Arbitrary File Deletion vulnerability (CVSS 8.6, AivahThemes Anona)
- [CVE-2025-68900](https://cve.now/CVE-2025-68900.md): WordPress Enfold theme \<= 7.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kriesi Enfold)
- [CVE-2025-68899](https://cve.now/CVE-2025-68899.md): WordPress Vivagh theme \<= 2.4 - PHP Object Injection vulnerability (CVSS 8.8, designthemes Vivagh)
- [CVE-2025-68898](https://cve.now/CVE-2025-68898.md): WordPress Synergy Project Manager plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.8, cjjparadoxmax Synergy Project Manager)
- [CVE-2025-68896](https://cve.now/CVE-2025-68896.md): WordPress WDV One Page Docs plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 6.5, vrpr WDV One Page Docs)
- [CVE-2025-68894](https://cve.now/CVE-2025-68894.md): WordPress ShoutOut plugin \<= 4.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shoutoutglobal ShoutOut)
- [CVE-2025-68884](https://cve.now/CVE-2025-68884.md): WordPress WP Simple Redirect plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arevico WP Simple Redirect)
- [CVE-2025-68883](https://cve.now/CVE-2025-68883.md): WordPress bidorbuy Store Integrator plugin \<= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, extremeidea bidorbuy Store Integrator)
- [CVE-2025-68882](https://cve.now/CVE-2025-68882.md): WordPress Scalenut plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 7.5, Scalenut)
- [CVE-2025-68881](https://cve.now/CVE-2025-68881.md): WordPress AppExperts plugin \<= 1.4.5 - SQL Injection vulnerability (CVSS 8.5, Saad Iqbal AppExperts)
- [CVE-2025-68871](https://cve.now/CVE-2025-68871.md): WordPress Dooodl plugin \<= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, noCreativity Dooodl)
- [CVE-2025-68869](https://cve.now/CVE-2025-68869.md): WordPress LazyTasks plugin \<= 1.2.37 - Privilege Escalation vulnerability (CVSS 9.8, LazyCoders LazyTasks)
- [CVE-2025-68866](https://cve.now/CVE-2025-68866.md): WordPress Dinatur plugin \<= 1.18 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, woofer696 Dinatur)
- [CVE-2025-68864](https://cve.now/CVE-2025-68864.md): WordPress Infility Global plugin \<= 2.15.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Infility Global)
- [CVE-2025-68859](https://cve.now/CVE-2025-68859.md): WordPress Syntax Highlighter Compress plugin \<= 3.0.83.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, agmorpheus Syntax Highlighter Compress)
- [CVE-2025-68858](https://cve.now/CVE-2025-68858.md): WordPress wpCAS plugin \<= 1.07 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Casey Bisson wpCAS)
- [CVE-2025-68857](https://cve.now/CVE-2025-68857.md): WordPress Paid Downloads plugin \<= 3.15 - SQL Injection vulnerability (CVSS 9.3, ichurakov Paid Downloads)
- [CVE-2025-68849](https://cve.now/CVE-2025-68849.md): WordPress Quote Master plugin \<= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Frank Corso Quote Master)
- [CVE-2025-68839](https://cve.now/CVE-2025-68839.md): WordPress Easy Theme Options plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Remi Corson Easy Theme Options)
- [CVE-2025-68838](https://cve.now/CVE-2025-68838.md): WordPress MemberPress Discord Addon plugin \<= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, expresstechsoftware MemberPress Discord Addon)
- [CVE-2025-68835](https://cve.now/CVE-2025-68835.md): WordPress Ravpage plugin \<= 2.33 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, matiskiba Ravpage)
- [CVE-2025-68558](https://cve.now/CVE-2025-68558.md): WordPress Depicter Slider plugin \<= 4.0.4 - Broken Access Control vulnerability (CVSS 6.5, averta Depicter Slider)
- [CVE-2025-68538](https://cve.now/CVE-2025-68538.md): WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme \<= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Craft)
- [CVE-2025-68520](https://cve.now/CVE-2025-68520.md): WordPress DotLife theme \< 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods DotLife)
- [CVE-2025-68518](https://cve.now/CVE-2025-68518.md): WordPress Hoteller theme \< 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Hoteller)
- [CVE-2025-68510](https://cve.now/CVE-2025-68510.md): WordPress Photography theme \< 7.7.5 - Local File Inclusion vulnerability (CVSS 8.1, ThemeGoods Photography)
- [CVE-2025-68507](https://cve.now/CVE-2025-68507.md): WordPress Icegram plugin \<= 3.1.35 - Broken Access Control vulnerability (CVSS 6.5, Icegram)
- [CVE-2025-68073](https://cve.now/CVE-2025-68073.md): WordPress GDPR CCPA Compliance Support plugin \<= 2.7.4 - Broken Access Control vulnerability (CVSS 6.5, Ninja Team GDPR CCPA Compliance Support)
- [CVE-2025-68072](https://cve.now/CVE-2025-68072.md): WordPress Easy Property Listings plugin \<= 3.5.20 - Broken Access Control vulnerability (CVSS 6.5, Merv Barrett Easy Property Listings)
- [CVE-2025-68059](https://cve.now/CVE-2025-68059.md): WordPress Hotel Listing plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 7.6, e-plugins Hotel Listing)
- [CVE-2025-68058](https://cve.now/CVE-2025-68058.md): WordPress Institutions Directory plugin \<= 1.3..4 - Broken Access Control vulnerability (CVSS 7.6, e-plugins Institutions Directory)
- [CVE-2025-68057](https://cve.now/CVE-2025-68057.md): WordPress Hospital Doctor Directory plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 7.6, e-plugins Hospital Doctor Directory)
- [CVE-2025-68047](https://cve.now/CVE-2025-68047.md): WordPress Eventin plugin \<= 4.1.3 - PHP Object Injection vulnerability (CVSS 8.8, Arraytics Eventin)
- [CVE-2025-68046](https://cve.now/CVE-2025-68046.md): WordPress Contact Form & Lead Form Elementor Builder plugin \<= 2.0.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, ThemeHunk Contact Form & Lead Form Elementor Builder)
- [CVE-2025-68041](https://cve.now/CVE-2025-68041.md): WordPress Omnichannel for WooCommerce plugin \<= 1.3.65 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codisto Omnichannel for WooCommerce)
- [CVE-2025-68039](https://cve.now/CVE-2025-68039.md): WordPress WP BackItUp plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 6.5, Chris Simmons WP BackItUp)
- [CVE-2025-68035](https://cve.now/CVE-2025-68035.md): WordPress Tabby Checkout plugin \<= 5.8.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, tabbyai Tabby Checkout)
- [CVE-2025-68034](https://cve.now/CVE-2025-68034.md): WordPress CleverReach® WP plugin \<= 1.5.21 - SQL Injection vulnerability (CVSS 9.3, CleverReach® WP)
- [CVE-2025-68030](https://cve.now/CVE-2025-68030.md): WordPress Frontis Blocks plugin \<= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, WP Messiah Frontis Blocks)
- [CVE-2025-68027](https://cve.now/CVE-2025-68027.md): WordPress Hydra Booking plugin \<= 1.1.32 - Privilege Escalation vulnerability (CVSS 7.3, Themefic Hydra Booking)
- [CVE-2025-68020](https://cve.now/CVE-2025-68020.md): WordPress Notifier plugin \<= 2.7.13 - Broken Access Control vulnerability (CVSS 6.5, WANotifier Notifier)
- [CVE-2025-68019](https://cve.now/CVE-2025-68019.md): WordPress SEO Booster plugin \<= 6.1.8 - Broken Access Control vulnerability (CVSS 6.5, cleverplugins SEO Booster)
- [CVE-2025-68018](https://cve.now/CVE-2025-68018.md): WordPress Order Listener for WooCommerce plugin \<= 3.6.1 - Broken Access Control vulnerability (CVSS 9.4, StackWC Order Listener for WooCommerce)
- [CVE-2025-68017](https://cve.now/CVE-2025-68017.md): WordPress Antideo Email Validator plugin \<= 1.0.10 - SQL Injection vulnerability (CVSS 7.5, Antideo Email Validator)
- [CVE-2025-68016](https://cve.now/CVE-2025-68016.md): WordPress onepay Payment Gateway For WooCommerce plugin \<= 1.1.2 - Other Vulnerability Type vulnerability (CVSS 6.5, Onepay Sri Lanka onepay Payment Gateway For WooCommerce)
- [CVE-2025-68015](https://cve.now/CVE-2025-68015.md): WordPress Event Tickets with Ticket Scanner plugin \<= 2.8.5 - Remote Code Execution (RCE) vulnerability (CVSS 9.0, Vollstart Event Tickets with Ticket Scanner)
- [CVE-2025-68013](https://cve.now/CVE-2025-68013.md): WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin \<= 2.1.2 - Arbitrary Content Deletion vulnerability (CVSS 6.5, cardpaysolutions Payment Gateway Authorize.Net CIM for WooC…)
- [CVE-2025-68012](https://cve.now/CVE-2025-68012.md): WordPress CodeColorer plugin \<= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dmytro Shteflyuk CodeColorer)
- [CVE-2025-68011](https://cve.now/CVE-2025-68011.md): WordPress GLS Shipping for WooCommerce plugin \<= 1.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GLS Shipping for WooCommerce)
- [CVE-2025-68010](https://cve.now/CVE-2025-68010.md): WordPress Netgsm plugin \<= 2.9.63 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Netgsm)
- [CVE-2025-68009](https://cve.now/CVE-2025-68009.md): WordPress Slider Templates plugin \<= 1.0.3 - Broken Access Control vulnerability (CVSS 6.5, Codeless Slider Templates)
- [CVE-2025-68008](https://cve.now/CVE-2025-68008.md): WordPress WP Mail plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mndpsingh287 WP Mail)
- [CVE-2025-68007](https://cve.now/CVE-2025-68007.md): WordPress Event Espresso 4 Decaf plugin \<= 5.0.37.decaf - Settings Change vulnerability (CVSS 6.5, Event Espresso 4 Decaf)
- [CVE-2025-68006](https://cve.now/CVE-2025-68006.md): WordPress Booking Ultra Pro plugin \<= 1.1.23 - Sensitive Data Exposure vulnerability (CVSS 6.5, Deetronix Booking Ultra Pro)
- [CVE-2025-68004](https://cve.now/CVE-2025-68004.md): WordPress My Post Order plugin \<= 1.2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kapil Chugh My Post Order)
- [CVE-2025-68003](https://cve.now/CVE-2025-68003.md): WordPress Shown Connector plugin \<= 1.2.10 - Settings Change vulnerability (CVSS 6.5, renatoatshown Shown Connector)
- [CVE-2025-68001](https://cve.now/CVE-2025-68001.md): WordPress g-FFL Checkout plugin \<= 2.1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, garidium g-FFL Checkout)
- [CVE-2025-67968](https://cve.now/CVE-2025-67968.md): WordPress Real Homes CRM plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 9.9, InspiryThemes Real Homes CRM)
- [CVE-2025-67967](https://cve.now/CVE-2025-67967.md): WordPress Lawyer Directory plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 7.6, e-plugins Lawyer Directory)
- [CVE-2025-67966](https://cve.now/CVE-2025-67966.md): WordPress Lawyer Directory plugin \<= 1.3.3 - Privilege Escalation vulnerability (CVSS 8.8, e-plugins Lawyer Directory)
- [CVE-2025-67964](https://cve.now/CVE-2025-67964.md): WordPress Homey Core plugin \<= 2.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, favethemes Homey Core)
- [CVE-2025-67963](https://cve.now/CVE-2025-67963.md): WordPress Movie Booking plugin \<= 1.1.5 - Arbitrary File Deletion vulnerability (CVSS 8.6, ovatheme Movie Booking)
- [CVE-2025-67961](https://cve.now/CVE-2025-67961.md): WordPress WPO365 plugin \<= 40.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Marco van Wieren WPO365)
- [CVE-2025-67960](https://cve.now/CVE-2025-67960.md): WordPress WorkScout-Core plugin \<= 1.7.06 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, purethemes WorkScout-Core)
- [CVE-2025-67959](https://cve.now/CVE-2025-67959.md): WordPress WorkScout theme \<= 4.1.07 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, purethemes WorkScout)
- [CVE-2025-67958](https://cve.now/CVE-2025-67958.md): WordPress TaxCloud for WooCommerce plugin \<= 8.3.8 - Broken Access Control vulnerability (CVSS 6.5, TaxCloud for WooCommerce)
- [CVE-2025-67957](https://cve.now/CVE-2025-67957.md): WordPress Listivo Core plugin \<= 2.3.77 - Local File Inclusion vulnerability (CVSS 8.1, TangibleWP Listivo Core)
- [CVE-2025-67956](https://cve.now/CVE-2025-67956.md): WordPress User Registration plugin \<= 4.4.6 - Broken Access Control vulnerability (CVSS 8.2, wpeverest User Registration)
- [CVE-2025-67955](https://cve.now/CVE-2025-67955.md): WordPress MyHome Core plugin \<= 4.1.0 - Local File Inclusion vulnerability (CVSS 7.5, TangibleWP MyHome Core)
- [CVE-2025-67954](https://cve.now/CVE-2025-67954.md): WordPress Salon booking system plugin \<= 10.30.3 - Sensitive Data Exposure vulnerability (CVSS 6.5, Dimitri Grassi Salon booking system)
- [CVE-2025-67953](https://cve.now/CVE-2025-67953.md): WordPress Booking Activities plugin \<= 1.16.44 - Privilege Escalation vulnerability (CVSS 8.1, Booking Activities Team Booking Activities)
- [CVE-2025-67952](https://cve.now/CVE-2025-67952.md): WordPress Grand Tour theme \< 5.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Tour)
- [CVE-2025-67949](https://cve.now/CVE-2025-67949.md): WordPress Hostiko theme \< 94.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, designingmedia Hostiko)
- [CVE-2025-67947](https://cve.now/CVE-2025-67947.md): WordPress AdForest Elementor plugin \<= 3.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scriptsbundle AdForest Elementor)
- [CVE-2025-67946](https://cve.now/CVE-2025-67946.md): WordPress AdForest theme \<= 6.0.11 - Local File Inclusion vulnerability (CVSS 8.1, scriptsbundle AdForest)
- [CVE-2025-67945](https://cve.now/CVE-2025-67945.md): WordPress MailerLite – WooCommerce integration plugin \<= 3.1.2 - SQL Injection vulnerability (CVSS 9.3, MailerLite – WooCommerce integration)
- [CVE-2025-67944](https://cve.now/CVE-2025-67944.md): WordPress Nelio AB Testing plugin \<= 8.1.8 - Arbitrary Code Execution vulnerability (CVSS 9.1, Nelio Software Nelio AB Testing)
- [CVE-2025-67943](https://cve.now/CVE-2025-67943.md): WordPress My auctions allegro plugin \<= 3.6.32 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wphocus My auctions allegro)
- [CVE-2025-67942](https://cve.now/CVE-2025-67942.md): WordPress Peach Payments Gateway plugin \<= 3.3.6 - Broken Access Control vulnerability (CVSS 6.5, peachpayments Peach Payments Gateway)
- [CVE-2025-67941](https://cve.now/CVE-2025-67941.md): WordPress The Aisle theme \< 2.9.1 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes The Aisle)
- [CVE-2025-67940](https://cve.now/CVE-2025-67940.md): WordPress Powerlift theme \< 3.2.1 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Powerlift)
- [CVE-2025-67939](https://cve.now/CVE-2025-67939.md): WordPress Tickera plugin \<= 3.5.6.2 - Broken Access Control vulnerability (CVSS 6.5, Tickera)
- [CVE-2025-67938](https://cve.now/CVE-2025-67938.md): WordPress Biagiotti theme \< 3.5.2 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Biagiotti)
- [CVE-2025-67923](https://cve.now/CVE-2025-67923.md): WordPress JetEngine plugin \<= 3.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetEngine)
- [CVE-2025-67626](https://cve.now/CVE-2025-67626.md): WordPress WP SEO Search plugin \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Angel Costa WP SEO Search)
- [CVE-2025-67620](https://cve.now/CVE-2025-67620.md): WordPress Anon theme \<= 2.2.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CleverSoft Anon)
- [CVE-2025-67619](https://cve.now/CVE-2025-67619.md): WordPress Kids Heaven theme \<= 3.2 - PHP Object Injection vulnerability (CVSS 8.8, designthemes Kids Heaven)
- [CVE-2025-67617](https://cve.now/CVE-2025-67617.md): WordPress Consult Aid theme \<= 1.4.3 - PHP Object Injection vulnerability (CVSS 9.8, themeton Consult Aid)
- [CVE-2025-67616](https://cve.now/CVE-2025-67616.md): WordPress Mella theme \<= 1.2.29 - Local File Inclusion vulnerability (CVSS 8.1, BZOTheme Mella)
- [CVE-2025-67615](https://cve.now/CVE-2025-67615.md): WordPress Myour theme \<= 1.5.1 - Local File Inclusion vulnerability (CVSS 8.1, bslthemes Myour)
- [CVE-2025-67614](https://cve.now/CVE-2025-67614.md): WordPress TheNa theme \<= 1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, foreverpinetree TheNa)
- [CVE-2025-66143](https://cve.now/CVE-2025-66143.md): WordPress Crumber plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 5.4, merkulove Crumber)
- [CVE-2025-66142](https://cve.now/CVE-2025-66142.md): WordPress Comparimager for Elementor plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.4, merkulove Comparimager for Elementor)
- [CVE-2025-66141](https://cve.now/CVE-2025-66141.md): WordPress Scroller plugin \<= 2.0.2 - Broken Access Control vulnerability (CVSS 5.4, merkulove Scroller)
- [CVE-2025-66140](https://cve.now/CVE-2025-66140.md): WordPress Uper for Elementor plugin \<= 1.0.5 - Broken Access Control vulnerability (CVSS 5.4, merkulove Uper for Elementor)
- [CVE-2025-66139](https://cve.now/CVE-2025-66139.md): WordPress Audier For Elementor plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.4, merkulove Audier For Elementor)
- [CVE-2025-66138](https://cve.now/CVE-2025-66138.md): WordPress Motionger for Elementor plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 5.4, merkulove Motionger for Elementor)
- [CVE-2025-66137](https://cve.now/CVE-2025-66137.md): WordPress Searcher for Elementor plugin \<= 1.0.3 - Broken Access Control vulnerability (CVSS 5.4, merkulove Searcher for Elementor)
- [CVE-2025-66136](https://cve.now/CVE-2025-66136.md): WordPress Carter for Elementor plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.4, merkulove Carter for Elementor)
- [CVE-2025-66135](https://cve.now/CVE-2025-66135.md): WordPress Imager for Elementor plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 5.4, merkulove Imager for Elementor)
- [CVE-2025-64252](https://cve.now/CVE-2025-64252.md): WordPress ANAC XML Viewer plugin \<= 1.8.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Marco Milesi ANAC XML Viewer)
- [CVE-2025-63051](https://cve.now/CVE-2025-63051.md): WordPress REHub Framework plugin \< 19.9.9.4 - Sensitive Data Exposure vulnerability (CVSS 4.3, sizam REHub Framework)
- [CVE-2025-63026](https://cve.now/CVE-2025-63026.md): WordPress Grand Restaurant Theme Elements for Elementor plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeGoods Grand Restaurant Theme Elements for Elementor)
- [CVE-2025-63019](https://cve.now/CVE-2025-63019.md): WordPress Cookies and Content Security Policy plugin \<= 2.34 - Sensitive Data Exposure vulnerability (CVSS 5.3, Johan Jonk Stenström Cookies and Content Security Policy)
- [CVE-2025-63018](https://cve.now/CVE-2025-63018.md): WordPress Bard theme \<= 2.229 - Broken Access Control vulnerability (CVSS 4.3, wproyal Bard)
- [CVE-2025-63017](https://cve.now/CVE-2025-63017.md): WordPress WerkStatt plugin plugin \<= 1.6.6 - Local File Inclusion vulnerability (CVSS 7.5, fuelthemes WerkStatt Plugin)
- [CVE-2025-62754](https://cve.now/CVE-2025-62754.md): WordPress Payment Gateway bKash for WC plugin \<= 3.1.0 - Broken Access Control vulnerability (CVSS 5.3, Kapil Paul Payment Gateway bKash for WC)
- [CVE-2025-62741](https://cve.now/CVE-2025-62741.md): WordPress Pool Services theme \<= 3.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, SmartDataSoft Pool Services)
- [CVE-2025-62106](https://cve.now/CVE-2025-62106.md): WordPress WP-CRM System plugin \<= 3.4.5 - Broken Access Control vulnerability (CVSS 5.4, Mario Peshev WP-CRM System)
- [CVE-2025-62077](https://cve.now/CVE-2025-62077.md): WordPress Affiliate Link Tracker plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SEOSEON EUROPE S.L Affiliate Link Tracker)
- [CVE-2025-62056](https://cve.now/CVE-2025-62056.md): WordPress News Event theme \<= 1.0.1 - Arbitrary File Upload vulnerability (CVSS 9.9, blazethemes News Event)
- [CVE-2025-62050](https://cve.now/CVE-2025-62050.md): WordPress Blogmatic theme \<= 1.0.3 - Arbitrary File Upload vulnerability (CVSS 9.9, blazethemes Blogmatic)
- [CVE-2025-5805](https://cve.now/CVE-2025-5805.md): WordPress Electron theme \<= 1.8.2 - Broken Access Control vulnerability (CVSS 6.5, Ninetheme Electron)
- [CVE-2025-54003](https://cve.now/CVE-2025-54003.md): WordPress Depot theme \<= 1.16 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Depot)
- [CVE-2025-54002](https://cve.now/CVE-2025-54002.md): WordPress xSmart theme \<= 1.2.9.4 - Broken Access Control vulnerability (CVSS 6.5, Jthemes xSmart)
- [CVE-2025-53240](https://cve.now/CVE-2025-53240.md): WordPress WordPress Photo Gallery plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, adamlabs WordPress Photo Gallery)
- [CVE-2025-52762](https://cve.now/CVE-2025-52762.md): WordPress flexo-posts-manager Plugin \<= 1.0001 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, flexostudio flexo-posts-manager)
- [CVE-2025-52746](https://cve.now/CVE-2025-52746.md): WordPress Restaurante theme \<= 3.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ayecode Restaurante)
- [CVE-2025-50007](https://cve.now/CVE-2025-50007.md): WordPress xSmart theme \<= 1.2.9.4 - Privilege Escalation vulnerability (CVSS 8.8, Jthemes xSmart)
- [CVE-2025-50006](https://cve.now/CVE-2025-50006.md): WordPress xSmart theme \<= 1.2.9.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jthemes xSmart)
- [CVE-2025-50005](https://cve.now/CVE-2025-50005.md): WordPress tagDiv Composer plugin \<= 5.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tagDiv Composer)
- [CVE-2025-50004](https://cve.now/CVE-2025-50004.md): WordPress JupiterX Core plugin \<= 4.10.1 - PHP Object Injection vulnerability (CVSS 8.8, artbees JupiterX Core)
- [CVE-2025-50003](https://cve.now/CVE-2025-50003.md): WordPress Amuli theme \<= 2.3.0 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Amuli)
- [CVE-2025-50002](https://cve.now/CVE-2025-50002.md): WordPress Energia theme \<= 1.1.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Farost Energia)
- [CVE-2025-49994](https://cve.now/CVE-2025-49994.md): WordPress Athens theme \<= 1.1.6 - Local File Inclusion vulnerability (CVSS 8.1, ovatheme Athens)
- [CVE-2025-49375](https://cve.now/CVE-2025-49375.md): WordPress HomeLancer theme \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.4, cozythemes HomeLancer)
- [CVE-2025-49336](https://cve.now/CVE-2025-49336.md): WordPress Pondol BBS plugin \<= 1.1.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pondol BBS)
- [CVE-2025-49249](https://cve.now/CVE-2025-49249.md): WordPress Drone theme \<= 1.40 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ApusTheme Drone)
- [CVE-2025-49066](https://cve.now/CVE-2025-49066.md): WordPress Accordion Slider PRO plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Accordion Slider PRO)
- [CVE-2025-49055](https://cve.now/CVE-2025-49055.md): WordPress WP Lead Capturing Pages plugin \<= 2.5 - SQL Injection vulnerability (CVSS 9.3, kamleshyadav WP Lead Capturing Pages)
- [CVE-2025-49050](https://cve.now/CVE-2025-49050.md): WordPress WP Lead Capturing Pages plugin \<= 2.5 - SQL Injection vulnerability (CVSS 8.5, kamleshyadav WP Lead Capturing Pages)
- [CVE-2025-49049](https://cve.now/CVE-2025-49049.md): WordPress DZS Video Gallery plugin \<= 12.39 - SQL Injection vulnerability (CVSS 8.5, ZoomIt DZS Video Gallery)
- [CVE-2025-49046](https://cve.now/CVE-2025-49046.md): WordPress xPromoter plugin \<= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup xPromoter)
- [CVE-2025-49045](https://cve.now/CVE-2025-49045.md): WordPress Super Interactive Maps plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, highwarden Super Interactive Maps)
- [CVE-2025-49043](https://cve.now/CVE-2025-49043.md): WordPress Magic Responsive Slider and Carousel WordPress plugin \<= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Magic Responsive Slider and Carousel WordPress)
- [CVE-2025-48094](https://cve.now/CVE-2025-48094.md): WordPress Magic Slider plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Magic Slider)
- [CVE-2025-47666](https://cve.now/CVE-2025-47666.md): WordPress Image&Video FullScreen Background plugin \<= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Image&Video FullScreen Background)
- [CVE-2025-47600](https://cve.now/CVE-2025-47600.md): WordPress WoodMart theme \<= 8.3.7 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, xtemos WoodMart)
- [CVE-2025-47555](https://cve.now/CVE-2025-47555.md): WordPress Tutor LMS plugin \<= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 3.8, Themeum Tutor LMS)
- [CVE-2025-47500](https://cve.now/CVE-2025-47500.md): WordPress Stackable plugin \<= 3.19.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Benjamin Intal Stackable)
- [CVE-2025-47474](https://cve.now/CVE-2025-47474.md): WordPress Anarkali theme \<= 1.0.9 - Local File Inclusion vulnerability (CVSS 8.1, Ninetheme Anarkali)
- [CVE-2025-32123](https://cve.now/CVE-2025-32123.md): WordPress HTML5 Video Player with Playlist & Multiple Skins plugin \<= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup HTML5 Video Player with Playlist & Multiple Sk…)
- [CVE-2025-31413](https://cve.now/CVE-2025-31413.md): WordPress Element Pack Elementor Addons plugin \<= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, bdthemes Element Pack Elementor Addons)
- [CVE-2025-27005](https://cve.now/CVE-2025-27005.md): WordPress HTML5 Video Player plugin \<= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup HTML5 Video Player)
- [CVE-2026-23761](https://cve.now/CVE-2026-23761.md): VB-Audio Voicemeeter & Matrix Drivers DoS via Improper FILE\_OBJECT FsContext Initialization (CVSS 6.9, VB-Audio Software Voicemeeter · VB-Audio Software Matrix)
- [CVE-2026-23762](https://cve.now/CVE-2026-23762.md): VB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCache (CVSS 6.9, VB-Audio Software Voicemeeter · VB-Audio Software Matrix)
- [CVE-2026-23763](https://cve.now/CVE-2026-23763.md): VB-Audio Matrix Drivers Local Privilege Escalation via Kernel Memory Exposure (CVSS 8.5, VB-Audio Software Matrix)
- [CVE-2026-23764](https://cve.now/CVE-2026-23764.md): VB-Audio Voicemeeter & Matrix Drivers DoS via Corrupted IoAllocateMdl Length (CVSS 6.8, VB-Audio Software Voicemeeter · VB-Audio Software Matrix)
- [CVE-2026-22278](https://cve.now/CVE-2026-22278.md): Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2025-36588](https://cve.now/CVE-2025-36588.md): Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Inj (CVSS 8.8, Dell Unisphere for PowerMax)
- [CVE-2025-32057](https://cve.now/CVE-2025-32057.md): Misconfigured SSL/TLS communication of Redbend service for Infotainment ECU (CVSS 6.5, Bosch Infotainment system ECU)
- [CVE-2025-32056](https://cve.now/CVE-2025-32056.md): Anti-Theft Bypass for Infotainment ECU (CVSS 4.0, Bosch Infotainment system ECU)
- [CVE-2026-24009](https://cve.now/CVE-2026-24009.md): Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage (CVSS 8.1, docling-project docling-core · docling-core)
- [CVE-2025-65098](https://cve.now/CVE-2025-65098.md): Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass (CVSS 7.4, baptisteArno typebot.io · @typebot.io/js)
- [CVE-2025-64097](https://cve.now/CVE-2025-64097.md): NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force (CVSS 9.5, nerves-hub nerves\_hub\_web)
- [CVE-2025-15523](https://cve.now/CVE-2025-15523.md): TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app (CVSS 4.8, Inkscape)
- [CVE-2026-23760](https://cve.now/CVE-2026-23760.md): SmarterTools SmarterMail \< Build 9511 Authentication Bypass via Password Reset API (CVSS 9.3, KEV, SmarterTools SmarterMail)
- [CVE-2026-1329](https://cve.now/CVE-2026-1329.md): Tenda AX1803 WifiGuestSet fromGetWifiGuestBasic stack-based overflow (CVSS 8.7, Tenda AX1803)
- [CVE-2026-1328](https://cve.now/CVE-2026-1328.md): Totolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflow (CVSS 8.7, Totolink NR1800X)
- [CVE-2026-1327](https://cve.now/CVE-2026-1327.md): Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection (CVSS 5.3, Totolink NR1800X)
- [CVE-2025-13928](https://cve.now/CVE-2025-13928.md): Incorrect Authorization in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-13927](https://cve.now/CVE-2025-13927.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-0723](https://cve.now/CVE-2026-0723.md): Unchecked Return Value in GitLab (CVSS 7.4, GitLab)
- [CVE-2026-1102](https://cve.now/CVE-2026-1102.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-1326](https://cve.now/CVE-2026-1326.md): Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injection (CVSS 5.3, Totolink NR1800X)
- [CVE-2025-12738](https://cve.now/CVE-2025-12738.md): Enumeration of restricted property value (CVSS 1.3, neo4j Enterprise Edition)
- [CVE-2026-1325](https://cve.now/CVE-2026-1325.md): Sangfor Operation and Maintenance Security Management System edit\_pwd\_mall password recovery (CVSS 6.9, Sangfor Operation and Maintenance Security Management System)
- [CVE-2026-1324](https://cve.now/CVE-2026-1324.md): Sangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injection (CVSS 8.7, Sangfor Operation and Maintenance Management System)
- [CVE-2025-14295](https://cve.now/CVE-2025-14295.md): Automated Logic WebCTRL and Carrier i-Vu Session Fixation (CVSS 7.0, Automated Logic WebCTRL · Carrier i-Vu)
- [CVE-2025-10856](https://cve.now/CVE-2025-10856.md): Arbitrary File Upload in Solvera Software's Teknoera (CVSS 8.1, Solvera Software Services Trade Teknoera)
- [CVE-2025-10855](https://cve.now/CVE-2025-10855.md): IDOR in Solvera Software's Teknoera (CVSS 7.5, Solvera Software Services Trade Teknoera)
- [CVE-2025-67684](https://cve.now/CVE-2025-67684.md): Remote Code Execution via Local File Inclusion in Quick.Cart (CVSS 9.4, OpenSolution Quick.Cart)
- [CVE-2025-67683](https://cve.now/CVE-2025-67683.md): Reflected XSS in Quick.Cart (CVSS 5.1, OpenSolution Quick.Cart)
- [CVE-2025-10024](https://cve.now/CVE-2025-10024.md): IDOR in EXERT Computer Technologies' Education Management System (CVSS 7.5, EXERT Computer Technologies Software Ltd. Education Managem…)
- [CVE-2025-13335](https://cve.now/CVE-2025-13335.md): Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-1225](https://cve.now/CVE-2026-1225.md): Malicious logback.xml configuration file allows instantiation of arbitrary classes (CVSS 1.8, QOS.CH Sarl Logback-core · ch.qos.logback:logback-core)
- [CVE-2026-1332](https://cve.now/CVE-2026-1332.md): HAMASTAR Technology｜MeetingHub - Missing Authentication (CVSS 6.9, HAMASTAR Technology MeetingHub)
- [CVE-2025-4764](https://cve.now/CVE-2025-4764.md): SQLi in Aida Computer's Hotspot (CVSS 8.0, Aida Computer Information Technology Hotel Guest Hotspot)
- [CVE-2025-4763](https://cve.now/CVE-2025-4763.md): XSS in Aida Computer's Hotspot (CVSS 5.5, Aida Computer Information Technology Hotel Guest Hotspot)
- [CVE-2026-1331](https://cve.now/CVE-2026-1331.md): AMASTAR Technology｜MeetingHub - Arbitrary File Upload (CVSS 9.3, AMASTAR Technology MeetingHub)
- [CVE-2026-1330](https://cve.now/CVE-2026-1330.md): HAMASTAR Technology｜MeetingHub - Arbitrary File Read (CVSS 8.7, HAMASTAR Technology MeetingHub)
- [CVE-2026-24332](https://cve.now/CVE-2026-24332.md): Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because (CVSS 4.3, Discord WebSocket API service)
- [CVE-2026-0920](https://cve.now/CVE-2026-0920.md): LA-Studio Element Kit for Elementor \<= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit\_bkrole parameter (CVSS 9.8, choijun LA-Studio Element Kit for Elementor)
- [CVE-2025-71176](https://cve.now/CVE-2025-71176.md): pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial o (CVSS 6.8, pytest)
- [CVE-2026-24049](https://cve.now/CVE-2026-24049.md): wheel Allows Arbitrary File Permission Modification via Path Traversal (CVSS 7.1, pypa wheel · wheel)
- [CVE-2026-24042](https://cve.now/CVE-2026-24042.md): Appsmith public apps can execute unpublished actions (viewMode confusion) (CVSS 9.4, appsmithorg appsmith)
- [CVE-2026-24039](https://cve.now/CVE-2026-24039.md): Horilla's Improper Access Control Allows Employees to Auto-Approve Documents (CVSS 4.3, horilla-opensource horilla)
- [CVE-2026-24038](https://cve.now/CVE-2026-24038.md): Horilla HR has 2FA Bypass through its OTP Handling Logic (CVSS 8.1, horilla-opensource horilla)
- [CVE-2026-24037](https://cve.now/CVE-2026-24037.md): Horilla HRM has XSS Bypass through Project Name (CVSS 4.8, horilla-opensource horilla)
- [CVE-2026-24036](https://cve.now/CVE-2026-24036.md): Horilla Exposes Unpublished Job Disclosures through Unauthenticated API (CVSS 5.3, horilla-opensource horilla)
- [CVE-2026-24055](https://cve.now/CVE-2026-24055.md): Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking (CVSS 6.3, langfuse)
- [CVE-2026-24035](https://cve.now/CVE-2026-24035.md): Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee (CVSS 4.3, horilla-opensource horilla)
- [CVE-2026-24034](https://cve.now/CVE-2026-24034.md): Horilla has File Upload XSS (CVSS 5.4, horilla-opensource horilla)
- [CVE-2026-24010](https://cve.now/CVE-2026-24010.md): Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover (CVSS 8.8, horilla-opensource horilla)
- [CVE-2026-24006](https://cve.now/CVE-2026-24006.md): Seroval affected by Denial of Service via Deeply Nested Objects (CVSS 7.5, lxsmnsyc seroval · seroval)
- [CVE-2026-24002](https://cve.now/CVE-2026-24002.md): pyodide sandbox option is insecure (CVSS 9.1, gristlabs grist-core)
- [CVE-2026-24001](https://cve.now/CVE-2026-24001.md): jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch (CVSS 2.7, kpdecker jsdiff · diff)
- [CVE-2026-23992](https://cve.now/CVE-2026-23992.md): go-tuf improperly validates the configured threshold for delegations (CVSS 5.9, theupdateframework go-tuf · github.com/theupdateframework/g…)
- [CVE-2026-23991](https://cve.now/CVE-2026-23991.md): go-tuf affected by client DoS via malformed server response (CVSS 5.9, theupdateframework go-tuf · github.com/theupdateframework/g…)
- [CVE-2026-23966](https://cve.now/CVE-2026-23966.md): sm-crypto Affected by Private Key Recovery in SM2-PKE (CVSS 9.1, JuneAndGreen sm-crypto · sm-crypto)
- [CVE-2026-23965](https://cve.now/CVE-2026-23965.md): sm-crypto Affected by Signature Forgery in SM2-DSA (CVSS 7.5, JuneAndGreen sm-crypto · sm-crypto)
- [CVE-2026-23967](https://cve.now/CVE-2026-23967.md): sm-crypto Affected by Signature Malleability in SM2-DSA (CVSS 7.5, JuneAndGreen sm-crypto · sm-crypto)
- [CVE-2026-23959](https://cve.now/CVE-2026-23959.md): CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier (CVSS 6.9, CoreShop · coreshop/core-shop)
- [CVE-2026-23964](https://cve.now/CVE-2026-23964.md): Mastodon has insufficient access control to push notification settings (CVSS 6.5, mastodon)
- [CVE-2026-23963](https://cve.now/CVE-2026-23963.md): Mastodon missing length limits on list names, filter names, and filter keywords (CVSS 4.3, mastodon)
- [CVE-2026-23962](https://cve.now/CVE-2026-23962.md): Mastodon vulnerable to Denial of Service from a single post (client/server) (CVSS 7.5, mastodon)
- [CVE-2026-23961](https://cve.now/CVE-2026-23961.md): Mastodon may allow a remote suspension bypass (CVSS 5.3, mastodon)
- [CVE-2026-23958](https://cve.now/CVE-2026-23958.md): DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover (CVSS 8.8, dataease)
- [CVE-2026-23699](https://cve.now/CVE-2026-23699.md): AP180 series with firmware versions prior to AP\_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. (CVSS 7.2, Ruijie Networks Co. AP180(JA) V1.xx · Ruijie Networks Co… +7)
- [CVE-2025-27380](https://cve.now/CVE-2025-27380.md): HTML Injection Leading to Script Execution in Altium Enterprise Server (CVSS 7.6, Altium AES)
- [CVE-2026-23957](https://cve.now/CVE-2026-23957.md): seroval is vulnerable to Denial of Service via array serialization (CVSS 7.5, lxsmnsyc seroval · seroval)
- [CVE-2026-23956](https://cve.now/CVE-2026-23956.md): seroval affected by Denial of Service via RegExp serialization (CVSS 7.5, lxsmnsyc seroval · seroval)
- [CVE-2025-27379](https://cve.now/CVE-2025-27379.md): Stored Cross-Site Scripting in AES BOM Viewer (CVSS 6.8, Altium AES)
- [CVE-2025-27378](https://cve.now/CVE-2025-27378.md): SQL Injection in AES Due to Inactive SQL Parsing Configuration (CVSS 8.6, Altium AES)
- [CVE-2026-23952](https://cve.now/CVE-2026-23952.md): ImageMagick has a NULL pointer dereference in MSL parser via \<comment\> tag before image load (CVSS 6.5, ImageMagick · Magick.NET-Q8-x64 +18)
- [CVE-2026-23951](https://cve.now/CVE-2026-23951.md): SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash (CVSS 5.5, sumatrapdfreader sumatrapdf)
- [CVE-2025-27377](https://cve.now/CVE-2025-27377.md): Missing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle Attacks (CVSS 5.3, Altium Designer)
- [CVE-2026-23946](https://cve.now/CVE-2026-23946.md): Tendenci has Authenticated Remote Code Execution via Pickle Deserialization (CVSS 6.8, tendenci)
- [CVE-2026-23893](https://cve.now/CVE-2026-23893.md): openCryptoki has improper link resolution before file access (link following) (CVSS 6.8, opencryptoki)
- [CVE-2025-56589](https://cve.now/CVE-2025-56589.md): A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the (CVSS 7.5)
- [CVE-2025-56590](https://cve.now/CVE-2025-56590.md): An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. (CVSS 9.8)
- [CVE-2025-66428](https://cve.now/CVE-2025-66428.md): An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation. (CVSS 8.8)
- [CVE-2025-67221](https://cve.now/CVE-2025-67221.md): The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents. (CVSS 7.5, orjson)
- [CVE-2025-69612](https://cve.now/CVE-2025-69612.md): A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. (CVSS 6.5)
- [CVE-2025-69764](https://cve.now/CVE-2025-69764.md): Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid s (CVSS 9.8)
- [CVE-2025-69820](https://cve.now/CVE-2025-69820.md): Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath fun (CVSS 6.0, github.com/beam-cloud/beta9 · aws/aws-sdk-php)
- [CVE-2025-69821](https://cve.now/CVE-2025-69821.md): An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connecti (CVSS 7.4)
- [CVE-2025-69822](https://cve.now/CVE-2025-69822.md): An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate priv (CVSS 7.4)
- [CVE-2025-69828](https://cve.now/CVE-2025-69828.md): File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary (CVSS 10.0)
- [CVE-2025-70899](https://cve.now/CVE-2025-70899.md): PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.