CVEs published January 23, 2026
255 CVEs were published on January 23, 2026: 30 critical, 76 high. 2 are now in CISA KEV.
- Published
- 255
- Critical
- 30
- High
- 76
- Medium
- 126
- Low
- 2
- Unrated
- 21
- Now in CISA KEV
- 2
- Fix available
- 47
Most affected products
- Linux
- 34
- ALGO 8180 IP Audio Alerter
- 18
- Dell ObjectScale
- 5
- Langflow
- 5
- GPT Academic
- 3
- Anritsu ShockLine
- 2
- Anritsu VectorStar
- 2
- Birebirsoft Software and Technology Solutions Sufirmam
- 2
- Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping…
- 2
- Foundation Agents MetaGPT
- 2
Critical 30
- CVE-2026-24423SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APISmarterTools SmarterMail
- CVE-2021-47891Unified Remote 3.9.0.2463 - Remote Code ExecutionUnified Intents AB Unified Remote
- CVE-2026-22984libceph: prevent potential out-of-bounds reads in handle_auth_done()Linux
- CVE-2025-71159btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node()Linux
- CVE-2025-4320Information Disclosure in Birebirsoft's SufirmamBirebirsoft Software and Technology Solutions Sufirmam
- CVE-2025-4319Improper Access Control in Birebirsoft's SufirmamBirebirsoft Software and Technology Solutions Sufirmam
- CVE-2026-1364JNC｜IAQS and I6 - Missing AuthenticationJNC IAQS · JNC I6
- CVE-2026-1363JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side SecurityJNC IAQS · JNC I6
- CVE-2026-0773Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution VulnerabilityUpsonic
- CVE-2026-0770Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityLangflow
- CVE-2026-0769Langflow eval_custom_component_code Eval Injection Remote Code Execution VulnerabilityLangflow
- CVE-2026-0768Langflow code Code Injection Remote Code Execution VulnerabilityLangflow
- CVE-2026-0764GPT Academic upload Deserialization of Untrusted Data Remote Code Execution VulnerabilityGPT Academic
- CVE-2026-0763GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution VulnerabilityGPT Academic
- CVE-2026-0761Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution VulnerabilityFoundation Agents MetaGPT
- CVE-2026-0760Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution VulnerabilityFoundation Agents MetaGPT
- CVE-2026-0759Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution VulnerabilityKatana Network Development Starter Kit
- CVE-2026-0756github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerabilitygithub-kanban-mcp-server
- CVE-2026-0755gemini-mcp-tool execAsync Command Injection Remote Code Execution VulnerabilityGemini MCP Tool gemini-mcp-tool · gemini-mcp-tool
- CVE-2025-15061Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution VulnerabilityFramelink Figma MCP Server · figma-developer-mcp
- CVE-2025-15063Ollama MCP Server execAsync Command Injection Remote Code Execution VulnerabilityOllama MCP Server
- CVE-2026-24304Azure Resource Manager Elevation of Privilege VulnerabilityMicrosoft Azure Resource Manager
- CVE-2022-25369An issue was discovered in Dynamicweb before 9.12.8.
- CVE-2025-52024A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthent
- CVE-2025-52025An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28.
- CVE-2025-66719An issue was discovered in Free5gc NRF 1.4.0.github.com/free5gc/nrf
- CVE-2025-67229An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path a
- CVE-2025-70457A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component.
- CVE-2025-70983Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.
- CVE-2025-70985Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their sc
High 76
- CVE-2026-24139MyTube Allows Unauthorized Database Export by Guest Usersfranklioxygen MyTube
- CVE-2026-24136Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL APIsaleor
- CVE-2021-47904PhreeBooks 5.2.3 - Remote Code ExecutionPhreesoft PhreeBooks
- CVE-2021-47903LiteSpeed Web Server Enterprise 5.4.11 - Command InjectionLiteSpeed Technologies LiteSpeed Web Server Enterprise
- CVE-2021-47898Epson USB Display 1.6.0.0 Unquoted Service Path VulnerabilityEpson America Epson USB Display
- CVE-2021-47896PDFCOMPLETE Corporate Edition 4.1.45 - 'pdfcDispatcher' Unquoted Service PathPDF Complete PDFCOMPLETE Corporate Edition
- CVE-2021-47890LogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service PathSoftros Systems LogonExpert
- CVE-2021-47889Softros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service PathSoftros Systems LAN Messenger
- CVE-2021-47888Textpattern 4.8.3 - Remote code executionThe Textpattern Development Team Textpattern
- CVE-2026-22992libceph: return the handler error from mon_handle_auth_done()Linux
- CVE-2026-22991libceph: make free_choose_arg_map() resilient to partial allocationLinux
- CVE-2026-22990libceph: replace overzealous BUG_ON in osdmap_apply_incremental()Linux
- CVE-2026-22988arp: do not assume dev_hard_header() does not change skb->headLinux
- CVE-2026-22980nfsd: provide locking for v4_end_graceLinux
- CVE-2025-71161dm-verity: disable recursive forward error correctionLinux
- CVE-2025-71158gpio: mpsse: ensure worker is torn downLinux
- CVE-2026-0994Denial of Service in Python ProtobufPython Protobuf · protobuf
- CVE-2026-24635WordPress EduBlink Core plugin <= 2.0.7 - Local File Inclusion vulnerabilityDevsBlink EduBlink Core
- CVE-2026-24624WordPress Neoforum plugin <= 1.0 - SQL Injection vulnerabilitysaeros1984 Neoforum
- CVE-2026-24623WordPress Neoforum plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitysaeros1984 Neoforum
- CVE-2026-24609WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerabilityElated-Themes Laurent
- CVE-2026-24608WordPress Laurent Core plugin <= 2.4.1 - Local File Inclusion vulnerabilityElated-Themes Laurent Core
- CVE-2026-24572WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerabilityNelio Software Nelio Content
- CVE-2026-24538WordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerabilityomnipressteam Omnipress
- CVE-2026-24531WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerabilitySelect-Themes Prowess
- CVE-2025-71155KVM: s390: Fix gmap_helper_zap_one_page() againLinux
- CVE-2025-71150ksmbd: Fix refcount leak when invalid session is found on session lookupLinux
- CVE-2025-71146netfilter: nf_conncount: fix leaked ct in error pathsLinux
- CVE-2025-71145usb: phy: isp1301: fix non-OF device reference imbalanceLinux
- CVE-2025-14866Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role AssignmentMelapress Role Editor
- CVE-2026-22273Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Use of Default Credentials vulnerabiDell ObjectScale
- CVE-2026-22271Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive IDell ObjectScale
- CVE-2024-11976BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode ExecutionBuddyPress
- CVE-2026-0603Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionorg.hibernate/hibernate-core · Red Hat JBoss Enterprise… +13
- CVE-2025-67847Moodle: moodle: remote code execution via insufficient restore input validationmoodle · moodle/moodle
- CVE-2025-3839Epiphany: insecure external protocol invocation in epiphanyepiphany
- CVE-2026-0710Sipp/sipp: sipp: denial of service and potential arbitrary code execution vulnerabilitysipp
- CVE-2025-15351Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityAnritsu VectorStar
- CVE-2025-15350Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityAnritsu VectorStar
- CVE-2025-15349Anritsu ShockLine SCPI Race Condition Remote Code Execution VulnerabilityAnritsu ShockLine
- CVE-2025-15348Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityAnritsu ShockLine
- CVE-2026-0778Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution VulnerabilityEnel X JuiceBox
- CVE-2026-0776Discord Client Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityDiscord Client
- CVE-2026-0775npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerabilitynpm cli
- CVE-2026-0774WatchYourLAN Configuration Page Argument Injection Remote Code Execution VulnerabilityWatchYourLAN
- CVE-2026-0772Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution VulnerabilityLangflow
- CVE-2026-0771Langflow PythonFunction Code Injection Remote Code Execution VulnerabilityLangflow
- CVE-2026-0762GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution VulnerabilityGPT Academic
- CVE-2026-0758mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerabilitymcp-server-siri-shortcuts
- CVE-2026-0757MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape VulnerabilityMCP Manager for Claude Desktop
- CVE-2025-15062Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution VulnerabilityTrimble SketchUp
- CVE-2026-0795ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0794ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0793ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0792ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0791ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0787ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0786ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0785ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0784ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0783ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0782ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0781ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0780ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0779ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0796ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2025-15059GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2025-110027-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability7-Zip
- CVE-2026-24138FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`fogproject
- CVE-2025-52026An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-
- CVE-2025-66720Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId.
- CVE-2025-67230Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to
- CVE-2025-67264An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local at
- CVE-2025-69907An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /o
- CVE-2025-69908An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a pub
- CVE-2025-70986Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department
Medium, low and unrated 149
- CVE-2026-24140MyTube has Mass Assignment via Settings Managementfranklioxygen MyTube
- CVE-2026-24474Dioxus Components has JavaScript injection via user-supplied IDsDioxusLabs components
- CVE-2026-24128XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messagesxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2026-24127Typemill has Reflected XSS via login error view templatetypemill
- CVE-2026-1386Arbitrary Host File Overwrite via Symlink in Firecracker JailerAWS Firecracker
- CVE-2025-14947All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletionplugins360 All-in-One Video Gallery
- CVE-2021-47906BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site ScriptingBloofoxCMS
- CVE-2021-47905MyBB Delete Account Plugin 1.4 - Cross-Site Scriptingvintagedaddyo MyBB Delete Account Plugin
- CVE-2021-47899YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF VulnerabilityMfscripts YetiShare File Hosting Script
- CVE-2021-47897PEEL Shopping 9.3.0 - 'address' Stored Cross-Site ScriptingPEEL eCommerce PEEL Shopping
- CVE-2021-47895Nsauditor 3.2.2.0 - 'Event Description' Denial of ServiceNsauditor
- CVE-2021-47894Managed Switch Port Mapping Tool 2.85.2 - Denial of ServiceNorthwest Performance Software Managed Switch Port Mapping…
- CVE-2021-47893AgataSoft PingMaster Pro 2.1 - Denial of ServiceAgataSoft PingMaster Pro
- CVE-2021-47892PEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site ScriptingPEEL eCommerce PEEL Shopping
- CVE-2021-47881dataSIMS Avionics ARINC 664-1 - Local Buffer OverflowData Device dataSIMS Avionics ARINC
- CVE-2018-25132MyBB Trending Widget Plugin 1.2 - Cross-Site Scriptingzainali99 MyBB Trending Widget Plugin
- CVE-2018-25116MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scriptingjamiesage123 MyBB Thread Redirect Plugin
- CVE-2025-71177LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and SearchLavaLite CMS · lavalite/cms
- CVE-2026-1299email BytesGenerator header injection due to unquoted newlinesPython Software Foundation CPython
- CVE-2026-22995ublk: fix use-after-free in ublk_partition_scan_workLinux
- CVE-2026-22994bpf: Fix reference count leak in bpf_prog_test_run_xdp()Linux
- CVE-2026-22993idpf: Fix RSS LUT NULL ptr issue after soft resetLinux
- CVE-2026-22989nfsd: check that server is running in unlock_filesystemLinux
- CVE-2026-22987net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroyLinux
- CVE-2026-22986gpiolib: fix race condition for gdev->srcuLinux
- CVE-2026-22985idpf: Fix RSS LUT NULL pointer crash on early ethtool operationsLinux
- CVE-2026-22983net: do not write to msg_get_inq in calleeLinux
- CVE-2026-22982net: mscc: ocelot: Fix crash when adding interface under a lagLinux
- CVE-2026-22981idpf: detach and close netdevs while handling a resetLinux
- CVE-2026-22979net: fix memory leak in skb_segment_list for GRO packetsLinux
- CVE-2026-22978wifi: avoid kernel-infoleak from struct iw_pointLinux
- CVE-2025-71160netfilter: nf_tables: avoid chain re-validation if possibleLinux
- CVE-2026-24636WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerabilitySyed Balkhi Sugar Calendar
- CVE-2026-24634WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerabilityRustaurius Ultimate Reviews
- CVE-2026-24633WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerabilityPassionate Brains Add Expires Headers & Optimized Minify
- CVE-2026-24632WordPress Delay Redirects plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityjagdish1o1 Delay Redirects
- CVE-2026-24631WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes Rosebud
- CVE-2026-24630WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerabilityDesign Stylish Cost Calculator
- CVE-2026-24629WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityAbility Web Accessibility with Max Access
- CVE-2026-24627WordPress Trusona for WordPress plugin <= 2.0.0 - Broken Access Control vulnerabilityTrusona for WordPress
- CVE-2026-24626WordPress Logo Slider plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityLogicHunt Logo Slider
- CVE-2026-24625WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerabilityImaginate Solutions File Uploads Addon for WooCommerce
- CVE-2026-24622WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerabilitySergiy Dzysyak Suggestion Toolkit
- CVE-2026-24621WordPress Terms descriptions plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerabilityVladimir Statsenko Terms descriptions
- CVE-2026-24620WordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerabilityPluginOps Landing Page Builder
- CVE-2026-24619WordPress PopCash.Net Code Integration Tool plugin <= 1.8 - Broken Access Control vulnerabilityPopCash.Net Code Integration Tool
- CVE-2026-24617WordPress Easy Modal plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityDaniel Iser Easy Modal
- CVE-2026-24616WordPress WP Popups plugin <= 2.2.0.5 - Broken Access Control vulnerabilityDamian WP Popups
- CVE-2026-24615WordPress Cream Magazine theme <= 2.1.10 - Broken Access Control vulnerabilitythemebeez Cream Magazine
- CVE-2026-24614WordPress Flex QR Code Generator plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityDevsbrain Flex QR Code Generator
- CVE-2026-24613WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerabilityEcwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping…
- CVE-2026-24612WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerabilitythemebeez Orchid Store
- CVE-2026-24607WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerabilitywptravelengine Travel Monster
- CVE-2026-24606WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerabilityWeb Impian Bayarcash WooCommerce
- CVE-2026-24605WordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerabilitypencilwp X Addons for Elementor
- CVE-2026-24604WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerabilitythemebeez Simple GDPR Cookie Compliance
- CVE-2026-24603WordPress Universal Google Adsense and Ads manager plugin <= 1.1.8 - Broken Access Control vulnerabilitythemebeez Universal Google Adsense and Ads manager
- CVE-2026-24601WordPress Penci Pay Writer plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Pay Writer
- CVE-2026-24600WordPress Penci Review plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Review
- CVE-2026-24599WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerabilityXLPlugins NextMove Lite
- CVE-2026-24598WordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerabilityMultilanguage by BestWebSoft
- CVE-2026-24596WordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerabilitymarynixie Related Posts Thumbnails Plugin for WordPress
- CVE-2026-24595WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerabilityzohocrm Zoho CRM Lead Magnet
- CVE-2026-24594WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for WPBakery Page Builder
- CVE-2026-24593WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerabilityStrategy11 Team AWP Classifieds
- CVE-2026-24591WordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityyasir129 Turn Yoast SEO FAQ Block to Accordion
- CVE-2026-24589WordPress Cargus plugin <= 1.5.8 - Sensitive Data Exposure vulnerabilityCargus eCommerce Cargus
- CVE-2026-24588WordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerabilitytopdevs Smart Product Viewer
- CVE-2026-24587WordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerabilitykutsy AJAX Hits Counter + Popular Posts Widget
- CVE-2026-24585WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerabilityHyyan Abo Fakher Hyyan WooCommerce Polylang Integration
- CVE-2026-24584WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS BunnyNet Integration
- CVE-2026-24583WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerabilitySumUp Payment Gateway For WooCommerce
- CVE-2026-24581WordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerabilityWP Swings Points and Rewards for WooCommerce
- CVE-2026-24580WordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerabilityEcwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping…
- CVE-2026-24579WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerabilityWP Messiah Ai Image Alt Text Generator for WP
- CVE-2026-24578WordPress Admin login URL Change plugin <= 1.1.5 - Broken Access Control vulnerabilityJahid Hasan Admin login URL Change
- CVE-2026-24577WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerabilityGenetech Products Pie Register
- CVE-2026-24576WordPress UX Flat plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerabilityCOP UX Flat
- CVE-2026-24571WordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerabilityboxnow BOX NOW Delivery
- CVE-2026-24570WordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerabilityWisdmLabs Edwiser Bridge
- CVE-2026-24569WordPress Media Library File Size plugin <= 1.6.7 - Broken Access Control vulnerabilitySully Media Library File Size
- CVE-2026-24568WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerabilityWP Travel
- CVE-2026-24567WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerabilitybriarinc Anything Order by Terms
- CVE-2026-24566WordPress iNET Webkit plugin <= 1.2.4 - Broken Access Control vulnerabilityiNET Webkit
- CVE-2026-24565WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerabilitybPlugins B Accordion
- CVE-2026-24564WordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerabilityIsrapil Textmetrics
- CVE-2026-24563WordPress LifePress plugin <= 2.2.1 - Broken Access Control vulnerabilityAshan Perera LifePress
- CVE-2026-24562WordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerabilityRyviu – Product Reviews for WooCommerce
- CVE-2026-24561WordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerabilityMahmudul Hasan Arif FluentBoards
- CVE-2026-24560WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerabilityCloudinary
- CVE-2026-24559WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.3 - Sensitive Data Exposure vulnerabilityCRM Perks Integration for Contact Form 7 HubSpot
- CVE-2026-24558WordPress ABG Rich Pins plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityantoniobg ABG Rich Pins
- CVE-2026-24557WordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerabilityWEN Solutions Contact Form 7 GetResponse Extension
- CVE-2026-24556WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerabilitywpdive ElementCamp
- CVE-2026-24555WordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerabilityArtPlacer Widget
- CVE-2026-24553WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerabilityDotstore Fraud Prevention For Woocommerce
- CVE-2026-24551WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerabilitymonetagwp Monetag Official Plugin
- CVE-2026-24550WordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerabilityKaira Blockons
- CVE-2026-24549WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerabilityPaolo GeoDirectory
- CVE-2026-24548WordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerabilityprinceahmed Radio Player
- CVE-2026-24544WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerabilityHarmonic Design HD Quiz
- CVE-2026-24543WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerabilityHorea Radu Materialis Companion
- CVE-2026-24542WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityJohn James Jacoby WP Term Order
- CVE-2026-24541WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerabilitymkscripts Download After Email
- CVE-2026-24540WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerabilityprinceahmed Integrate Google Drive
- CVE-2026-24539WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerabilityABCdatos Protección de datos – RGPD
- CVE-2026-24536WordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerabilityWebpushr
- CVE-2026-24535WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerabilitywebdevstudios Automatic Featured Images from Videos
- CVE-2026-24534WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerabilityuPress Booter
- CVE-2026-24532WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerabilitySiteLock Security – WP Hardening, Login Security & Malware…
- CVE-2026-24530WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerabilitysheepfish WebP Conversion
- CVE-2026-24529WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerabilityAlejandro Quick Restaurant Reservations
- CVE-2026-24528WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerabilitypixelgrade Nova Blocks
- CVE-2026-24526WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerabilitySteve Truman Email Inquiry & Cart Options for WooCommerce
- CVE-2026-24525WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerabilityCloudPanel CLP Varnish Cache
- CVE-2026-24524WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerabilityEssekia Tablesome
- CVE-2026-24523WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerabilityMarcus (aka @msykes) WP FullCalendar
- CVE-2026-24522WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerabilityMyThemeShop WP Subscribe
- CVE-2026-24521WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityTimur Kamaev Kama Thumbnail
- CVE-2025-71157RDMA/core: always drop device refcount in ib_del_sub_device_and_put()Linux
- CVE-2025-71156gve: defer interrupt enabling until NAPI registrationLinux
- CVE-2025-71154net: usb: rtl8150: fix memory leak on usb_submit_urb() failureLinux
- CVE-2025-71153ksmbd: Fix memory leak in get_file_all_info()Linux
- CVE-2025-71152net: dsa: properly keep track of conduit referenceLinux
- CVE-2025-71151cifs: Fix memory and information leak in smb3_reconfigure()Linux
- CVE-2025-71148net/handshake: restore destructor on submit failureLinux
- CVE-2025-71147KEYS: trusted: Fix a memory leak in tpm2_load_cmdLinux
- CVE-2025-13921weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Updatewedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2026-0914WP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcodelegalweb WP DSGVO Tools
- CVE-2025-2204XSS in Tapandsign Technologies' Tap&Sign AppTapandsign Technologies Software Tap&Sign
- CVE-2025-46699Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulDell Data Protection Advisor
- CVE-2026-22276Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive InformDell ObjectScale
- CVE-2026-22275Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Inclusion of Sensitive Information iDell ObjectScale
- CVE-2026-22274Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive IDell ObjectScale
- CVE-2026-24515In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.libexpat project libexpat
- CVE-2025-14745RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcoderebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…
- CVE-2025-14069Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schemamagazine3 Schema & Structured Data for WP & AMP
- CVE-2026-0927KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Uploadiqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2025-15522Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeuncannyowl Uncanny Automator – Easy Automation, Integration…
- CVE-2026-0790ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0789ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-0788ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting VulnerabilityALGO 8180 IP Audio Alerter
- CVE-2026-24137sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalsigstore · github.com/sigstore/sigstore
- CVE-2025-52022A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed
- CVE-2025-52023A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed erro
- CVE-2025-67124A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arminiserve
- CVE-2025-67125A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG
- CVE-2025-67231A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context
- CVE-2025-70458A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain A