CVEs published January 28, 2026
202 CVEs were published on January 28, 2026: 13 critical, 79 high. 2 are now in CISA KEV.
- Published
- 202
- Critical
- 13
- High
- 79
- Medium
- 108
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 72
Most affected products
- discourse
- 14
- Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- 11
- SolarWinds Web Help Desk
- 6
- Explorance Blue
- 5
- nocodb
- 4
- code-projects Online Music Site
- 3
- dokploy
- 3
- opf openproject
- 3
- Broadcom Symantec Endpoint Protection Windows Client
- 2
- D-Link DIR-615
- 2
Critical 13
- CVE-2026-24897Authenticated Remote Code Execution via Arbitrary File UploadErugoOSS Erugo
- CVE-2025-57795Unauthenticated Remote File Download in Explorance BlueExplorance Blue
- CVE-2025-57794Unrestricted File Upload Vulnerability in Explorance BlueExplorance Blue
- CVE-2025-57792SQL Injection Vulnerability in Explorance BlueExplorance Blue
- CVE-2026-24685OpenProject has Argument Injection on Repository module that allows Arbitrary File Writeopf openproject
- CVE-2026-1056Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversalinc2734 Snow Monkey Forms
- CVE-2025-40554SolarWinds Web Help Desk Authentication Bypass VulnerabilitySolarWinds Web Help Desk
- CVE-2025-40553SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2025-40552SolarWinds Web Help Desk Authentication Bypass VulnerabilitySolarWinds Web Help Desk
- CVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2026-24841Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpointdokploy
- CVE-2025-61140The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.jsonpath
- CVE-2025-69602A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier
High 79
- CVE-2026-24856iccDEV has UB runtime error in <icTagTypeSignature>InternationalColorConsortium iccDEV
- CVE-2026-24835Podman Desktop Extension System Vulnerable to Authentication Bypasspodman-desktop
- CVE-2026-24769NocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadnocodb
- CVE-2025-14840HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126Drupal HTTP Client Manager · drupal/http_client_manager
- CVE-2025-14472Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125Drupal Acquia Content Hub · drupal/acquia_contenthub
- CVE-2025-13982Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120Drupal Login Time Restriction · drupal/login_time_restricti…
- CVE-2025-46691Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability.Dell PremierColor
- CVE-2025-61726Memory exhaustion in query parameter parsing in net/urlGo standard library net/url · stdlib
- CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/goGo toolchain cmd/go · toolchain
- CVE-2025-68119Unexpected code execution when invoking toolchain in cmd/goGo toolchain cmd/go · toolchain
- CVE-2025-69218Discourse moderators can access admin-only reports exposing private upload URLsdiscourse
- CVE-2025-68662FinalDestination hostname matching allows SSRF protection bypassdiscourse
- CVE-2026-0750Payment bypass in Commerce PayboxDrupal Commerce Paybox
- CVE-2025-68479Discourse subscriptions are susceptible to takeoverdiscourse
- CVE-2026-24772OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Serveropf openproject
- CVE-2025-33220NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the mNVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +2
- CVE-2025-33219NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wrNVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +3
- CVE-2025-33218NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an intNVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +2
- CVE-2025-33217NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free.NVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +1
- CVE-2020-36973PDW File Browser 1.3 - Remote Code Executionmichalc PDW File Browser
- CVE-2020-36972SmartBlog 2.0.1 - 'id_post' Blind SQL injectionsmartdatasoft SmartBlog
- CVE-2020-36971Nidesoft 3GP Video Converter 2.6.18 - Local Stack Buffer OverflowNidesoft 3GP Video Converter
- CVE-2020-36969M/Monit 3.7.4 - Privilege EscalationTildeslash M/Monit
- CVE-2020-36968M/Monit 3.7.4 - Password DisclosureTildeslash M/Monit
- CVE-2020-36967Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH)Zortam.com Zortam Mp3 Media Studio
- CVE-2020-36965docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter)VeryPDF.com docPrint Pro
- CVE-2020-36964YATinyWinFTP - Denial of Serviceik80 YATinyWinFTP
- CVE-2020-36963Intelbras Router RF 301K 1.1.2 - Authentication BypassIntelbras Router RF
- CVE-2020-3696110-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)10-Strike Software Network Inventory Explorer
- CVE-2020-36945WebDamn User Registration & Login System with User Panel - SQLi Auth BypassWEBDAMN.COM WebDamn User Registration & Login System with U…
- CVE-2025-57793SQL Injection Vulnerability in Explorance BlueExplorance Blue
- CVE-2025-13917Elevation of Privileges in Web Security Services (WSS) AgentBroadcom Symantec Web Security Services Agent
- CVE-2026-22243EGroupware has SQL Injection in Nextmatch Filter Processingegroupware · egroupware/egroupware
- CVE-2025-58150x86: buffer overrun with shadow paging + tracingXen
- CVE-2026-23014perf: Ensure swevent hrtimer is properly destroyedLinux
- CVE-2020-36992Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Pathnordvpn
- CVE-2020-36991ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service PathShareMouse
- CVE-2020-36990Input Director 1.4.3 - 'Input Director' Unquoted Service PathInputdirector Input Director
- CVE-2020-36989ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service PathForensiTAppxService
- CVE-2020-36987Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service PathGearboxcomputers Program Access Controller
- CVE-2020-36986Prey 1.9.6 - "CronService" Unquoted Service PathPreyproject Prey
- CVE-2020-36985IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service PathGearboxcomputers IP Watcher
- CVE-2020-36984EPSON 1.124 - 'seksmdb.exe' Unquoted Service PathEPSON
- CVE-2025-59901authenticated reflected XSS vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59895Remote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59894Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59893Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59892Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59891Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-26386Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) toolJohnson Controls iSTAR Configuration Utility
- CVE-2026-1280Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameternmedia Frontend File Manager Plugin
- CVE-2026-0844Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_fieldnmedia Simple User Registration
- CVE-2025-14386Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.12 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeovershahrukhlinkgraph Search Atlas SEO – Premier SEO Plugin for…
- CVE-2025-7740Use of default credentials vulnerability in Hitachi Energy SuprOS productHitachi Energy SuprOS
- CVE-2026-1400AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpointtigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2026-0702VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'wpcreatix VidShop – Shoppable Videos for WooCommerce
- CVE-2025-40537SolarWinds Web Help Desk Hardcoded Credentials VulnerabilitySolarWinds Web Help Desk
- CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass VulnerabilitySolarWinds Web Help Desk
- CVE-2026-0832New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosuresaadiqbal New User Approve
- CVE-2025-14610TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameterbloompixel TableMaster for Elementor – Advanced Responsive…
- CVE-2026-15142100 Technology｜Official Document Management System - Incorrect Authorization2100 Technology Official Document Management System
- CVE-2026-1506D-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injectionD-Link DIR-615
- CVE-2026-1505D-Link DIR-615 URL Filter set_temp_nodes.php os command injectionD-Link DIR-615
- CVE-2026-21569This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.Atlassian Crowd Data Center
- CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversalisaacs node-tar · tar
- CVE-2026-24840Dokploy uses hardcoded credentials in installation script, which could result in database accessdokploy
- CVE-2022-40619FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affe
- CVE-2022-40620FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when down
- CVE-2025-57283The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability.browserstack-local
- CVE-2025-65886A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes.
- CVE-2025-65888A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negativ
- CVE-2025-65889A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted in
- CVE-2025-65890A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an
- CVE-2025-65891A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_pro
- CVE-2025-69517An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content
- CVE-2025-70999A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of S
- CVE-2025-71000An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-71003An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a
- CVE-2025-71007An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) v
Medium, low and unrated 110
- CVE-2025-15344Tanium addressed a SQL injection vulnerability in Asset.Tanium Asset
- CVE-2026-1551itsourcecode School Management System controller.php sql injectionitsourcecode School Management System
- CVE-2026-1550PHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorizationPHPGurukul Hospital Management System
- CVE-2026-1549jishenghua jshERP PluginController uploadPluginConfigFile path traversaljishenghua jshERP
- CVE-2026-1548Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injectionTotolink A7000R
- CVE-2026-1547Totolink A7000R cstecgi.cgi setUnloadUserData command injectionTotolink A7000R
- CVE-2026-1546jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injectionjishenghua jshERP
- CVE-2026-24889soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64stellar rs-soroban-sdk · soroban-sdk
- CVE-2026-24888Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObjectmicrosoft maker.js · makerjs
- CVE-2026-1545itsourcecode School Management System index.php sql injectionitsourcecode School Management System
- CVE-2026-1544D-Link DIR-823X set_mode sub_41E2A0 os command injectionD-Link DIR-823X
- CVE-2026-24857bulk_extractor has Heap-based Buffer Overflow vulnerabilitysimsong bulk_extractor
- CVE-2026-1535code-projects Online Music Site AdminReply.php sql injectioncode-projects Online Music Site
- CVE-2026-1534code-projects Online Music Site AdminEditUser.php sql injectioncode-projects Online Music Site
- CVE-2026-1533code-projects Online Music Site AdminAddCategory.php sql injectioncode-projects Online Music Site
- CVE-2026-1532D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversalD-Link DCS-700L
- CVE-2026-24768NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameternocodb
- CVE-2026-24767NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionalitynocodb
- CVE-2026-24766NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoSnocodb
- CVE-2026-24739Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operationssymfony · symfony/process +1
- CVE-2026-24742Discourse staff action logs expose sensitive information to moderatorsdiscourse
- CVE-2026-23743Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized usersdiscourse
- CVE-2025-13986Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124Drupal Disable Login Page · drupal/disable_login
- CVE-2025-13985Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123Drupal Entity Share · drupal/entity_share
- CVE-2025-13984Next.js - Critical - Access bypass - SA-CONTRIB-2025-122Drupal Next.js · drupal/next
- CVE-2025-13983Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121Drupal Tagify · drupal/tagify
- CVE-2025-13981AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119Drupal AI · drupal/ai
- CVE-2025-13980CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118Drupal CKEditor 5 Premium Features · drupal/ckeditor5_premi…
- CVE-2025-13979Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117Drupal Mini site · drupal/minisite
- CVE-2023-37525HCL BigFix Compliance is vulnerable to a sensitive information disclosureHCLSoftware BigFix Compliance
- CVE-2026-21865Discourse topic conversion permission vulnerability for moderatorsdiscourse
- CVE-2025-69289Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email changediscourse
- CVE-2025-61728Excessive CPU consumption when building archive index in archive/zipGo standard library archive/zip · stdlib
- CVE-2025-61730Handshake messages may be processed at the incorrect encryption level in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2025-68934Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpointdiscourse
- CVE-2025-68933Discourse non-admin moderators can exfiltrate private content via post ownership transferdiscourse
- CVE-2025-68666Discourse users archives leaked to users with moderation privilegesdiscourse
- CVE-2026-0749Cross-Site Scripting Vulnerability in Drupal Form Builder ModuleDrupal
- CVE-2025-68660Discourse AI Discover's continue conversation allows threat actor to impersonate userdiscourse
- CVE-2025-68659Discourse has DoS vulnerability in username change endpointdiscourse
- CVE-2025-67723Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugindiscourse
- CVE-2025-66488Discourse allows script execution in uploaded HTML/XML files on S3discourse
- CVE-2026-24775OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extensionopf openproject
- CVE-2025-33237NVIDIA HD Audio Driver for Windows contains a vulnerability where an attacker could exploit a NULL pointer dereference issue.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS
- CVE-2025-57796Use of a hardcoded static key to protect sensitive data in Explorance BlueExplorance Blue
- CVE-2020-36970PMB 5.6 - 'chemin' Local File DisclosurePMB Services
- CVE-2020-36962Tendenci 12.3.1 - CSV/ Formula InjectionTendenci
- CVE-2020-36944ILIAS Learning Management System 4.3 - SSRFilias.de ILIAS Learning Management System
- CVE-2020-36943aSc TimeTables 2021.6.2 - Denial of Serviceasc Applied Software Consultants, s.r.o. asc Timetables
- CVE-2025-46306The issue was addressed with improved bounds checks.Apple Keynote · Apple iOS and iPadOS +1
- CVE-2025-46316An out-of-bounds read was addressed with improved input validation.Apple Pages · Apple iOS and iPadOS +1
- CVE-2025-13919Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows ClientBroadcom Symantec Endpoint Protection Windows Client
- CVE-2025-13918Elevation of Privileges in Symantec Endpoint Protection Windows ClientBroadcom Symantec Endpoint Protection Windows Client
- CVE-2026-1522Open5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of serviceOpen5GS
- CVE-2026-23553x86: incomplete IBPB for vCPU isolationXen
- CVE-2026-1539Libsoup: libsoup: credential leakage via http redirectsRed Hat Enterprise Linux
- CVE-2026-1536Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition headerRed Hat Enterprise Linux
- CVE-2026-1237Vulnerable cross-model authorization in juju.Canonical juju · github.com/juju/juju
- CVE-2026-1521Open5GS SGWC s5c-handler.c denial of serviceOpen5GS
- CVE-2026-1520rethinkdb Secondary Index cross site scriptingrethinkdb
- CVE-2026-1060WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST APIlitonice13 WP Adminify – White Label WordPress, Admin Menu…
- CVE-2025-14795Stop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlistwebguyio Stop Spammers Classic
- CVE-2020-36993LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site ScriptingLimeSurvey
- CVE-2020-36988PDW File Browser <= v1.3 - Cross-Site Scripting (XSS)GuidoNeele PDW File Browser
- CVE-2025-14865Passster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpchill Passster – Password Protect Pages and Content
- CVE-2025-59900Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59899Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59898Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59897Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2025-59896Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerFlexense Sync Breeze Enterprise Server · Flexense Disk Puls…
- CVE-2026-0483Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChatLiveHelperChat
- CVE-2026-1398Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Updatechrisnowak Change WP URL
- CVE-2026-1399WP Google Ad Manager Plugin <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settingsmiles99 WP Google Ad Manager Plugin
- CVE-2025-14616Recooty <= 1.0.6 - Cross-Site Request Forgery to Settings UpdateRecooty – Job Widget
- CVE-2025-14283BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpblockart BlockArt Blocks – Gutenberg Blocks, Page Builder…
- CVE-2025-14063SEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' Parameterseomantis SEO Links Interlinking
- CVE-2026-1380Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Updatelxicon Bitcoin Donate Button
- CVE-2026-1391Vzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']mamunreza Vzaar Media Management
- CVE-2025-15511Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status ModificationRupantorpay
- CVE-2026-1377imwptip <= 1.1 - Cross-Site Request Forgery to Settings Updatehu_chao imwptip
- CVE-2025-41351Weak encryption on Funambol's cloud serverFunambol Cloud Server
- CVE-2026-1053Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parametersvinod-dalvi Ivory Search – WordPress Search Plugin
- CVE-2026-1381Order Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fieldswpcodefactory Order Minimum/Maximum Amount Limits for WooCo…
- CVE-2026-0818CSS-based exfiltration of the content from partially encrypted emails when allowing remote contentMozilla Thunderbird
- CVE-2026-1054RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modificationmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2026-1389Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletionbplugins Document Embedder – Embed PDFs, Word, Excel, and O…
- CVE-2026-1310Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletionmigaweb Simple calendar for Elementor
- CVE-2025-14039Simple Folio <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fieldspresstigers Simple Folio
- CVE-2025-12709Interactions – Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingbfintal Interactions – Create Interactive Experiences in th…
- CVE-2025-9082WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingWPBITS Addons For Elementor Page Builder
- CVE-2026-1295Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessupercleanse Buy Now Plus — Payments with Stripe
- CVE-2026-0825Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Exportcrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2026-1244Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributecodeccoop Forms Bridge – Infinite integrations
- CVE-2026-1466Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauJirafeau project Jirafeau
- CVE-2025-13471User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option UpdateUser Activity Log
- CVE-2026-1083Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configurationcodepeople Appointment Hour Booking – Booking Calendar
- CVE-2026-1298Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacementiulia-cazan Easy Replace Image
- CVE-2025-8072Target Video Easy Publish <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameternebojsadabic Target Video Easy Publish
- CVE-2026-1513billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.NAVER billboard.js · billboard.js
- CVE-2026-24852iccDEV has a heap-buffer-overflow in icXmlParseTextString()InternationalColorConsortium iccDEV
- CVE-2026-24850ML-DSA Signature Verification Accepts Signatures with Repeated Hint IndicesRustCrypto signatures · ml-dsa
- CVE-2026-24839Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headersdokploy
- CVE-2025-65887A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS)
- CVE-2025-69601A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode.
- CVE-2025-70336A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbi
- CVE-2025-71001A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2025-71002A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) vi
- CVE-2025-71004A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a cra
- CVE-2025-71005A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a c
- CVE-2025-71006A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via