# CVEs published 2026-01-28

202 CVEs were published on January 28, 2026: 13 critical, 79 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-15344](https://cve.now/CVE-2025-15344.md): Tanium addressed a SQL injection vulnerability in Asset. (CVSS 6.3, Tanium Asset)
- [CVE-2026-1551](https://cve.now/CVE-2026-1551.md): itsourcecode School Management System controller.php sql injection (CVSS 5.3, itsourcecode School Management System)
- [CVE-2026-1550](https://cve.now/CVE-2026-1550.md): PHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization (CVSS 5.3, PHPGurukul Hospital Management System)
- [CVE-2026-1549](https://cve.now/CVE-2026-1549.md): jishenghua jshERP PluginController uploadPluginConfigFile path traversal (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-1548](https://cve.now/CVE-2026-1548.md): Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection (CVSS 5.3, Totolink A7000R)
- [CVE-2026-24897](https://cve.now/CVE-2026-24897.md): Authenticated Remote Code Execution via Arbitrary File Upload (CVSS 10.0, ErugoOSS Erugo)
- [CVE-2026-1547](https://cve.now/CVE-2026-1547.md): Totolink A7000R cstecgi.cgi setUnloadUserData command injection (CVSS 5.3, Totolink A7000R)
- [CVE-2026-1546](https://cve.now/CVE-2026-1546.md): jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-24889](https://cve.now/CVE-2026-24889.md): soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen\_range for u64 (CVSS 5.3, stellar rs-soroban-sdk · soroban-sdk)
- [CVE-2026-24888](https://cve.now/CVE-2026-24888.md): Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject (CVSS 6.5, microsoft maker.js · makerjs)
- [CVE-2026-1545](https://cve.now/CVE-2026-1545.md): itsourcecode School Management System index.php sql injection (CVSS 6.9, itsourcecode School Management System)
- [CVE-2026-1544](https://cve.now/CVE-2026-1544.md): D-Link DIR-823X set\_mode sub\_41E2A0 os command injection (CVSS 5.3, D-Link DIR-823X)
- [CVE-2026-24857](https://cve.now/CVE-2026-24857.md): bulk\_extractor has Heap-based Buffer Overflow vulnerability (CVSS 5.5, simsong bulk\_extractor)
- [CVE-2026-24856](https://cve.now/CVE-2026-24856.md): iccDEV has UB runtime error in \<icTagTypeSignature\> (CVSS 7.8, InternationalColorConsortium iccDEV)
- [CVE-2026-1535](https://cve.now/CVE-2026-1535.md): code-projects Online Music Site AdminReply.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-1534](https://cve.now/CVE-2026-1534.md): code-projects Online Music Site AdminEditUser.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-24835](https://cve.now/CVE-2026-24835.md): Podman Desktop Extension System Vulnerable to Authentication Bypass (CVSS 8.8, podman-desktop)
- [CVE-2026-24769](https://cve.now/CVE-2026-24769.md): NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload (CVSS 8.5, nocodb)
- [CVE-2026-1533](https://cve.now/CVE-2026-1533.md): code-projects Online Music Site AdminAddCategory.php sql injection (CVSS 5.1, code-projects Online Music Site)
- [CVE-2026-1532](https://cve.now/CVE-2026-1532.md): D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal (CVSS 4.8, D-Link DCS-700L)
- [CVE-2026-24768](https://cve.now/CVE-2026-24768.md): NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter (CVSS 5.7, nocodb)
- [CVE-2026-24767](https://cve.now/CVE-2026-24767.md): NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality (CVSS 4.9, nocodb)
- [CVE-2026-24766](https://cve.now/CVE-2026-24766.md): NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS (CVSS 4.9, nocodb)
- [CVE-2026-24739](https://cve.now/CVE-2026-24739.md): Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations (CVSS 6.3, symfony · symfony/process +1)
- [CVE-2026-24742](https://cve.now/CVE-2026-24742.md): Discourse staff action logs expose sensitive information to moderators (CVSS 6.5, discourse)
- [CVE-2026-23743](https://cve.now/CVE-2026-23743.md): Discourse allows permalinks to restricted resources to leak resource slugs to unauthorized users (CVSS 6.9, discourse)
- [CVE-2025-14840](https://cve.now/CVE-2025-14840.md): HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126 (CVSS 7.5, Drupal HTTP Client Manager · drupal/http\_client\_manager)
- [CVE-2025-14472](https://cve.now/CVE-2025-14472.md): Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125 (CVSS 8.1, Drupal Acquia Content Hub · drupal/acquia\_contenthub)
- [CVE-2025-13986](https://cve.now/CVE-2025-13986.md): Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124 (CVSS 4.2, Drupal Disable Login Page · drupal/disable\_login)
- [CVE-2025-13985](https://cve.now/CVE-2025-13985.md): Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123 (CVSS 5.3, Drupal Entity Share · drupal/entity\_share)
- [CVE-2025-13984](https://cve.now/CVE-2025-13984.md): Next.js - Critical - Access bypass - SA-CONTRIB-2025-122 (CVSS 6.1, Drupal Next.js · drupal/next)
- [CVE-2025-13983](https://cve.now/CVE-2025-13983.md): Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121 (CVSS 5.4, Drupal Tagify · drupal/tagify)
- [CVE-2025-13982](https://cve.now/CVE-2025-13982.md): Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120 (CVSS 8.1, Drupal Login Time Restriction · drupal/login\_time\_restricti…)
- [CVE-2025-13981](https://cve.now/CVE-2025-13981.md): AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119 (CVSS 4.4, Drupal AI · drupal/ai)
- [CVE-2025-13980](https://cve.now/CVE-2025-13980.md): CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118 (CVSS 5.3, Drupal CKEditor 5 Premium Features · drupal/ckeditor5\_premi…)
- [CVE-2025-13979](https://cve.now/CVE-2025-13979.md): Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117 (CVSS 5.4, Drupal Mini site · drupal/minisite)
- [CVE-2023-37525](https://cve.now/CVE-2023-37525.md): HCL BigFix Compliance is vulnerable to a sensitive information disclosure (CVSS 5.3, HCLSoftware BigFix Compliance)
- [CVE-2026-21865](https://cve.now/CVE-2026-21865.md): Discourse topic conversion permission vulnerability for moderators (CVSS 6.5, discourse)
- [CVE-2025-69289](https://cve.now/CVE-2025-69289.md): Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change (CVSS 5.1, discourse)
- [CVE-2025-46691](https://cve.now/CVE-2025-46691.md): Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. (CVSS 7.8, Dell PremierColor)
- [CVE-2025-61728](https://cve.now/CVE-2025-61728.md): Excessive CPU consumption when building archive index in archive/zip (CVSS 6.5, Go standard library archive/zip · stdlib)
- [CVE-2025-61726](https://cve.now/CVE-2025-61726.md): Memory exhaustion in query parameter parsing in net/url (CVSS 7.5, Go standard library net/url · stdlib)
- [CVE-2025-61730](https://cve.now/CVE-2025-61730.md): Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVSS 5.3, Go standard library crypto/tls · stdlib)
- [CVE-2025-61731](https://cve.now/CVE-2025-61731.md): Arbitrary file write using cgo pkg-config directive in cmd/go (CVSS 7.8, Go toolchain cmd/go · toolchain)
- [CVE-2025-68119](https://cve.now/CVE-2025-68119.md): Unexpected code execution when invoking toolchain in cmd/go (CVSS 7.0, Go toolchain cmd/go · toolchain)
- [CVE-2025-69218](https://cve.now/CVE-2025-69218.md): Discourse moderators can access admin-only reports exposing private upload URLs (CVSS 7.1, discourse)
- [CVE-2025-68934](https://cve.now/CVE-2025-68934.md): Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint (CVSS 6.5, discourse)
- [CVE-2025-68933](https://cve.now/CVE-2025-68933.md): Discourse non-admin moderators can exfiltrate private content via post ownership transfer (CVSS 6.9, discourse)
- [CVE-2025-68666](https://cve.now/CVE-2025-68666.md): Discourse users archives leaked to users with moderation privileges (CVSS 5.9, discourse)
- [CVE-2025-68662](https://cve.now/CVE-2025-68662.md): FinalDestination hostname matching allows SSRF protection bypass (CVSS 7.6, discourse)
- [CVE-2026-0749](https://cve.now/CVE-2026-0749.md): Cross-Site Scripting Vulnerability in Drupal Form Builder Module (CVSS 4.8, Drupal)
- [CVE-2025-68660](https://cve.now/CVE-2025-68660.md): Discourse AI Discover's continue conversation allows threat actor to impersonate user (CVSS 5.3, discourse)
- [CVE-2026-0750](https://cve.now/CVE-2026-0750.md): Payment bypass in Commerce Paybox (CVSS 8.7, Drupal Commerce Paybox)
- [CVE-2025-68659](https://cve.now/CVE-2025-68659.md): Discourse has DoS vulnerability in username change endpoint (CVSS 4.3, discourse)
- [CVE-2025-68479](https://cve.now/CVE-2025-68479.md): Discourse subscriptions are susceptible to takeover (CVSS 7.1, discourse)
- [CVE-2025-67723](https://cve.now/CVE-2025-67723.md): Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin (CVSS 4.6, discourse)
- [CVE-2025-66488](https://cve.now/CVE-2025-66488.md): Discourse allows script execution in uploaded HTML/XML files on S3 (CVSS 4.6, discourse)
- [CVE-2026-24775](https://cve.now/CVE-2026-24775.md): OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension (CVSS 6.3, opf openproject)
- [CVE-2026-24772](https://cve.now/CVE-2026-24772.md): OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server (CVSS 8.9, opf openproject)
- [CVE-2025-33237](https://cve.now/CVE-2025-33237.md): NVIDIA HD Audio Driver for Windows contains a vulnerability where an attacker could exploit a NULL pointer dereference issue. (CVSS 5.5, NVIDIA GeForce · NVIDIA RTX, Quadro, NVS)
- [CVE-2025-33220](https://cve.now/CVE-2025-33220.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the m (CVSS 7.8, NVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +2)
- [CVE-2025-33219](https://cve.now/CVE-2025-33219.md): NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wr (CVSS 7.8, NVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +3)
- [CVE-2025-57796](https://cve.now/CVE-2025-57796.md): Use of a hardcoded static key to protect sensitive data in Explorance Blue (CVSS 6.8, Explorance Blue)
- [CVE-2025-33218](https://cve.now/CVE-2025-33218.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an int (CVSS 7.8, NVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +2)
- [CVE-2025-33217](https://cve.now/CVE-2025-33217.md): NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. (CVSS 7.8, NVIDIA GeForce · NVIDIA RTX PRO, RTX, Quadro +1)
- [CVE-2025-57795](https://cve.now/CVE-2025-57795.md): Unauthenticated Remote File Download in Explorance Blue (CVSS 9.9, Explorance Blue)
- [CVE-2020-36973](https://cve.now/CVE-2020-36973.md): PDW File Browser 1.3 - Remote Code Execution (CVSS 8.7, michalc PDW File Browser)
- [CVE-2020-36972](https://cve.now/CVE-2020-36972.md): SmartBlog 2.0.1 - 'id\_post' Blind SQL injection (CVSS 8.8, smartdatasoft SmartBlog)
- [CVE-2020-36971](https://cve.now/CVE-2020-36971.md): Nidesoft 3GP Video Converter 2.6.18 - Local Stack Buffer Overflow (CVSS 8.4, Nidesoft 3GP Video Converter)
- [CVE-2020-36970](https://cve.now/CVE-2020-36970.md): PMB 5.6 - 'chemin' Local File Disclosure (CVSS 6.9, PMB Services)
- [CVE-2020-36969](https://cve.now/CVE-2020-36969.md): M/Monit 3.7.4 - Privilege Escalation (CVSS 8.7, Tildeslash M/Monit)
- [CVE-2020-36968](https://cve.now/CVE-2020-36968.md): M/Monit 3.7.4 - Password Disclosure (CVSS 7.1, Tildeslash M/Monit)
- [CVE-2020-36967](https://cve.now/CVE-2020-36967.md): Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH) (CVSS 8.4, Zortam.com Zortam Mp3 Media Studio)
- [CVE-2020-36965](https://cve.now/CVE-2020-36965.md): docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter) (CVSS 8.4, VeryPDF.com docPrint Pro)
- [CVE-2020-36964](https://cve.now/CVE-2020-36964.md): YATinyWinFTP - Denial of Service (CVSS 8.7, ik80 YATinyWinFTP)
- [CVE-2020-36963](https://cve.now/CVE-2020-36963.md): Intelbras Router RF 301K 1.1.2 - Authentication Bypass (CVSS 8.7, Intelbras Router RF)
- [CVE-2020-36962](https://cve.now/CVE-2020-36962.md): Tendenci 12.3.1 - CSV/ Formula Injection (CVSS 5.3, Tendenci)
- [CVE-2020-36961](https://cve.now/CVE-2020-36961.md): 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH) (CVSS 8.4, 10-Strike Software Network Inventory Explorer)
- [CVE-2020-36945](https://cve.now/CVE-2020-36945.md): WebDamn User Registration & Login System with User Panel - SQLi Auth Bypass (CVSS 8.8, WEBDAMN.COM WebDamn User Registration & Login System with U…)
- [CVE-2020-36944](https://cve.now/CVE-2020-36944.md): ILIAS Learning Management System 4.3 - SSRF (CVSS 6.9, ilias.de ILIAS Learning Management System)
- [CVE-2020-36943](https://cve.now/CVE-2020-36943.md): aSc TimeTables 2021.6.2 - Denial of Service (CVSS 6.7, asc Applied Software Consultants, s.r.o. asc Timetables)
- [CVE-2025-57794](https://cve.now/CVE-2025-57794.md): Unrestricted File Upload Vulnerability in Explorance Blue (CVSS 9.1, Explorance Blue)
- [CVE-2025-57792](https://cve.now/CVE-2025-57792.md): SQL Injection Vulnerability in Explorance Blue (CVSS 10.0, Explorance Blue)
- [CVE-2025-46306](https://cve.now/CVE-2025-46306.md): The issue was addressed with improved bounds checks. (CVSS 5.5, Apple Keynote · Apple iOS and iPadOS +1)
- [CVE-2025-46316](https://cve.now/CVE-2025-46316.md): An out-of-bounds read was addressed with improved input validation. (CVSS 4.3, Apple Pages · Apple iOS and iPadOS +1)
- [CVE-2025-57793](https://cve.now/CVE-2025-57793.md): SQL Injection Vulnerability in Explorance Blue (CVSS 8.6, Explorance Blue)
- [CVE-2026-24685](https://cve.now/CVE-2026-24685.md): OpenProject has Argument Injection on Repository module that allows Arbitrary File Write (CVSS 9.4, opf openproject)
- [CVE-2025-13919](https://cve.now/CVE-2025-13919.md): Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client (CVSS 4.4, Broadcom Symantec Endpoint Protection Windows Client)
- [CVE-2025-13918](https://cve.now/CVE-2025-13918.md): Elevation of Privileges in Symantec Endpoint Protection Windows Client (CVSS 6.7, Broadcom Symantec Endpoint Protection Windows Client)
- [CVE-2026-1522](https://cve.now/CVE-2026-1522.md): Open5GS SGWC s5c-handler.c sgwc\_s5c\_handle\_modify\_bearer\_response denial of service (CVSS 6.9, Open5GS)
- [CVE-2025-13917](https://cve.now/CVE-2025-13917.md): Elevation of Privileges in Web Security Services (WSS) Agent (CVSS 7.0, Broadcom Symantec Web Security Services Agent)
- [CVE-2026-22243](https://cve.now/CVE-2026-22243.md): EGroupware has SQL Injection in Nextmatch Filter Processing (CVSS 8.7, egroupware · egroupware/egroupware)
- [CVE-2026-23553](https://cve.now/CVE-2026-23553.md): x86: incomplete IBPB for vCPU isolation (CVSS 2.9, Xen)
- [CVE-2025-58150](https://cve.now/CVE-2025-58150.md): x86: buffer overrun with shadow paging + tracing (CVSS 8.8, Xen)
- [CVE-2026-1539](https://cve.now/CVE-2026-1539.md): Libsoup: libsoup: credential leakage via http redirects (CVSS 5.8, Red Hat Enterprise Linux)
- [CVE-2026-1536](https://cve.now/CVE-2026-1536.md): Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header (CVSS 5.8, Red Hat Enterprise Linux)
- [CVE-2026-1237](https://cve.now/CVE-2026-1237.md): Vulnerable cross-model authorization in juju. (CVSS 2.1, Canonical juju · github.com/juju/juju)
- [CVE-2026-1521](https://cve.now/CVE-2026-1521.md): Open5GS SGWC s5c-handler.c denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-1520](https://cve.now/CVE-2026-1520.md): rethinkdb Secondary Index cross site scripting (CVSS 4.8, rethinkdb)
- [CVE-2026-1060](https://cve.now/CVE-2026-1060.md): WP Adminify \<= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API (CVSS 5.3, litonice13 WP Adminify – White Label WordPress, Admin Menu…)
- [CVE-2026-23014](https://cve.now/CVE-2026-23014.md): perf: Ensure swevent hrtimer is properly destroyed (CVSS 7.8, Linux)
- [CVE-2025-14795](https://cve.now/CVE-2025-14795.md): Stop Spammers Classic \<= 2026.1 - Cross-Site Request Forgery via Email Allowlist (CVSS 4.3, webguyio Stop Spammers Classic)
- [CVE-2020-36993](https://cve.now/CVE-2020-36993.md): LimeSurvey \<= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting (CVSS 5.1, LimeSurvey)
- [CVE-2020-36992](https://cve.now/CVE-2020-36992.md): Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path (CVSS 8.5, nordvpn)
- [CVE-2020-36991](https://cve.now/CVE-2020-36991.md): ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path (CVSS 8.5, ShareMouse)
- [CVE-2020-36990](https://cve.now/CVE-2020-36990.md): Input Director 1.4.3 - 'Input Director' Unquoted Service Path (CVSS 8.5, Inputdirector Input Director)
- [CVE-2020-36989](https://cve.now/CVE-2020-36989.md): ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path (CVSS 8.5, ForensiTAppxService)
- [CVE-2020-36988](https://cve.now/CVE-2020-36988.md): PDW File Browser \<= v1.3 - Cross-Site Scripting (XSS) (CVSS 4.8, GuidoNeele PDW File Browser)
- [CVE-2020-36987](https://cve.now/CVE-2020-36987.md): Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path (CVSS 8.5, Gearboxcomputers Program Access Controller)
- [CVE-2020-36986](https://cve.now/CVE-2020-36986.md): Prey 1.9.6 - "CronService" Unquoted Service Path (CVSS 8.5, Preyproject Prey)
- [CVE-2020-36985](https://cve.now/CVE-2020-36985.md): IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path (CVSS 8.5, Gearboxcomputers IP Watcher)
- [CVE-2020-36984](https://cve.now/CVE-2020-36984.md): EPSON 1.124 - 'seksmdb.exe' Unquoted Service Path (CVSS 8.5, EPSON)
- [CVE-2025-14865](https://cve.now/CVE-2025-14865.md): Passster – Password Protect Pages and Content \<= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpchill Passster – Password Protect Pages and Content)
- [CVE-2026-1056](https://cve.now/CVE-2026-1056.md): Snow Monkey Forms \<= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal (CVSS 9.8, inc2734 Snow Monkey Forms)
- [CVE-2025-59901](https://cve.now/CVE-2025-59901.md): authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server (CVSS 8.5, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59900](https://cve.now/CVE-2025-59900.md): Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server (CVSS 5.1, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59899](https://cve.now/CVE-2025-59899.md): Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server (CVSS 5.1, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59898](https://cve.now/CVE-2025-59898.md): Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server (CVSS 5.1, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59897](https://cve.now/CVE-2025-59897.md): Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server (CVSS 5.1, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59896](https://cve.now/CVE-2025-59896.md): Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server (CVSS 5.1, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59895](https://cve.now/CVE-2025-59895.md): Remote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise Server (CVSS 8.2, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59894](https://cve.now/CVE-2025-59894.md): Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server (CVSS 8.5, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59893](https://cve.now/CVE-2025-59893.md): Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server (CVSS 8.5, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59892](https://cve.now/CVE-2025-59892.md): Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server (CVSS 8.5, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2025-59891](https://cve.now/CVE-2025-59891.md): Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server (CVSS 8.5, Flexense Sync Breeze Enterprise Server · Flexense Disk Puls…)
- [CVE-2026-0483](https://cve.now/CVE-2026-0483.md): Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat (CVSS 6.9, LiveHelperChat)
- [CVE-2025-26386](https://cve.now/CVE-2025-26386.md): Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool (CVSS 7.1, Johnson Controls iSTAR Configuration Utility)
- [CVE-2026-1398](https://cve.now/CVE-2026-1398.md): Change WP URL \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, chrisnowak Change WP URL)
- [CVE-2026-1399](https://cve.now/CVE-2026-1399.md): WP Google Ad Manager Plugin \<= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings (CVSS 4.4, miles99 WP Google Ad Manager Plugin)
- [CVE-2025-14616](https://cve.now/CVE-2025-14616.md): Recooty \<= 1.0.6 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, Recooty – Job Widget)
- [CVE-2026-1280](https://cve.now/CVE-2026-1280.md): Frontend File Manager Plugin \<= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file\_id' Parameter (CVSS 7.5, nmedia Frontend File Manager Plugin)
- [CVE-2025-14283](https://cve.now/CVE-2025-14283.md): BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library \<= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpblockart BlockArt Blocks – Gutenberg Blocks, Page Builder…)
- [CVE-2025-14063](https://cve.now/CVE-2025-14063.md): SEO Links Interlinking \<= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google\_error' Parameter (CVSS 6.1, seomantis SEO Links Interlinking)
- [CVE-2026-0844](https://cve.now/CVE-2026-0844.md): Simple User Registration \<= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile\_save\_field (CVSS 8.8, nmedia Simple User Registration)
- [CVE-2025-14386](https://cve.now/CVE-2025-14386.md): Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.12 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover (CVSS 8.8, shahrukhlinkgraph Search Atlas SEO – Premier SEO Plugin for…)
- [CVE-2026-1380](https://cve.now/CVE-2026-1380.md): Bitcoin Donate Button \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, lxicon Bitcoin Donate Button)
- [CVE-2026-1391](https://cve.now/CVE-2026-1391.md): Vzaar Media Management \<= 1.2 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 5.3, mamunreza Vzaar Media Management)
- [CVE-2025-15511](https://cve.now/CVE-2025-15511.md): Rupantorpay \<= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification (CVSS 5.3, Rupantorpay)
- [CVE-2026-1377](https://cve.now/CVE-2026-1377.md): imwptip \<= 1.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, hu\_chao imwptip)
- [CVE-2025-41351](https://cve.now/CVE-2025-41351.md): Weak encryption on Funambol's cloud server (CVSS 6.0, Funambol Cloud Server)
- [CVE-2025-7740](https://cve.now/CVE-2025-7740.md): Use of default credentials vulnerability in Hitachi Energy SuprOS product (CVSS 8.8, Hitachi Energy SuprOS)
- [CVE-2026-1400](https://cve.now/CVE-2026-1400.md): AI Engine \<= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update\_media\_metadata Endpoint (CVSS 7.2, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2026-1053](https://cve.now/CVE-2026-1053.md): Ivory Search \<= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu\_gcse' and 'nothing\_found\_text' Parameters (CVSS 4.4, vinod-dalvi Ivory Search – WordPress Search Plugin)
- [CVE-2026-0702](https://cve.now/CVE-2026-0702.md): VidShop – Shoppable Videos for WooCommerce \<= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields' (CVSS 7.5, wpcreatix VidShop – Shoppable Videos for WooCommerce)
- [CVE-2026-1381](https://cve.now/CVE-2026-1381.md): Order Minimum/Maximum Amount Limits for WooCommerce \<= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields (CVSS 4.4, wpcodefactory Order Minimum/Maximum Amount Limits for WooCo…)
- [CVE-2026-0818](https://cve.now/CVE-2026-0818.md): CSS-based exfiltration of the content from partially encrypted emails when allowing remote content (CVSS 4.3, Mozilla Thunderbird)
- [CVE-2025-40554](https://cve.now/CVE-2025-40554.md): SolarWinds Web Help Desk Authentication Bypass Vulnerability (CVSS 9.8, SolarWinds Web Help Desk)
- [CVE-2025-40553](https://cve.now/CVE-2025-40553.md): SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 9.8, SolarWinds Web Help Desk)
- [CVE-2025-40552](https://cve.now/CVE-2025-40552.md): SolarWinds Web Help Desk Authentication Bypass Vulnerability (CVSS 9.8, SolarWinds Web Help Desk)
- [CVE-2025-40551](https://cve.now/CVE-2025-40551.md): SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 9.8, KEV, SolarWinds Web Help Desk)
- [CVE-2025-40537](https://cve.now/CVE-2025-40537.md): SolarWinds Web Help Desk Hardcoded Credentials Vulnerability (CVSS 7.5, SolarWinds Web Help Desk)
- [CVE-2025-40536](https://cve.now/CVE-2025-40536.md): SolarWinds Web Help Desk Security Control Bypass Vulnerability (CVSS 8.1, KEV, SolarWinds Web Help Desk)
- [CVE-2026-1054](https://cve.now/CVE-2026-1054.md): RegistrationMagic \<= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification (CVSS 5.3, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2026-1389](https://cve.now/CVE-2026-1389.md): Document Embedder \<= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion (CVSS 4.3, bplugins Document Embedder – Embed PDFs, Word, Excel, and O…)
- [CVE-2026-0832](https://cve.now/CVE-2026-0832.md): New User Approve \<= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure (CVSS 7.3, saadiqbal New User Approve)
- [CVE-2026-1310](https://cve.now/CVE-2026-1310.md): Simple calendar for Elementor \<= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion (CVSS 5.3, migaweb Simple calendar for Elementor)
- [CVE-2025-14039](https://cve.now/CVE-2025-14039.md): Simple Folio \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields (CVSS 6.4, presstigers Simple Folio)
- [CVE-2025-12709](https://cve.now/CVE-2025-12709.md): Interactions – Create Interactive Experiences in the Block Editor \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bfintal Interactions – Create Interactive Experiences in th…)
- [CVE-2025-9082](https://cve.now/CVE-2025-9082.md): WPBITS Addons For Elementor \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, WPBITS Addons For Elementor Page Builder)
- [CVE-2026-1295](https://cve.now/CVE-2026-1295.md): Buy Now Plus \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, supercleanse Buy Now Plus — Payments with Stripe)
- [CVE-2026-0825](https://cve.now/CVE-2026-0825.md): Database for Contact Form 7, WPforms, Elementor forms \<= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export (CVSS 5.3, crmperks Database for Contact Form 7, WPforms, Elementor fo…)
- [CVE-2026-1244](https://cve.now/CVE-2026-1244.md): Forms Bridge \<= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, codeccoop Forms Bridge – Infinite integrations)
- [CVE-2026-1466](https://cve.now/CVE-2026-1466.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau (CVSS 6.1, Jirafeau project Jirafeau)
- [CVE-2025-13471](https://cve.now/CVE-2025-13471.md): User Activity Log \<= 2.2 - Unauthenticated Limited Arbitrary Option Update (CVSS 5.3, User Activity Log)
- [CVE-2025-14610](https://cve.now/CVE-2025-14610.md): TableMaster for Elementor \<= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv\_url' Parameter (CVSS 7.2, bloompixel TableMaster for Elementor – Advanced Responsive…)
- [CVE-2026-1083](https://cve.now/CVE-2026-1083.md): Appointment Hour Booking – Booking Calendar \<= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration (CVSS 4.4, codepeople Appointment Hour Booking – Booking Calendar)
- [CVE-2026-1298](https://cve.now/CVE-2026-1298.md): Easy Replace Image \<= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement (CVSS 4.3, iulia-cazan Easy Replace Image)
- [CVE-2025-8072](https://cve.now/CVE-2025-8072.md): Target Video Easy Publish \<= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder\_img Parameter (CVSS 6.4, nebojsadabic Target Video Easy Publish)
- [CVE-2026-1514](https://cve.now/CVE-2026-1514.md): 2100 Technology｜Official Document Management System - Incorrect Authorization (CVSS 7.1, 2100 Technology Official Document Management System)
- [CVE-2026-1506](https://cve.now/CVE-2026-1506.md): D-Link DIR-615 MAC Filter Configuration adv\_mac\_filter.php os command injection (CVSS 8.6, D-Link DIR-615)
- [CVE-2026-1505](https://cve.now/CVE-2026-1505.md): D-Link DIR-615 URL Filter set\_temp\_nodes.php os command injection (CVSS 8.6, D-Link DIR-615)
- [CVE-2026-1513](https://cve.now/CVE-2026-1513.md): billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding. (CVSS 6.1, NAVER billboard.js · billboard.js)
- [CVE-2026-21569](https://cve.now/CVE-2026-21569.md): This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. (CVSS 7.9, Atlassian Crowd Data Center)
- [CVE-2026-24852](https://cve.now/CVE-2026-24852.md): iccDEV has a heap-buffer-overflow in icXmlParseTextString() (CVSS 6.1, InternationalColorConsortium iccDEV)
- [CVE-2026-24850](https://cve.now/CVE-2026-24850.md): ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices (CVSS 5.3, RustCrypto signatures · ml-dsa)
- [CVE-2026-24842](https://cve.now/CVE-2026-24842.md): node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal (CVSS 8.2, isaacs node-tar · tar)
- [CVE-2026-24841](https://cve.now/CVE-2026-24841.md): Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint (CVSS 9.9, dokploy)
- [CVE-2026-24840](https://cve.now/CVE-2026-24840.md): Dokploy uses hardcoded credentials in installation script, which could result in database access (CVSS 8.0, dokploy)
- [CVE-2026-24839](https://cve.now/CVE-2026-24839.md): Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers (CVSS 4.7, dokploy)
- [CVE-2022-40619](https://cve.now/CVE-2022-40619.md): FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affe (CVSS 7.7)
- [CVE-2022-40620](https://cve.now/CVE-2022-40620.md): FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when down (CVSS 7.7)
- [CVE-2025-57283](https://cve.now/CVE-2025-57283.md): The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. (CVSS 7.8, browserstack-local)
- [CVE-2025-61140](https://cve.now/CVE-2025-61140.md): The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. (CVSS 9.8, jsonpath)
- [CVE-2025-65886](https://cve.now/CVE-2025-65886.md): A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes. (CVSS 7.5)
- [CVE-2025-65887](https://cve.now/CVE-2025-65887.md): A division-by-zero vulnerability in the flow.floor\_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) (CVSS 6.5)
- [CVE-2025-65888](https://cve.now/CVE-2025-65888.md): A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negativ (CVSS 7.5)
- [CVE-2025-65889](https://cve.now/CVE-2025-65889.md): A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted in (CVSS 7.5)
- [CVE-2025-65890](https://cve.now/CVE-2025-65890.md): A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an (CVSS 7.5)
- [CVE-2025-65891](https://cve.now/CVE-2025-65891.md): A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get\_device\_pro (CVSS 7.5)
- [CVE-2025-69517](https://cve.now/CVE-2025-69517.md): An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content (CVSS 8.8)
- [CVE-2025-69601](https://cve.now/CVE-2025-69601.md): A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. (CVSS 6.5)
- [CVE-2025-69602](https://cve.now/CVE-2025-69602.md): A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier (CVSS 9.1)
- [CVE-2025-70336](https://cve.now/CVE-2025-70336.md): A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbi (CVSS 4.8)
- [CVE-2025-70999](https://cve.now/CVE-2025-70999.md): A GPU device-ID validation flaw in the flow.cuda.get\_device\_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of S (CVSS 7.5)
- [CVE-2025-71000](https://cve.now/CVE-2025-71000.md): An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 7.5)
- [CVE-2025-71001](https://cve.now/CVE-2025-71001.md): A segmentation violation in the flow.column\_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a craf (CVSS 6.5)
- [CVE-2025-71002](https://cve.now/CVE-2025-71002.md): A floating-point exception (FPE) in the flow.column\_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) vi (CVSS 6.5)
- [CVE-2025-71003](https://cve.now/CVE-2025-71003.md): An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a (CVSS 7.5)
- [CVE-2025-71004](https://cve.now/CVE-2025-71004.md): A segmentation violation in the oneflow.logical\_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a cra (CVSS 6.5)
- [CVE-2025-71005](https://cve.now/CVE-2025-71005.md): A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a c (CVSS 6.5)
- [CVE-2025-71006](https://cve.now/CVE-2025-71006.md): A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via (CVSS 6.5)
- [CVE-2025-71007](https://cve.now/CVE-2025-71007.md): An input validation vulnerability in the oneflow.index\_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) v (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.