CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- infility globalWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability9.3 Critical
- codepeople sell downloadsWordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerability7.5 High
- wpweb follow my blog postWordPress Follow My Blog Post plugin <= 2.4.0 - Arbitrary Content Deletion vulnerability7.5 High
- rustaurius five star restaurant reservationsWordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability8.6 High
- brecht custom related postsWordPress Custom Related Posts plugin <= 1.8.0 - Sensitive Data Exposure vulnerability7.5 High
- wp swings wallet system for woocommerceWordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerability6.3 Medium
- awethemes awebookingWordPress AweBooking plugin <= 3.2.26 - Sensitive Data Exposure vulnerability6.5 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System prod.php cross site scripting5.3 Medium
- themify shopoWordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability9.9 Critical
- themify edminWordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability8.8 High
- wpvibes anywhere elementor proWordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability4.3 Medium
- aa-team premium seo packWordPress Premium SEO Pack <= 3.3.2 - SQL Injection Vulnerability8.5 High
- aa-team amazon native shopping recommendationsWordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability9.3 Critical
- jwsthemes freeagentWordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerability8.1 High
- centreon infra monitoring, web +1 moreInformation disclosure on Administration parameters API endpoint5.3 Medium
- centreon web, infra monitoring +1 moreA user with elevated privileges can inject XSS in the Administration ACL Menus configuration page6.8 Medium
- centreon infra monitoring, web +1 moreRCE via the backup feature available only to user with high privilege7.2 High
- code-projects online product reservation systemcode-projects Online Product Reservation System GET Parameter order_view.php sql injection6.9 Medium
- linuxirqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()No score
- linuxmt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()2.3 Low
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreNFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags7.8 High
- linuxcrypto: starfive - Correctly handle return of sg_nents_for_lenNo score
- linuxnet: netpoll: initialize work queue before error checksNo score
- linuxhfs: fix potential use after free in hfs_correct_next_unused_CNID()7.8 High
- linuxiommu/amd: Fix potential out-of-bounds read in iommu_mmio_showNo score
- linuxwifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()No score
- linuxbacklight: led-bl: Add devlink to supplier LEDs5.5 Medium
- linuxdrm/vgem-fence: Fix potential deadlock on release5.7 Medium
- linuxblock: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock7.8 High
- linuxstaging: most: remove broken i2c driver9.8 Critical
- linuxrtc: amlogic-a4: fix double free caused by devmNo score
- linuxALSA: firewire-motu: add bounds check in put_user loop for DSP events7.1 High
- linuxiavf: Implement settime64 with -EOPNOTSUPPNo score
- linuxs390/fpu: Fix false-positive kmsan report in fpu_vstl()No score
- code-projects online product reservation systemcode-projects Online Product Reservation System left_cart.php sql injection5.3 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System User Login login.php sql injection6.9 Medium
- apache kyuubiApache Kyuubi: Unauthorized directory access due to missing path normalization8.8 High
- angeljudesuarez society management systemitsourcecode Society Management System edit_activity_query.php sql injection5.3 Medium
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - Arbitrary File Upload8.7 High
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - SQL Injection7.1 High
- tenda ac1206, ac1206 firmware +1 moreTenda AC1206 httpd BehaviorManager formBehaviorManager command injection5.3 Medium
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - SQL Injection7.1 High
- flarum framework, vaadin, vaadin vaadin-spreadsheet-flow +2 moreCross-site scripting in Action caption4.8 Medium
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal5.3 Medium
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal5.3 Medium
- remyandrade api key manager appSourceCodester API Key Manager App Import Key cross site scripting5.1 Medium
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - Missing Authorization7.1 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W ConfigAdvideo strcpy buffer overflow8.7 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formTaskEdit strcpy buffer overflow8.7 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formPptpClientConfig strcpy buffer overflow8.7 High
- Show moreLoading…