CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- coollabs coolifyCoolify has a privilege escalation - low privileged user can invite themselves as an admin user8.7 High
- badkeysbadkeys vulnerable to ASCII control character injection on console via malformed input2.0 Low
- coollabs coolifyCoolify members can see private key of root user10.0 Critical
- coollabs coolifyCoolify vulnerable to command injection via docker-compose.yaml parameters9.7 Critical
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- craftcms cms, craft cms +1 moreUnauthenticated Craft CMS users can trigger a database backup7.0 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI5.2 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation5.0 Medium
- citeum openctiGraphQL IDOR allows authenticated user to delete workspace content of other users7.1 High
- coollabs coolifyCoolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint5.7 Medium
- coollabs coolifyCoolify has Stored XSS in Project Name9.4 Critical
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential information disclosure via unchecked asset relocation4.9 Medium
- coollabs coolifyCoolify has Git Repository RCE10.0 Critical
- coollabs coolifyCoolify has Docker Compose Injection issue9.4 Critical
- muffonmuffon has One-click Remote Code Execution via XSS and Custom URL Handling8.8 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has Local File Inclusion/Path Traversal vulnerability9.2 Critical
- silabs.com z-wave protocol controllerSilicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds read5.3 Medium
- waituk entradaWordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability9.3 Critical
- dokan proWordPress Dokan Pro plugin <= 3.14.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- marketing fire, llc loginwp - proWordPress LoginWP - Pro Plugin <= 4.0.8.5 - Broken Access Control vulnerability6.5 Medium
- ubiquiti inc unifi connect ev station lite, ui unifi connect ev station lite firmware +1 moreAn Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite ...5.3 Medium
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA malicious actor with access to the adjacent network could overflow the UniFi Protect...6.5 Medium
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi...8.8 High
- ubiquiti inc ucrm argentina afip invoices plugin, ui argentina afip invoices +1 moreA Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and...7.5 High
- marketing fire llc loginwp - proWordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerability7.5 High
- thimpress thim coreWordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- corourke iphone webclip managerWordPress iPhone Webclip Manager plugin <= 0.5 - CSRF to Stored XSS vulnerability7.1 High
- masaakitanaka booking packageWordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability7.5 High
- tumult inc hype animationsWordPress Tumult Hype Animations plugin <= 1.9.11 - CSRF to XSS vulnerability7.1 High
- whill model c2 electric wheelchair, model f power chair +1 moreWHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for...9.3 Critical
github.com/open-feature/flagd/coreGo,github.com/open-feature/flagd/flagdGo,github.com/open-feature/flagd/flagd-proxyGo +2 moreflagd: Multiple Go Runtime CVEs Impact Security and AvailabilityNo score- centreon awie, infra monitoring +1 moreAn unauthenticated user is able to introduce SQL Injection using the Awie export module9.8 Critical
- campcodes supplier management systemCampcodes Supplier Management System edit_profile.php sql injection5.3 Medium
- centreon awie, infra monitoring +1 moreUnauthenticated configuration import allows administrative account creation using AWIE component9.8 Critical
- centreon infra monitoring, dynamic service management +1 moreA user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page6.8 Medium
- apache software foundation sis, apache spatial information system +1 moreApache SIS: XML External Entity (XXE) vulnerability6.5 Medium
- centreon web, infra monitoring +1 moreA user with elevated privileges can inject XSS in the Hosts configuration parameters page6.8 Medium
- posimyth the plus addons for elementor page builder liteWordPress The Plus Addons for Elementor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- automattic wp job managerWordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System User Registration register_code.php sql injection6.9 Medium
- infinitum form geo controllerWordPress Geo Controller plugin <= 8.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- meow apps media file renamerWordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability9.1 Critical
- klbtheme machic coreWordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- code-projects online product reservation systemcode-projects Online Product Reservation System Cart Update update.php sql injection5.3 Medium
vim-commonTuxCare,vim-enhancedTuxCare,vim-filesystemTuxCare +2 more +4 moreUpdate of vimNo score- code-projects online product reservation systemcode-projects Online Product Reservation System POST Parameter delete.php sql injection5.3 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System Administration Backend improper authentication6.9 Medium
rkyvcrates.ioPotential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOMNo score- rockoa, xinhu rainrock rockoa +1 moreXinhu Rainrock RockOA API rockfun.php cross site scripting5.1 Medium
- rockoa, xinhu rainrock rockoa +1 moreXinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting5.1 Medium
- Show moreLoading…