CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- stylemix masterstudy lms wordpress plugin – for online courses and educationMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion5.4 Medium
- rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpressGamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure4.3 Medium
- jonua table field add-on for acf and scfTable Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content6.4 Medium
- stevejburge tag, category, and taxonomy manager – ai autotagger with openaiTaxoPress <= 3.41.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification4.3 Medium
- curllibssh key passphrase bypass without agent set3.1 Low
- curllibssh global known_hosts override5.3 Medium
- curlOpenSSL partial chain store policy bypass5.3 Medium
- curlbearer token leak on cross-protocol redirect5.3 Medium
- curlNo QUIC certificate pinning with GnuTLS5.9 Medium
- averta phloxPhlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attribute6.4 Medium
- averta shortcodes and extra features for phlox themeShortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure5.3 Medium
- plat'home co.,ltd. openblocks idm rx1 (fw5.0.x), openblocks iot dx1 (fw5.0.x), openblocks iot ex/bx models (fw5.0.x) +3 more +5 moreAuthentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may...8.7 High
- buddydev buddypress xprofile custom field typesBuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- xagio seo – ai powered seoXagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
- bww url image importerURL Image Importer <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- fsylum fs registration passwordFS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggersPopupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion4.3 Medium
- aksharsoftsolutions as password field in default registration formAS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- color iccdevUse After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEV7.8 High
- color iccdeviccDEV has Out-of-bounds Read, Use of Out-of-range Pointer Offset and Improper Input Validation6.1 Medium
- ultimatemember forumwp – forum & discussion boardForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name6.4 Medium
- ghera74 ilghera support system for woocommerceilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion5.3 Medium
- averta depicter — popup & slider builderDepicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates5.3 Medium
- ninjateam fastdup – fastest wordpress migration & duplicatorFastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter6.5 Medium
- vikasratudi page expire popup/redirection for wordpressPage Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute6.5 Medium
- manchumahara cbx bookmark & favoriteCBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter6.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure6.5 Medium
- wpvibes form vibes – database manager for formsForm Vibes – Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection4.9 Medium
- color iccdeviccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()8.8 High
- color iccdeviccDEV has Undefined Behavior in CIccCLUT::Init()8.8 High
- color iccdeviccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function8.8 High
- asus myasus, asci +1 moreAn uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local...8.5 High
- codename065 download managerDownload Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword7.3 High
- google android, mediatek, inc. mediatek chipset +1 moreIn dpe, there is a possible out of bounds write due to an integer overflow. This could lead to...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn dpe, there is a possible memory corruption due to use after free. This could lead to local...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn dpe, there is a possible memory corruption due to use after free. This could lead to local...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn dpe, there is a possible memory corruption due to use after free. This could lead to local...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn dpe, there is a possible memory corruption due to an integer overflow. This could lead to...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible memory corruption due to use after free. This could lead to local...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible memory corruption due to use after free. This could lead to local...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible memory corruption due to use after free. This could lead to local...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible memory corruption due to uninitialized data. This could lead to...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible out of bounds write due to a missing bounds check. This could...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible out of bounds write due to a missing bounds check. This could...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible memory corruption due to use after free. This could lead to local...7.8 High
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible memory corruption due to use after free. This could lead to local...7.8 High
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible use after free due to a race condition. This could lead to local...7.0 High
- google android, mediatek, inc. mediatek chipset +1 moreIn display, there is a possible out of bounds write due to a missing bounds check. This could...7.8 High
- google android, mediatek, inc. mediatek chipset +1 moreIn geniezone, there is a possible memory corruption due to use after free. This could lead to...6.7 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn seninf, there is a possible memory corruption due to a race condition. This could lead to...7.0 High
- Show moreLoading…