CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- pickplugins accordionWordPress Accordion plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- fahad mahmood rss feed widgetWordPress RSS Feed Widget plugin <= 3.0.2 - Broken Access Control vulnerability5.4 Medium
- coolhappy the events calendar countdown addonWordPress The Events Calendar Countdown Addon plugin <= 1.4.15 - Broken Access Control vulnerability4.3 Medium
- wpcenter affiliatexWordPress AffiliateX plugin <= 1.3.9.3 - Broken Access Control vulnerability4.3 Medium
- boldgrid post and page builder by boldgridWordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability4.3 Medium
- vankarwai calafateWordPress Calafate theme <= 1.7.7 - Local File Inclusion vulnerability7.5 High
- buddhathemes wedesigntech ultimate booking addonWordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability5.4 Medium
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability4.3 Medium
- themepoints team showcaseWordPress Team Showcase plugin <= 2.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfactory wishlist for woocommerceWordPress Wishlist for WooCommerce plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jeroen schmit theater for wordpressWordPress Theater for WordPress plugin <= 0.19 - Broken Access Control vulnerability4.3 Medium
- magepeopleteam car rental managerWordPress Car Rental Manager plugin <= 1.0.9 - Broken Access Control vulnerability4.3 Medium
- gt3 themes photo galleryWordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- e-plugins jobbankWordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jwsthemes issabellaWordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerability8.1 High
- dell unisphere for powermax, unisphere for powermax virtual appliance +1 moreDell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML...7.6 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260101] - Inadequate content filtering for data URLs5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260102] - XSS vector in the pagebreak plugin5.9 Medium
- guangzhou yeroo tech co., ltd. ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie8.6 High
- shenzhen xingmeng qihang media co., ltd. qihang media web (qh.aspx) digital signageQiHang Media Web Digital Signage 3.0.9 Cookie Authentication Credentials Disclosure8.6 High
- arteco-global arteco web client dvr/nvrArteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass8.7 High
- pro-bravia sony bravia digital signage, sony bravia signage +1 moreSony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion5.3 Medium
- pro-bravia sony bravia digital signage, sony electronics inc. bravia digital signage, sony bravia signage +2 moreSony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR6.9 Medium
- pro-bravia sony bravia digital signage, sony bravia signage +1 moreSony BRAVIA Digital Signage 1.7.8 Unauthenticated System API Information Disclosure6.9 Medium
- red red-v super digital signage system rxv-a740rRED-V Super Digital Signage System 5.1.1 Log Information Disclosure Vulnerability6.9 Medium
- yerootech ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control8.7 High
- yerootech ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management5.1 Medium
- tdmsignage tdm digital signage pc playerTDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions8.5 High
- adtecdigital signedje digital signage player, admanage traffic & media management application, afiniti multi-carrier platform +8 more +10 moreAdtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials8.7 High
- all-dynamics software enlogic:show digital signage systemAll-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass8.5 High
- plexus anblick digital signage managementPlexus anblick Digital Signage Management 3.1.13 Open Redirect via Pagina Parameter5.1 Medium
- cayin technology smp-1000, smp-200, smp-2000 +16 more +18 moreCayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter8.7 High
- secure computing snapgear management console sg560, securecomputing snapgear sg560 firmware +1 moreSecure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read/Write8.7 High
- secure computing snapgear management console sg560, securecomputing snapgear sg560 firmware +1 moreSecure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin Users5.1 Medium
- extreme networks aerohive hiveosExtreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service8.7 High
- p5 fnip-8x16aP5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management5.3 Medium
- fibar group s.a. home center 2, home center 3, home center lite +2 moreFIBARO System Home Center 5.021 Remote File Inclusion via Proxy API5.1 Medium
- tenda ac23, ac23 firmware +1 moreTenda AC23 PowerSaveSet sscanf buffer overflow8.7 High
- airvpn eddieEddie VPN 2.24.6 - Local Privilege Escalation8.5 High
- dell secure connect gateway, secure connect gateway (scg) appliance, secure connect gateway (scg) application +2 moreDell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30...6.4 Medium
- forcepoint one endpoint (f1e), one data loss prevention +1 moreVulnerable Python version used in Forcepoint One DLP Client7.8 High
- color iccdeviccDEV has Type Confusion during XML Curve Serialization6.6 Medium
- color iccdeviccDEV has Out-of-bounds Read and Integer Underflow (Wrap or Wraparound)6.1 Medium
- color iccdeviccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination6.1 Medium
- expresstech quiz and survey master (qsm) – easy quiz and survey maker, quiz and survey master +1 moreQuiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter6.5 Medium
- expresstech quiz and survey master (qsm) – easy quiz and survey maker, quiz and survey master +1 moreQuiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads6.5 Medium
- buddydev mediapressMediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode6.4 Medium
- expresstech quiz and survey master (qsm) – easy quiz and survey maker, quiz and survey master +1 moreQuiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion4.3 Medium
- arraytics timetics – appointment booking & schedulingAppointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification6.5 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification5.3 Medium
- Show moreLoading…