CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- progress moveit transferMOVEit Transfer REST API does not require current password in order to initiate the password change process3.7 Low
- trendnet tew-811dru, tew-811dru firmware +1 moreTRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injection8.6 High
- altera quartus prime lite, quartus prime standard, intel quartus prime +2 moreQuartus® Prime Standard and Quartus® Prime Lite Security Advisory5.4 Medium
- altera quartus prime lite, quartus prime standard, intel quartus prime +2 moreQuartus® Prime Standard and Quartus® Prime Lite Security Advisory5.4 Medium
- trendnet tew-713re, tew-713re firmware +1 moreTRENDnet TEW-713RE formFSrvX os command injection9.3 Critical
- altera quartus prime lite, quartus prime standard, intel quartus prime +2 moreQuartus® Prime Standard and Quartus® Prime Lite Security Advisory5.4 Medium
- altera quartus prime pro, intel quartus prime +1 moreQuartus Prime Pro Edition Advisory5.4 Medium
- altera quartus prime pro, intel quartus prime +1 moreQuartus Prime Pro Edition Advisory5.4 Medium
- dasinfomedia wpchurchWordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- engotheme plant - gardening & houseplants wordpress themeWordPress Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure Vulnerability5.3 Medium
- altera quartus prime pro, intel quartus prime +1 moreQuartus Prime Pro Edition Installer Advisory5.4 Medium
- themefy bloggie, themify photobox, rezo +6 more +8 moreArbitrary File Upload Vulnerability in WordPress themes by Themify9.9 Critical
- github enterprise serverImproper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML8.4 High
- aa-team amazon affiliates addon for wpbakery page builder (formerly visual composer), woocommerce sales funnel builder +1 moreReflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress plugins7.1 High
- aa-team premium age verification / restriction for wordpress, responsive coming soon landing page / holding page for wordpress +1 morePrivilege Escalation Vulnerability in AA-Team WordPress plugins8.8 High
- color iccdeviccDEV ToneMap Writer has NULL Pointer Member Call5.5 Medium
- directusDirectus has open redirect in SAML4.3 Medium
- arista networks eosOn affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain…5.3 Medium
- color iccdeviccDEV has unicode buffer overflow in CIccTagTextDescription6.1 Medium
- color iccdeviccDEV has heap buffer overflow in CIccTagLut16::Validate()6.1 Medium
- totolink wa300, wa300 firmware +1 moreTOTOLINK WA300 cstecgi.cgi sub_401510 command injection5.3 Medium
- color iccdeviccDEV has heap buffer overflow in CIccTagLut8::Validate()6.1 Medium
- rustcrypto rsarsa crate has potential panic on a prime being equal to 12.7 Low
- parslParsl Monitoring Visualization Vulnerable to SQL Injection5.3 Medium
- kyvernoKyverno before v1.13.0 Policy Bypass via Multiple Exceptions9.4 Critical
- bokehBokeh server applications have Incomplete Origin Validation in WebSockets4.5 Medium
- n8nn8n is vulnerable to Remote Code Execution via Arbitrary File Write10.0 Critical
- axllent mailpitMailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)5.8 Medium
- wolfsshClient SCP Request Triggers Buffer Overread by 1 Byte5.1 Medium
- mojoomla wpchurchWordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerability8.1 High
- project-monai monaiMONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download5.3 Medium
- wolfsshAuthentication Bypass9.4 Critical
- sfwebservice inwave jobsWordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability9.8 Critical
- wpshop.ru adsplace'r – ad manager, inserter, adsense adsWordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shazdeh header image sliderWordPress Header Image Slider plugin <= 0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- digital zoom studio dzs video galleryWordPress DZS Video Gallery plugin <= 12.25 - PHP Object Injection vulnerability8.8 High
- elated-themes frappe, frappé +1 moreWordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability8.1 High
- cloudways breezeWordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability5.3 Medium
- cyberchimps responsive addons for elementorWordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability6.5 Medium
- posimyth uichemyWordPress UiChemy plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- publishpress post expiratorWordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability4.3 Medium
- codexthemes thegem theme elements (for wpbakery)WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfunnels creator lmsWordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability5.3 Medium
- codexthemes thegem theme elements (for elementor)WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codexthemes thegem theme elements (for elementor)WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerability7.5 High
- tickeraWordPress Tickera plugin <= 3.5.6.4 - Broken Access Control vulnerability4.3 Medium
- bbr plugins better business reviewsWordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability4.3 Medium
- proxy & vpn blocker & vpn blockerWordPress Proxy & VPN Blocker plugin <= 3.5.3 - Broken Access Control vulnerability4.3 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability5.4 Medium
- shahjahan jewel ninja tablesWordPress Ninja Tables plugin <= 5.2.4 - SQL Injection vulnerability8.5 High
- Show moreLoading…