CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- carmelo intern membership management systemcode-projects Intern Membership Management System check_admin.php sql injection6.9 Medium
- carmelo intern membership management systemcode-projects Intern Membership Management System edit_activity.php sql injection5.1 Medium
- carmelo intern membership management systemcode-projects Intern Membership Management System edit_students.php sql injection5.1 Medium
- carmelo intern membership management systemcode-projects Intern Membership Management System edit_admin.php sql injection5.1 Medium
- pioneer corporation stellanova aps-s301 series, stellanova limited aps-s202j-lm, stellanova lite aps-s201jgl +7 more +9 moreThe installers for multiple products provided by PIONEER CORPORATION contain an issue with the...8.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10 +1 moreKeycloak: keycloak authorization header parsing leading to potential security control bypass5.3 Medium
- loopus wp cost estimation & payment forms builderWP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete9.8 Critical
- jegtheme jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget6.4 Medium
- galdub folders – unlimited folders to organize media library folder, pages, posts, file managerFolders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement4.3 Medium
- loopus wp cost estimation & payment forms builderWP Cost Estimation < 9.660 - Upload Directory Traversal6.5 Medium
- kanboardKanboard is Vulnerable to Reverse Proxy Authentication Bypass9.1 Critical
- kanboardKanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure5.3 Medium
- kanboardKanboard vulnerable to Open Redirect via protocol-relative URLs4.7 Medium
- flagforgeFlag Forge has ReDoS Vulnerability in User Profile Lookup API7.5 High
- getgreenshot greenshotGreenshot Vulnerable to OS Command Injection via ExternalCommand Plugin7.8 High
vlcDebianvlc - security updateNo score- kaysus ks-wr3600 firmwareKAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any...8.8 High
- kaysus ks-wr1200 firmwareKAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface...5.4 Medium
- kaysus ks-wr3600 firmwareKAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session...9.4 Critical
- kaysus ks-wr3600 firmwareKAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the...8.4 High
- pandawireless pwru01 firmwareAn issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple...9.1 Critical
- https://github.com/linrunner tlpPolkit Authorization Check can be Bypassed in the TLP power daemon5.1 Medium
- gonitro nitro pdf proAn issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it...5.5 Medium
- webkul qloappsUnrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows...9.8 Critical
- gl-inet ax1800 firmwareAn issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4...6.5 Medium
- gl-inet ax1800 firmwareThe LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix...5.1 Medium
- gl-inet gl-axt1800 firmwareA command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The...8.1 High
- dromara ruoyi-vue-plusThe snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job...9.4 Critical
- jeecg jimureportJimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user...9.8 Critical
- dlink dir-605l firmwareAn issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6...6.8 Medium
- webpros plesk obsidian, red hat openshift dev spaces +1 morePlesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)...7.5 High
- phpgurukul hostel management systemCross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields ...8.7 High
- edubusinesssolutions print shop pro webdeskCross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp...5.4 Medium
- edubusinesssolutions print shop pro webdeskCross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg...6.1 Medium
- edubusinesssolutions print shop pro webdeskSQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12...9.8 Critical
- edubusinesssolutions print shop pro webdeskCross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print...6.8 Medium
- edubusinesssolutions print shop pro webdeskThere is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business...9.1 Critical
- indieka900 online shopping systemindieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action...9.8 Critical
- optimal-systems enaioAn issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10...9.1 Critical
- insiders-technologies e-invoice proAn issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a...7.5 High
- red hat openshift dev spaces, technitium dnsserver +1 moreAn issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service...7.5 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +6 more +8 moreGIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments9.8 Critical
- ggml llama.cppllama.cpp has Out-of-bounds Write in llama-server8.8 High
- wolfssl wolfssl-pywolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement9.3 Critical
- kromit titraTitra API Contains Mass Assignment Vulnerability4.3 Medium
- guangzhou v v-sol gpon/epon olt platformV-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Reflected Cross-Site Scripting Vulnerability5.1 Medium
- yahei.net yahei-php proberYahei-PHP Prober 0.4.7 Remote HTML Injection via Speed Parameter5.1 Medium
- iwt ltd. facesentry access control system, iwt facesentry access control system firmware +1 moreFaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php5.1 Medium
- soca technology co., ltd access control systemSOCA Access Control System 180612 Reflected Cross-Site Scripting via logged_page.php5.1 Medium
- Show moreLoading…