CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- wptexture image slider slideshowWordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- niklaslindemann bulk landing page creator for wordpress lpageryWordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerability5.4 Medium
- nawawi jamili docket cacheWordPress Docket Cache plugin <= 24.07.04 - Broken Access Control vulnerability4.3 Medium
- passionate brains ga4wp: google analytics for wordpressWordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability5.4 Medium
- wikimedia foundation mediawiki - uploadwizard extension, wikimedia mediawiki-extensions-uploadwizard +1 moreMultiple stored i18n/message-key XSSes in UploadWizard6.1 Medium
- pencilwp x addons for elementorWordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- buddydev mediapressWordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- g5theme handmade frameworkWordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability7.5 High
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup Operator to perform remote code execution (RCE) as the...9.0 Critical
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup or Tape Operator to write files as root.9.0 Critical
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the...9.0 Critical
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as...7.8 High
- munir kamal block sliderWordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability6.5 Medium
- ubiquiti inc airfiber af60, airfiber af60-xg, airmax ac +5 more +7 moreA malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the...8.8 High
- ubiquiti inc ubb, ubb-xg, udb-pro/udb-pro-sector +4 more +6 moreA malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the...8.8 High
- corednsCoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages6.6 Medium
- color iccdeviccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp8.8 High
- joinmastodon mastodonLocal Mastodon users can enumerate and access severed relationships of every other local user6.5 Medium
- joinmastodon mastodonMastodon has SSRF Protection bypass7.1 High
- gunet openeclassOpen eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)7.3 High
- rustfsRustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting5.7 Medium
- asseco amdxInformation disclosure via IDOR in Asseco AMDX5.3 Medium
- rustfsRustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation5.7 Medium
- jvoisin snuffleupagusSnuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package9.2 Critical
- icewhaletech zimaosZimaOS has Authentication Bypass via System-Level Username9.4 Critical
- coreruleset, owasp modsecurity core rule set +1 moreOWASP CRS has multipart bypass using multiple content-type parts9.3 Critical
- red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +2 more +4 moreAnsible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions8.5 High
- asseco infomedica plusRecoverable passwords in Asseco Infomedica Plus5.9 Medium
- asseco infomedica plusImproper Access Control in Asseco Infomedica Plus5.1 Medium
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote...7.5 High
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a...7.5 High
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote...9.8 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreLibsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication8.6 High
- zauberzeug niceguiNiceGUI has Redis connection leak via tab storage causes service degradation5.3 Medium
- zauberzeug niceguiZero-click XSS in all NiceGUI apps which uses `ui.sub_pages`7.2 High
- zauberzeug niceguiNiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links6.1 Medium
- zauberzeug niceguiNiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()6.1 Medium
- jegstudio gutenverse form – contact form builder, booking, reservation, subscribe for block editorGutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- g5theme zorkaWordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability5.3 Medium
- campaign monitor for wordpressWordPress Campaign Monitor for WordPress plugin <= 2.9.1 - Broken Access Control vulnerability4.3 Medium
- noor alam easy media downloadWordPress Easy Media Download plugin <= 1.1.11 - CSS Injection vulnerability5.4 Medium
- gopiplus@hotmail.com scroll rss excerptWordPress Scroll rss excerpt plugin <= 5.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ryan sutana wp app barWordPress WP App Bar plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hands01 e-shopsWordPress e-shops plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pinpollWordPress Pinpoll plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- cmsjunkie - wordpress business directory plugins wp-businessdirectoryWordPress WP-BusinessDirectory plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- jcaruso001 flaming password resetWordPress Flaming Password Reset plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shahjada visitor stats widgetWordPress Visitor Stats Widget plugin <= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- chloédigital primer by chloédigitalWordPress PRIMER by chloédigital plugin <= 1.0.25 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- anibalwainstein effect makerWordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…