CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- arraytics eventin – event calendar, event registration, tickets & booking (ai powered)Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'7.2 High
- wptb wp table builder – drag & drop table builderWP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation4.3 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element9.1 Critical
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion4.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass4.3 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'7.2 High
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification4.3 Medium
- wpdevelop booking calendarBooking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure5.3 Medium
- ricoh company, ltd. streamline nxImproper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the...8.2 High
- alibaba fastjson, red hat openshift service mesh 2, build of apache camel for spring boot 4 +5 more +7 moreFASTJSON Includes Functionality from Untrusted Control Sphere10.0 Critical
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure5.3 Medium
- veronalabs slimstat analyticsSlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter7.2 High
- veronalabs slimstat analyticsSlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters7.2 High
- indiewebIndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter6.4 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions5.3 Medium
- publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categoriesSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation5.4 Medium
- pagup wp google street view (with 360° virtual tour) & google maps + local seoWP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode6.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export5.3 Medium
- pagup bulk auto image alt text (alt tag, alt attribute) optimizer (image seo)BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpdevteam betterdocs – knowledge base docs & faq solution for elementor & block editorBetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure6.5 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field9.8 Critical
- samsung galaxy storeImproper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to...5.1 Medium
- samsung cloudImproper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows...2.1 Low
- samsung android, samsung mobile devices +1 moreImproper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1...5.2 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote...5.3 Medium
- samsung android, samsung mobile devices +1 moreImproper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1...4.8 Medium
- samsung android, samsung mobile devices +1 moreUse After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to...7.3 High
- samsung android, samsung mobile devices +1 moreImproper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to...6.8 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to...2.3 Low
- samsung android, samsung mobile devices +1 moreUse after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to...6.7 Medium
- basix nex-formsNex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS6.8 Medium
- creativemotion clearfy cache – wordpress optimization plugin, minify html, css & js, deferClearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering4.3 Medium
- shoheitanaka japanized for woocommerceJapanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- zte mf258k, mf258k pro firmware +1 moreZTE MF258K Pro Version Server has a Configuration Defect Vulnerability4.3 Medium
ndpiOSS-FuzzUse-of-uninitialized-value in processTLSBlockNo score- the wikimedia foundation mediawiki - approvedrevs extension, wikiworks approved revs +1 moreApprovedRevs allows bypassing the inline CSS sanitizer2.3 Low
- growth growthexperiments, the wikimedia foundation mediawiki - growthexperiments extension +1 moreStored XSS through edit summaries in GrowthExperiments2.3 Low
- edimax br-6208ac firmwareEDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName...9.8 Critical
- dlink dir-895la1 firmwareA Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link...9.8 Critical
- area9lyceum rhapsodeArea9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated...6.5 Medium
- area9lyceum rhapsodeIn Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename...6.5 Medium
- tim-solutions tim flowIn TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists...5.4 Medium
- tim-solutions tim flowIn TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which...5.4 Medium
- tim-solutions tim flowIn TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection...5.4 Medium
- tim-solutions tim flowAn issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to...5.3 Medium
- tim-solutions tim flowAn issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to...6.5 Medium
- heromotocorp vida v1 pro firmwareAn issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service...7.5 High
- No product listedA vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an...8.2 High
- couchcmsAn Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary...6.5 Medium
- No product listedIn Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service...7.5 High
- Show moreLoading…