CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- gestsupGestSup <= 3.2.60 CSRF Allows Privileged Actions8.9 High
- ruckus networks vriot iot controllerRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE10.0 Critical
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) feature release, powerprotect data domain with data domain operating system (dd os) lts 2024 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.5 Medium
- ruckus networks vriot iot controllerRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE10.0 Critical
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) feature release, powerprotect data domain with data domain operating system (dd os) lts2023 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...2.3 Low
- docsys project docsysRainyGao DocSys GroupMemberMapper.xml sql injection5.3 Medium
- the wikimedia foundation mediawiki - campaignevents extension, wikimedia campaignevents +1 moreCampaignEvents API missing authorization exposes meeting and chat URLs5.3 Medium
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) feature release, powerprotect data domain with data domain operating system (dd os) lts2023 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...2.7 Low
- phpgurukul online course registration systemPHPGurukul Online Course Registration System enroll.php sql injection5.3 Medium
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) feature release, powerprotect data domain with data domain operating system (dd os) lts 2025 +2 more +4 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.0 Medium
- bees software solutions bet eportal, cloudilyaerp bet e-portal +1 moreCVE-2025-145989.8 Critical
- vivotek ip7137, ip7137 firmware +1 moreCommand injection in Vivotek IP7137 cameras8.6 High
- vivotek ip7137, ip7137 firmware +1 morePath traversal in Vivotek IP7137 cameras6.9 Medium
- vivotek ip7137, ip7137 firmware +1 moreNo password set for administrative account in Vivotek IP7137 cameras9.3 Critical
- vivotek ip7137, ip7137 firmware +1 moreUnprotected RTSP stream in Vivotek IP7137 cameras8.7 High
- kaon cg3000t, cg3000tc +1 moreHardcoded credentials in KAON CG3000T/CG3000CT routers9.3 Critical
- tenda 300mbps wireless router f3 and n300 easy setup routerInsecure Session ID Management Vulnerability in Tenda Wireless Routers8.8 High
- tenda 300mbps wireless router f3 and n300 easy setup routerCookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers8.8 High
- anand kumar header and footer scriptsHeader and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- alobaidi the tooltipThe Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- furqan-khanzada menu cardMenu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- infosatech wp page permalink extensionWP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush6.5 Medium
- ashishajani contact form vcard generatorContact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter5.3 Medium
- amirshk autogen headers menuAutogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter6.4 Medium
- amu02aftab client testimonial sliderClient Testimonial Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field6.4 Medium
- mountaingrafix mg advancedoptionsMG AdvancedOptions <= 1.2 - Reflected Cross-Site Scripting6.1 Medium
- soniz curved textCurved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- beshkin shabat keeperShabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- woodpeckerleadform woodpecker for wordpressWoodpecker for WordPress <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute6.4 Medium
- debtcom debt.com business in a boxDebt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- ctietze pullquotePullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- burtrw lesson plan bookLesson Plan Book <= 1.3 - Reflected Cross-Site Scripting6.1 Medium
- tenda 300mbps wireless router f3 and n300 easy setup routerInsecure Transmission Vulnerability in Tenda Wireless Routers8.7 High
- tenda 300mbps wireless router f3 and n300 easy setup routerCleartext Transmission Vulnerability in Tenda Wireless Routers8.7 High
- zenitel icx500, icx500 firmware, icx510 +1 more +3 moreUnauthenticated Remote Code Execution via the device hostname10.0 Critical
- gitlabExposure of Private Personal Information to an Unauthorized Actor in GitLab3.5 Low
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabInsufficient Granularity of Access Control in GitLab5.4 Medium
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreMissing Authorization in GitLab7.1 High
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.0 High
- gitlabMissing Authorization in GitLab6.5 Medium
- zenitel icx500, icx500 firmware, icx510 +1 more +3 moreUnauthenticated SQL injection via GET request parameters7.5 High
- zenitel tcis-3+, tcis-3 firmware +1 moreAuthenticated Remote Code Execution in the NTP-configuration8.6 High
- zenitel tcis-3+, tcis-3 firmware +1 moreAuthenticated Remote Code Execution in device hostname10.0 Critical
- top-position top position google financeTop Position Google Finance <= 0.1.0 - Reflected Cross-Site Scripting6.1 Medium
- themelocation wp popup magicWP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute6.4 Medium
- lnbadmin1 nearby now reviewsNearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- greenshady entry viewsEntry Views <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- Show moreLoading…