CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- makesweatMakesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting4.4 Medium
- netcashpaynow netcash woocommerce payment gatewayNetcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- crushpics crush.pics image optimizer – image compression and optimizationCrush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- logiceverest shipping rates by city for woocommerceShipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter4.9 Medium
- techknowprime responsive accordion sliderResponsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'4.3 Medium
- ajseidl ajs footnotesAJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- searchwizSearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- jeroenpeters1986 name directoryName Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters7.2 High
- adoncreatives testimonials creatorTestimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- abage sosh share buttonsSosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery4.3 Medium
- vk011 real post slider liteReal Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings4.4 Medium
- sablab internal link builderInternal Link Builder <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings4.4 Medium
- woosaai integration opvius ai for woocommerceIntegration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal9.8 Critical
- lottiefile lottiefilesLottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure5.3 Medium
- obridgeacademy wpblogsynWPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update4.3 Medium
- dashboardbuilder dashboard builder – wordpress plugin for charts and graphsDASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection7.1 High
- mallsop list site contributorsList Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha6.1 Medium
- spring cli vscode extensionCommand injection vulnerability6.8 Medium
- huawei emui, harmonyos +1 morePermission verification bypass vulnerability in the media library module. Impact: Successful...6.2 Medium
- huawei emui, harmonyos +1 morePermission verification bypass vulnerability in the media library module. Impact: Successful...6.1 Medium
- huawei emui, harmonyos +1 moreMan-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of...5.7 Medium
- huawei harmonyosVulnerability of improper permission control in the print module. Impact: Successful exploitation...5.7 Medium
- huawei harmonyosPermission control vulnerability in the Notepad module. Impact: Successful exploitation of this...5.1 Medium
- huawei harmonyosPermission control vulnerability in the Notepad module. Impact: Successful exploitation of this...4.7 Medium
- huawei harmonyosData verification vulnerability in the HiView module. Impact: Successful exploitation of this...6.2 Medium
- huawei harmonyosMulti-thread race condition vulnerability in the thermal management module. Impact: Successful...6.8 Medium
- huawei harmonyosDouble free vulnerability in the multi-mode input module. Impact: Successful exploitation of this...7.8 High
- huawei harmonyosMulti-thread race condition vulnerability in the camera framework module. Impact: Successful...5.1 Medium
- huawei harmonyosMulti-thread race condition vulnerability in the camera framework module. Impact: Successful...5.1 Medium
- huawei harmonyosMulti-thread race condition vulnerability in the video framework module. Impact: Successful...8.4 High
- huawei harmonyosMulti-thread race condition vulnerability in the card framework module. Impact: Successful...8.0 High
- huawei harmonyosMulti-thread race condition vulnerability in the card framework module. Impact: Successful...8.4 High
- huawei harmonyosMulti-thread race condition vulnerability in the card framework module. Impact: Successful...8.0 High
- huawei harmonyosMulti-thread race condition vulnerability in the card framework module. Impact: Successful...8.0 High
- insyde software insydeh2o toolsegwindrvx64.sys is potentially vulnerable to a buffer overflow7.8 High
- insyde software insydeh2o toolsegwindrv.sys is potentially vulnerable to a buffer overflow.7.8 High
- insyde software insydeh2o toolsH2OFFT64.sys is potentially vulnerable to a buffer overflow.7.8 High
- insyde software insydeh2o toolsIn H2OFFT32.sys is potentially vulnerable to a buffer overflow.7.8 High
vlcOSS-FuzzUNKNOWN READ in MP4_TrackSeekNo score- google chromeUse after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to...8.8 High
- google chromeIncorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote...9.8 Critical
- google chromeIncorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote...9.8 Critical
- google chromeInsufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an...9.8 Critical
- google chromeIncorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a...5.4 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59...5.4 Medium
- google chromeInappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote...8.8 High
- google chromeInappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed...5.4 Medium
- google chromeInappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote...8.8 High
- google chromeOut of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote...8.8 High
- tenda ax1806 firmwareTenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of...7.5 High
- Show moreLoading…