CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: hns3: add VLAN id validation before using8.8 High
- linux, linux kernel +1 morehwmon: (w83791d) Convert macros to functions to avoid TOCTOU4.7 Medium
- linux, linux kernel +1 moremm/slub: reset KASAN tag in defer_free() before accessing freed memory7.8 High
- linux, linux kernel +1 moreMIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits7.1 High
- linux, linux kernel +1 moreusb: typec: ucsi: Handle incorrect num_connectors capability5.5 Medium
- linux, linux kernel +1 moref2fs: ensure node page reads complete before f2fs_put_super() finishes5.5 Medium
- linux, linux kernel +1 morefs: PM: Fix reverse check in filesystems_freeze_callback()5.5 Medium
- linux, linux kernel +1 moref2fs: use global inline_xattr_slab instead of per-sb slab cache5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreKVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer5.5 Medium
- linux, linux kernel +1 moredrm/msm: adreno: fix deferencing ifpc_reglist when not declared5.5 Medium
- linux, linux kernel +1 morescs: fix a wrong parameter in __scs_magic5.5 Medium
- bluspark global bluvoyixPlaintext Passwords Vulnerability in BLUVOYIX10.0 Critical
- bluspark global bluvoyixEmail Sending Vulnerability in BLUVOYIX10.0 Critical
- bluspark global bluvoyixAdministrator Account Creation Vulnerability in BLUVOYIX10.0 Critical
- bluspark global bluvoyixExposed Internal API Documentation Vulnerability in BLUVOYIX10.0 Critical
- bluspark global bluvoyixImproper Authentication Vulnerability in BLUVOYIX10.0 Critical
- checkpoint hramony saseLocal privilege escalation in Harmony SASE Windows Agent7.5 High
- emaintenance crazy bubble teaUser Enumeration in Crazy Bubble Tea mobile application7.1 High
- ysoft safeq 6Insecure Password Storage in Y Soft SafeQ 65.1 Medium
- rustcrypto cmov, utils +1 moreRustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz8.9 High
- https://github.com/shadowblip inputplumberPolkit authentication dis isabled by default in inputplumber8.5 High
- https://github.com/shadowblip inputplumberLack of Authentication in the InputManager D-Bus interface8.5 High
- apache camel, apache software foundation camel neo4j +1 moreApache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component5.3 Medium
- arm c1-premium, c1-premium firmware, c1-ultra +19 more +21 moreIn certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit...7.9 High
- elastic kibana, red hat logging subsystem for red hat openshift, jboss enterprise application platform 8 +3 more +5 moreExternal Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector8.6 High
- elastic packetbeatImproper Validation of Array Index in Packetbeat Leading to Overflow Buffers6.5 Medium
- modular ds dsWordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability10.0 Critical
- payhere payment gateway, unknown payhere payment gateway +1 morePayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- rndsand81 stopwords for commentsStopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery4.3 Medium
- floattechnologies float payment gatewayFloat Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation5.3 Medium
- socialchampio auto post to social media from social champSocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- perfitdev perfit woocommercePerfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion5.3 Medium
- electric-studio electric studio download counterElectric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters4.4 Medium
- aplazopayment aplazo payment gatewayAplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation5.3 Medium
- prasannasp short linkShort Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page4.4 Medium
- guillaumev linkedin scLinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page4.4 Medium
- dfieldfl wp allowed hostsWP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter4.4 Medium
- webbu wmf mobile redirectorWMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters4.4 Medium
- tridenttechnolabs shipping rate by citiesShipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' Parameter7.5 High
- chainlitChainlit contains an authorization bypass vulnerability2.3 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq6.5 Medium
- kunzemarketing kunze lawKunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- vaghasia3 news and blog designer bundleNews and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion9.8 Critical
- nofearinc wp-crm system – manage clients and projectsWP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification5.4 Medium
- daschmi getcontentfromurlGetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute7.2 High
- aankit spiceforms form builderSpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- ahmadgb geekybot — generate ai content without prompt, chatbot and lead generationGeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting7.2 High
- gothamdev gotham block extra lightGotham Block Extra Light <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- gothamdev gotham block extra lightGotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode6.5 Medium
- kiwicommerce pdf resume parserPDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials5.3 Medium
- Show moreLoading…