CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- wpchill filr – secure document libraryFilr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload4.4 Medium
- saad iqbal quick contact formQuick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay5.8 Medium
- wpswings wallet system for woocommerce – digital wallet, buy now pay later (bnpl), instant cashback, referral program, partial & subscription paymentsWallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation6.5 Medium
- thimpress wp hotel bookingWP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter5.3 Medium
- absolute secure accessInformation Disclosure in Secure Access Between 12.70 and 14.204.6 Medium
- absolute secure accessXSS in Secure Access Consoles prior to 14.204.8 Medium
- absolute secure accessDenial of Service in Secure Access Servers Prior to 14.20.6.0 Medium
assimpOSS-FuzzHeap-buffer-overflow in ___interceptor_strtolNo score- nodejs node, node.js +1 moreA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...5.9 Medium
- nodejs node, node.js +1 moreWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...5.9 Medium
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js's permission model allows a file's access and modification timestamps to be...2.8 Low
- nodejs node, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...7.1 High
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...7.1 High
- gradleGradle's failure to disable repositories failing to answer can expose builds to malicious artifacts8.6 High
- gradleGradle fails to disable repositories which can expose builds to malicious artifacts8.6 High
- open5gsOpen5GS s5c-handler.c sgwc_s5c_handle_create_session_response denial of service6.9 Medium
- open5gsOpen5GS GTPv2 Bearer Response denial of service6.9 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability7.1 High
- microsoft power apps, power apps desktop client +1 morePowerApps Desktop Client Remote Code Execution Vulnerability8.0 High
@veramo/data-storenpmVeramo is Vulnerable to SQL Injection in Veramo Data Store ORM6.8 Mediumsveltenpmsvelte is vulnerable to XSS with textarea bind:value8.4 High- kidocode crawl4aiCrawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter10.0 Critical
- kidocode crawl4aiCrawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling9.2 Critical
- modular dsWordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability10.0 Critical
- cakephpCakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting5.4 Medium
- assaf parag poll, survey & quiz maker plugin by opinion stagePoll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 Stored XSS5.1 Medium
- mcpjam inspectorREC in MCPJam inspector due to HTTP Endpoint exposes9.8 Critical
- omnilogic omni secure filesOmni Secure Files < 0.1.14 Unauthenticated Arbitrary File Upload9.3 Critical
- zalando skipperSkipper arbitrary code execution through lua filters8.8 High
- graphql-hive graphql-modulesConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules8.7 High
- labredescefetrj wegiaWeGIA Clickjacking Vulnerability4.3 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)4.8 Medium
- labredescefetrj wegiaWeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page5.3 Medium
- labredescefetrj wegiaWeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page4.3 Medium
- labredescefetrj wegiaWeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.9.1 Critical
- labredescefetrj wegiaWeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter7.2 High
activejobRubyGemsActive Job - Object injection security vulnerability6.6 Mediumactiverecord-jdbc-adapterRubyGemsActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection8.8 High- b3log siyuanSiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload5.3 Medium
- disksorter disk sorter serverDisk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path8.5 High
- spy-emergency spy emergencySpy Emergency 25.0.650 - Unquoted Service Path8.5 High
- xmindXmind 2020 - Persistent Cross-Site Scripting5.1 Medium
- jotron studymdStudyMD 0.3.2 - Persistent Cross-Site Scripting5.1 Medium
- gurayyarar snipcommandSnipCommand 0.1.0 - Persistent Cross-Site Scripting5.1 Medium
- moeditorMoeditor 0.2.0 - Persistent Cross-Site Scripting5.1 Medium
- Show moreLoading…