CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- mapnikMapnik dbfile.cpp string_value heap-based overflow4.8 Medium
- byvoid opencc, open chinese convert +1 moreBYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow4.8 Medium
- nicbarker claynicbarker clay clay.h Clay__MeasureTextCached null pointer dereference4.8 Medium
- raylibraysan5 raylib rtext.c LoadFontData integer overflow4.8 Medium
- nodejs node, node.js +1 moreA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...5.8 Medium
- publiccmsSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization5.3 Medium
- publiccmsSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal5.1 Medium
- raylibraysan5 raylib rtext.c GenImageFontAtlas heap-based overflow4.8 Medium
- cijliu librtspcijliu librtsp rtsp_parse_method buffer overflow4.8 Medium
- cijliu librtspcijliu librtsp rtsp_parse_request buffer overflow4.8 Medium
- cijliu librtspcijliu librtsp rtsp_rely_dumps buffer overflow4.8 Medium
- eyoucmsEyouCMS Member Avatar Diyajax.php check_userinfo unrestricted upload5.3 Medium
apache-poiOSS-FuzzSecurity exception in org.apache.poi.util.IOUtils.safelyAllocateNo scoreapache-poiOSS-FuzzSecurity exception in java.base/java.util.Arrays.copyOfRangeNo scoreapache-poiOSS-FuzzSecurity exception in org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup.<iniNo scorejsoupOSS-FuzzSecurity exception in com.google.re2j.Machine.addNo scorehtmlunitOSS-FuzzSecurity exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElementNo score- chamilo lmsChamilo LMS Legal Consent SocialController.php deleteLegal improper authorization5.3 Medium
- easycmsEasyCMS UserAction.class.php sql injection6.9 Medium
- kalcaddle kodboxkalcaddle kodbox Compression zip command injection5.3 Medium
- bastillion-io bastillionbastillion-io Bastillion System Management SystemKtrl.java command injection5.1 Medium
- bastillion-io bastillionbastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injection5.1 Medium
- xiweicheng tms, teamwork management system +1 morexiweicheng TMS HtmlUtil.java summary server-side request forgery5.3 Medium
- xiweicheng tms, teamwork management system +1 morexiweicheng TMS FileController.java upload unrestricted upload5.3 Medium
- feminer wms, warehouse management system +1 moreFeMiner wms chkuser.php sql injection6.9 Medium
- risesoft-y9 digital-infrastructurerisesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection6.9 Medium
- ligerosmartLigeroSmart index.pl cross site scripting5.1 Medium
- ligerosmartLigeroSmart index.pl cross site scripting5.1 Medium
- open5gsOpen5GS Timer resource consumption6.9 Medium
- open5gsOpen5GS context.c sgwc_bearer_add assertion6.9 Medium
- open5gsOpen5GS s11-handler.c assertion6.9 Medium
- cubewp1211 cubewp frameworkCubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode6.4 Medium
- cyberlord92 integrate dynamics 365 crmIntegrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration4.4 Medium
- shoheitanaka paygent for woocommercePAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation5.3 Medium
- fmeaddons registration & login with mobile phone number for woocommerceRegistration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass9.8 Critical
- kraft plugins demo importer plusDemo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload7.5 High
- cubewp1211 cubewp frameworkCubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure5.3 Medium
- bdthemes spin wheel – interactive spinning wheel that offers couponsSpin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter5.3 Medium
- creativemindssolutions cm e-mail blacklist – simple email filtering for safer registrationCM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter4.4 Medium
- bplugins team section block – showcase team members with layout optionsTeam Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link6.4 Medium
- monetizemore advanced ads – ad manager & adsenseAdvanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection4.9 Medium
- zealopensource user registration using contact form 7User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure5.3 Medium
- memsource phrase tms integration for wordpressPhrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion4.3 Medium
- jackdewey community eventsCommunity Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter5.3 Medium
- andy moyle church adminChurch Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter2.2 Low
- naa986 payment button for paypalPayment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation5.3 Medium
- thimpress thim blocksGutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter6.5 Medium
- sweetdaisy86 repairbuddy – repair shop crm & booking plugin for wordpressRepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders4.3 Medium
- awesome motive youtube feed proFeeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal5.9 Medium
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order9.8 Critical
- Show moreLoading…