CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- adamlabs wordpress photo galleryWordPress WordPress Photo Gallery plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability7.1 High
- flexostudio flexo-posts-managerWordPress flexo-posts-manager Plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability7.1 High
- ayecode restauranteWordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- jthemes xsmartWordPress xSmart theme <= 1.2.9.4 - Privilege Escalation vulnerability8.8 High
- jthemes xsmartWordPress xSmart theme <= 1.2.9.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tagdiv composerWordPress tagDiv Composer plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- artbees jupiterx coreWordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability8.8 High
- axiomthemes amuliWordPress Amuli theme <= 2.3.0 - Local File Inclusion vulnerability8.1 High
- farost energiaWordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerability10.0 Critical
- ovatheme athensWordPress Athens theme <= 1.1.6 - Local File Inclusion vulnerability8.1 High
- cozythemes homelancerWordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability5.4 Medium
- pondol bbsWordPress Pondol BBS plugin <= 1.1.8.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- apustheme droneWordPress Drone theme <= 1.40 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lambertgroup accordion slider proWordPress Accordion Slider PRO plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kamleshyadav wp lead capturing pagesWordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability9.3 Critical
- kamleshyadav wp lead capturing pagesWordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability8.5 High
- zoomit dzs video galleryWordPress DZS Video Gallery plugin <= 12.39 - SQL Injection vulnerability8.5 High
- lambertgroup xpromoterWordPress xPromoter plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- highwarden super interactive mapsWordPress Super Interactive Maps plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lambertgroup magic responsive slider and carousel wordpressWordPress Magic Responsive Slider and Carousel WordPress plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lambertgroup magic sliderWordPress Magic Slider plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lambertgroup image&video fullscreen backgroundWordPress Image&Video FullScreen Background plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- xtemos woodmartWordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability3.8 Low
- benjamin intal stackableWordPress Stackable plugin <= 3.19.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ninetheme anarkaliWordPress Anarkali theme <= 1.0.9 - Local File Inclusion vulnerability8.1 High
- lambertgroup html5 video player with playlist & multiple skinsWordPress HTML5 Video Player with Playlist & Multiple Skins plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- html5videoplayer html5 video playerWordPress HTML5 Video Player plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- vb-audio software matrix, matrix coconut, voicemeeter banana +2 more +4 moreVB-Audio Voicemeeter & Matrix Drivers DoS via Improper FILE_OBJECT FsContext Initialization6.9 Medium
- vb-audio software matrix, matrix coconut, voicemeeter banana +2 more +4 moreVB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCache6.9 Medium
- vb-audio software matrix, matrix coconut +1 moreVB-Audio Matrix Drivers Local Privilege Escalation via Kernel Memory Exposure8.5 High
- vb-audio software matrix, matrix coconut, voicemeeter banana +2 more +4 moreVB-Audio Voicemeeter & Matrix Drivers DoS via Corrupted IoAllocateMdl Length6.8 Medium
- dell powerscale onefsDell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive...8.1 High
- dell unisphere for powermax, unisphere for powermax virtual appliance +1 moreDell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of...8.8 High
- bosch infotainment system ecuMisconfigured SSL/TLS communication of Redbend service for Infotainment ECU6.5 Medium
- bosch infotainment system ecuAnti-Theft Bypass for Infotainment ECU4.0 Medium
- docling docling-coreDocling Core vulnerable to Remote Code Execution via unsafe PyYAML usage8.1 High
- typebot, baptistearno typebot.io +1 moreTypebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass7.4 High
- nerves-hub nerveshub, nerves hub web +1 moreNervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force9.5 Critical
- inkscapeTCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app4.8 Medium
- smartertools smartermailSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API9.3 Critical
- tenda ax1803, ax1803 firmware +1 moreTenda AX1803 WifiGuestSet fromGetWifiGuestBasic stack-based overflow8.7 High
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflow8.7 High
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection5.3 Medium
- gitlabIncorrect Authorization in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabUnchecked Return Value in GitLab7.4 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab5.3 Medium
- totolink nr1800x, nr1800x firmware +1 moreTotolink NR1800X POST Request cstecgi.cgi setWanCfg command injection5.3 Medium
- Show moreLoading…