CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- spring securitySpring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation5.3 Medium
- sigstoresigstore legacy TUF client allows for arbitrary file writes with target cache path traversal5.8 Medium
- linuxcontainers incusIncus container image templating arbitrary host file read and write8.7 High
- linuxcontainers incusIncus container environment configuration newline injection8.7 High
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10,...3.5 Low
- palantir com.palantir.aries:ariesAuthentication bypass in Aries due to misconfiguration6.6 Medium
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10,...5.0 Medium
- linuxfoundation rekorRekor affected by Server-Side Request Forgery (SSRF) via provided public key URL5.3 Medium
- linuxfoundation rekorRekor COSE v0.0.1 Canonicalize crashes when passed empty Message5.3 Medium
- dell powerscale onefsDell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability....4.3 Medium
- orvalOrval Mock Generation Code Injection via const7.7 High
- arksine moonrakerMoonraker with LDAP Enabled Allows Malicious Search Filter Injection2.7 Low
- surrealdbSurrealDB before 2.5.0 Privilege Escalation via Future Fields7.5 High
Umbraco.FormsNuGetUmbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp3.1 Low- dragonflyoss dragonflyDragonfly Manager Job API Allows Unauthenticated Access8.9 High
- google sentencepiece, red hat ai inference server, enterprise linux ai (rhel ai) 3 +3 more +5 moreInvalid Memory Access in Sentencepiece,8.5 High
- autodesk fusionStored XSS in Electronic Library Component Description8.1 High
- autodesk fusionStored XSS in the value of a part attribute8.1 High
- autodesk fusionStored XSS in Fusion desktop when attempting to delete a file8.1 High
- aa-team wordpress movies bulk importerWordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- hangzhou kuozhi network technology co., ltd. edusohoEduSoho < 22.4.7 Arbitrary File Read via classroom-course-statistics8.7 High
- qantumthemes kentha elementor widgetsWordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerability7.5 High
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ludwig you wpmastertoolkitWordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability4.3 Medium
- arul prasad j wp quick post duplicatorWordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerability4.3 Medium
- element invader – template kits for elementorWordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerability4.3 Medium
- launchinteractive merge + minify + refreshWordPress Merge + Minify + Refresh plugin <= 2.14 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- bplugins b sliderWordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themegoods photomeWordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability5.3 Medium
- wpjobportal wp job portalWordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- posimyth nexter blocksWordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exposure vulnerability4.3 Medium
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- bookingalgorithms ba book everythingWordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability4.3 Medium
- theme-one the gridWordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability5.3 Medium
- hclsoftware travelerWordPress Traveler theme < 3.2.8 - SQL Injection vulnerability8.5 High
- yithemes yith woocommerce request a quoteWordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability5.3 Medium
- storeapps stock manager for woocommerceWordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- thimpress learnpress – course reviewWordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- craig hewitt seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerability4.3 Medium
- brecht wp recipe makerWordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability4.3 Medium
- roxnor getgenieWordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability4.9 Medium
- favethemes houzez theme - functionalityWordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pencidesign penci shortcodes & performanceWordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpeverest user registrationWordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability4.3 Medium
- softwebmedia gyan elementsWordPress Gyan Elements plugin <= 2.2.1 - Local File Inclusion vulnerability7.5 High
- wp chill modula image galleryWordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- uxper goloWordPress Golo theme < 1.7.5 - Local File Inclusion vulnerability7.5 High
- uxper goloWordPress Golo theme < 1.7.5 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…