CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- webdevstudios automatic featured images from videosWordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability4.3 Medium
- upress booterWordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability4.3 Medium
- sitelock security – wp hardening, login security & malware scansWordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability4.3 Medium
- select-themes prowessWordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability7.5 High
- sheepfish webp conversionWordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability5.3 Medium
- alejandro quick restaurant reservationsWordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability5.3 Medium
- pixelgrade nova blocksWordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- steve truman email inquiry & cart options for woocommerceWordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cloudpanel clp varnish cacheWordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability5.3 Medium
- essekia tablesomeWordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability4.3 Medium
- marcus (aka @msykes) wp fullcalendarWordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability5.3 Medium
- mythemeshop wp subscribeWordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability4.3 Medium
- timur kamaev kama thumbnailWordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- linux, linux kernel +1 moreRDMA/core: always drop device refcount in ib_del_sub_device_and_put()7.8 High
- linux, linux kernel +1 moregve: defer interrupt enabling until NAPI registration7.8 High
- linux, linux kernel +1 moreKVM: s390: Fix gmap_helper_zap_one_page() again7.8 High
- linux, linux kernel +1 morenet: usb: rtl8150: fix memory leak on usb_submit_urb() failure5.5 Medium
- linux, linux kernel +1 moreksmbd: Fix memory leak in get_file_all_info()5.5 Medium
- linux, linux kernel +1 morenet: dsa: properly keep track of conduit reference7.8 High
- linux, linux kernel +1 moreksmbd: Fix refcount leak when invalid session is found on session lookup7.5 High
- linux, linux kernel +1 morenet/handshake: restore destructor on submit failure3.3 Low
- linux, linux kernel +1 moreKEYS: trusted: Fix a memory leak in tpm2_load_cmd5.5 Medium
- linux, linux kernel +1 morenetfilter: nf_conncount: fix leaked ct in error paths7.5 High
- linux, linux kernel +1 moreusb: phy: isp1301: fix non-OF device reference imbalance7.8 High
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update4.3 Medium
- legalweb wp dsgvo tools (gdpr)WP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode6.4 Medium
- melapress role editorMelapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment8.8 High
- birebirsoft software and technology solutions sufirmamInformation Disclosure in Birebirsoft's Sufirmam10.0 Critical
- birebirsoft software and technology solutions sufirmamImproper Access Control in Birebirsoft's Sufirmam9.4 Critical
- tapandsign technologies software inc. tap&signXSS in Tapandsign Technologies' Tap&Sign App4.7 Medium
- dell data protection advisorDell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of...4.3 Medium
- dell objectscale, elastic cloud storage +1 moreDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0,...5.5 Medium
kernel-firmwareSUSERecommended update for kernel-firmwareNo score- dell objectscale, elastic cloud storage +1 moreDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0,...4.4 Medium
- dell objectscale, elastic cloud storage +1 moreDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0,...6.5 Medium
- dell objectscale, elastic cloud storage +1 moreDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0,...8.8 High
- dell objectscale, elastic cloud storage +1 moreDell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0,...7.5 High
- jnc i6, iaqs +1 moreJNC｜IAQS and I6 - Missing Authentication9.3 Critical
- jnc i6, iaqs +1 moreJNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security9.3 Critical
- libexpat project libexpat, siemens ruggedcom rst2428p (6gk6242-6pa00), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreIn libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler...2.9 Low
- buddypressBuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- red hat amq broker 7, build of optaplanner 8, data grid 8 +20 more +22 moreOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection8.3 High
- rebelcode rss aggregator – rss import, news feeds, feed to post, and autobloggingRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode6.4 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema6.4 Medium
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload5.3 Medium
- moodleMoodle: moodle: remote code execution via insufficient restore input validation8.8 High
- uncannyowl uncanny automator – easy automation, integration, webhooks & workflow builder pluginUncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- No product listedSipp/sipp: sipp: denial of service and potential arbitrary code execution vulnerability8.4 High
- anritsu vectorstarAnritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- anritsu vectorstarAnritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- Show moreLoading…