CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- solarwinds web help deskSolarWinds Web Help Desk Hardcoded Credentials Vulnerability7.5 High
- solarwinds web help deskSolarWinds Web Help Desk Security Control Bypass Vulnerability8.1 High
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification5.3 Medium
- bplugins document embedder – embed pdfs, word, excel, and other filesDocument Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion4.3 Medium
- migaweb simple calendar for elementorSimple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion5.3 Medium
- saad iqbal new user approveNew User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure7.3 High
- presstigers simple folioSimple Folio <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields6.4 Medium
- bfintal interactions – create interactive experiences in the block editorInteractions – Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- supercleanse buy now plus — payments with stripeBuy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- wpbits addons for elementor page builderWPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export5.3 Medium
- codeccoop forms bridge – infinite integrationsForms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- jirafeauImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau6.1 Medium
- unknown user activity logUser Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update5.3 Medium
- codepeople appointment hour booking – booking calendarAppointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration4.4 Medium
- bloompixel tablemaster for elementor – advanced responsive tables for elementorTableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter7.2 High
- iulia-cazan easy replace imageEasy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement4.3 Medium
- nebojsadabic target video easy publishTarget Video Easy Publish <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter6.4 Medium
- 2100 technology official document management system2100 Technology｜Official Document Management System - Incorrect Authorization7.1 High
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injection8.6 High
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 URL Filter set_temp_nodes.php os command injection8.6 High
- naver billboard.jsbillboard.js is vulnerable to XSS during chart option binding6.1 Medium
- atlassian crowd, crowd data center +1 moreThis High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7...7.9 High
- color iccdeviccDEV has a heap-buffer-overflow in icXmlParseTextString()6.1 Medium
- rustcrypto signaturesML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices5.3 Medium
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal8.2 High
- dokployDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint9.9 Critical
- dokployDokploy uses hardcoded credentials in installation script, which could result in database access8.0 High
gpsdOSS-FuzzSegv on unknown address in aivdm_analyzeNo score- dokployDokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers4.7 Medium
- oneflowAn input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows...7.5 High
- oneflowA floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows...6.5 Medium
- oneflowA floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers...6.5 Medium
- oneflowA segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers...6.5 Medium
- oneflowAn input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows...7.5 High
- oneflowA floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows...6.5 Medium
- oneflowA segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to...6.5 Medium
- oneflowAn issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a...7.5 High
- oneflowA GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0...7.5 High
- podcastgenerator podcast generatorA Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' an…4.8 Medium
- altumcode 66biolinksA session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application...9.1 Critical
- altumcode 66biolinksA directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks...6.5 Medium
- No product listedAn issue in Amidaware Inc Tactical RMM v1.3.1 and before allows a remote attacker to execute...8.8 High
- oneflowA GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice...7.5 High
- oneflowA device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS)...7.5 High
- oneflowA type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause...7.5 High
- oneflowA dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to...7.5 High
- oneflowA division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows...6.5 Medium
- oneflowA shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service ...7.5 High
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Critical
- Show moreLoading…