CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- linux, linux kernel +1 moreperf: Ensure swevent hrtimer is properly destroyed7.8 High
- webguyio stop spammers classicStop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist4.3 Medium
- limesurveyLimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting5.1 Medium
- nordvpnNord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path8.5 High
- sharemouseShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path8.5 High
- inputdirector input directorInput Director 1.4.3 - 'Input Director' Unquoted Service Path8.5 High
- forensit forensitappxserviceForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path8.5 High
- guidoneele pdw file browserPDW File Browser <= v1.3 - Cross-Site Scripting (XSS)4.8 Medium
- gearboxcomputers program access controllerProgram Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path8.5 High
- preyproject preyPrey 1.9.6 - "CronService" Unquoted Service Path8.5 High
- gearboxcomputers ip watcherIP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path8.5 High
- epsonEPSON 1.124 - 'seksmdb.exe' Unquoted Service Path8.5 High
- wpchill passster – password protect pages and contentPassster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- inc2734 snow monkey formsSnow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal9.8 Critical
- flexense disk pulse enterprise, sync breeze enterprise server +1 moreauthenticated reflected XSS vulnerability in Sync Breeze Enterprise Server8.5 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server5.1 Medium
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server5.1 Medium
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server5.1 Medium
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server5.1 Medium
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server5.1 Medium
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreRemote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise Server8.2 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreCross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server8.5 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreCross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server8.5 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreCross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server8.5 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreCross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server8.5 High
- livehelperchatStored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat6.9 Medium
- johnson controls istar configuration utility (icu)Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool7.1 High
- miles99 wp google ad manager pluginWP Google Ad Manager Plugin <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings4.4 Medium
- chrisnowak change wp urlChange WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- nmedia frontend file manager pluginFrontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter7.5 High
- recooty – job widget (old dashboard)Recooty <= 1.0.6 - Cross-Site Request Forgery to Settings Update4.3 Medium
- wpblockart blockart blocks – gutenberg blocks, page builder blocks ,wordpress block plugin, sections & template libraryBlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- seomantis seo links interlinkingSEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' Parameter6.1 Medium
- lxicon bitcoin donate buttonBitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- nmedia simple user registrationSimple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field8.8 High
- shahrukhlinkgraph search atlas seo – premier seo plugin for one-click wp publishing & integrated ai optimizationSearch Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.12 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account T…8.8 High
- mamunreza vzaar media managementVzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']5.3 Medium
- rupantorpayRupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- hu chao imwptipimwptip <= 1.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- funambol cloud serverWeak encryption on Funambol's cloud server6.0 Medium
- hitachi energy suprosUse of default credentials vulnerability in Hitachi Energy SuprOS product8.8 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint7.2 High
- vinod-dalvi ivory search – wordpress search pluginIvory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters4.4 Medium
- wpcreatix vidshop – shoppable videos for woocommerceVidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'7.5 High
- wpcodefactory order minimum/maximum amount limits for woocommerceOrder Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields4.4 Medium
- mozilla thunderbirdCSS-based exfiltration of the content from partially encrypted emails when allowing remote content4.3 Medium
- solarwinds web help deskSolarWinds Web Help Desk Authentication Bypass Vulnerability9.8 Critical
- solarwinds web help deskSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- solarwinds web help deskSolarWinds Web Help Desk Authentication Bypass Vulnerability9.8 Critical
- solarwinds web help deskSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- Show moreLoading…