Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

366new WordPress flaws this week

393,576entries in the database

17,669 results · page 147 of 354

Jan 23, 2026A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that CVE-2025-52022 · Other software · Aptsys · reported by MITREMedium 5.3
A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
Product
Gemscms Backend
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Jan 23, 2026Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.CVE-2025-70986 · Other software · Ruoyi · reported by MITREHigh 7.5
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
Product
Ruoyi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gitee.com
Jan 23, 2026Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.CVE-2025-70985 · Other software · Ruoyi · reported by MITRECritical 9.1
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
Product
Ruoyi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gitee.com
Jan 23, 2026All-in-One Video Gallery: Unauthorized modification of dataCVE-2025-14947 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates.
Product
All-in-One Video Gallery
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof bacCVE-2025-67229 · Other software · Todesktop · reported by MITRECritical 9.8
An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.
Product
Builder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record todesktop.com todesktop.com
Jan 23, 2026An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible cliCVE-2025-69908 · Other software · Newgensoft · reported by MITREHigh 7.5
An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible client-side JavaScript resource.
Product
Omniapp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com newgensoft.com
Jan 23, 2026AWP Classifieds: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24593 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through <= 4.4.3.
Product
AWP Classifieds
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Fraud Prevention For Woocommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24553 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.2.
Product
Fraud Prevention For Woocommerce
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Fraud Prevention For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Webpushr: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.
Product
Webpushr
Affected
up to 4.38.0
What to do
Affects up to 4.38.0. Update Webpushr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026WP FullCalendar: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.
Product
WP FullCalendar
Affected
up to 1.6
What to do
Affects up to 1.6. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabCVE-2025-69907 · Other software · reported by MITREHigh 7.5
An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A remote attacker can access this endpoint without valid credentials to retrieve sensitive internal configuration information, including cabinet names and database-related metadata. This allows unauthorized enumeration of backend deployment details and may facilitate further targeted attacks.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com newgensoft.com
Jan 23, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Unauthorized modification or loss of dataCVE-2025-13921 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function in all versions up to, and including, 2.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit any documentation post. The vulnerability was partially patched in version 2.1.16.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.1.16
What to do
Affects up to 2.1.16. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative funCVE-2026-1364 · Other software · JNC · reported by twcert@cert.org.twCritical 9.3
IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities.
Product
IAQS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 23, 2026IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administratoCVE-2026-1363 · Other software · JNC · reported by twcert@cert.org.twCritical 9.3
IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end.
Product
IAQS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 22, 2026Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-24307 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Product
Microsoft 365 Copilot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-24306 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
Product
Azure Front Door
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-21524 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.
Product
Azure Data Explorer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-21521 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.4
Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.
Product
Microsoft 365 Word Copilot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attCVE-2026-21520 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
Product
Microsoft Copilot Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing ovCVE-2026-21264 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.
Product
Microsoft Account
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a CVE-2026-21227 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
Product
Azure Logic Apps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jan 22, 2026An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systemCVE-2025-67652 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 6.1
An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type of exploitation, leaving sensitive information more vulnerable.
Product
CLICK Programmable Logic Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Jan 22, 2026This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections.CVE-2025-54816 · Other software · EVMAPA · reported by ics-cert@hq.dhs.govCritical 9.4
This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Product
EVMAPA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Jan 22, 2026A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalaCVE-2025-14751 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 8.7
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.
Product
cMT3072XH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 22, 2026A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuCVE-2025-68609 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.6
A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.
Product
com.palantir.aries:aries
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record palantir.safebase.us
Jan 22, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.6.3.
Product
Nexter Blocks
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Contact Form & Lead Form Elementor Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
Product
Contact Form & Lead Form Elementor Builder
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Salon booking system: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.
Product
Salon booking system
Affected
up to 10.30.3
What to do
Affects up to 10.30.3. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026REHub Framework: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63051 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.
Product
REHub Framework
What to do
Update REHub Framework to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functioCVE-2026-1332 · Other software · HAMASTAR Technology · reported by twcert@cert.org.twMedium 6.9
MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information.
Product
MeetingHub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shelCVE-2026-1331 · Other software · AMASTAR Technology · reported by twcert@cert.org.twCritical 9.3
MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Product
MeetingHub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path TraversCVE-2026-1330 · Other software · HAMASTAR Technology · reported by twcert@cert.org.twHigh 8.7
MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Product
MeetingHub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 21, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Unauthorized modification of dataCVE-2026-1036 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.36
What to do
Affects up to 1.8.36. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 21, 2026Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute adminisCVE-2026-0834 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.2
Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366
Product
Archer C20 v6.0, Archer AX53 v1.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattg.systems tp-link.com
Jan 21, 2026GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side codCVE-2021-47860 · Other software · GetSimple CMS · reported by VulnCheckHigh 8.5
GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.
Product
Custom JS Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record get-simple.info github.com
Jan 21, 2026Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint.CVE-2021-47851 · Other software · Yodinfo · reported by VulnCheckCritical 9.3
Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage the /op=command endpoint to download and execute payloads by sending crafted JSON requests with malicious script commands.
Product
Mini Mouse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record apps.apple.com exploit-db.com
Jan 21, 2026Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers CVE-2021-47846 · Other software · I Want Source Codes · reported by VulnCheckHigh 8.8
Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.
Product
Digital Crime Report Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iwantfilemanager.com iwantsourcecodes.com
Jan 21, 2026Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files.CVE-2021-47802 · Other software · Shenzhen Tenda Technology Co.,Ltd. · reported by VulnCheckHigh 8.7
Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without authentication.
Product
Tenda D151 & D301
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com tendacn.com
Jan 21, 2026A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH serCVE-2026-20080 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH service to stop responding. This vulnerability exists because the SSH service lacks effective flood protection. An attacker could exploit this vulnerability by initiating a denial of service (DoS) attack against the SSH port. A successful exploit could allow the attacker to cause the SSH service to be unresponsive during the period of the DoS attack. All other operations remain stable during the attack.
Product
Cisco Ultra-Reliable Wireless Backhaul
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Jan 21, 2026Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain CVE-2026-22022 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.2
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components. Only deployments that meet all of the following criteria are impacted by this vulnerability: * Use of Solr's "RuleBasedAuthorizationPlugin" * A RuleBasedAuthorizationPlugin config (see security.json) that specifies multiple "roles" * A RuleBasedAuthorizationPlugin permission list (see security.json) that uses one or more of the following pre-defined permission rules: "config-read", "config-edit", "schema-read", "metrics-read", or "security-read". * A RuleBasedAuthorizationPlugin permission list that doesn't define the "all" pre-defined permission * A networking setup that allows clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr as-is, unmodified or restricted by any intervening proxy or gateway) Users can mitigate this vulnerability by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the "all" pre-defined permission and associates the permission with an
Product
Apache Solr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jan 20, 2026IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a userCVE-2025-36411 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Product
ApplinX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Jan 20, 2026IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side seCVE-2025-36410 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security.
Product
ApplinX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Jan 20, 2026NotificationX: Unauthorized modification of dataCVE-2026-0554 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and including, 3.1.11. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset analytics for any NotificationX campaign, regardless of ownership.
Product
NotificationX
Affected
up to 3.1.11
What to do
Affects up to 3.1.11. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 20, 2026Tutor LMS – eLearning and online course solution: Unauthorized attachment deletionCVE-2026-0548 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026Creator LMS – The LMS for Creators, Coaches, and Trainers: Unauthorized modification of data that can lead to privilege escalationCVE-2025-15347 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor level access and above, to update arbitrary WordPress options.
Product
Creator LMS – The LMS for Creators, Coaches, and Trainers
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Creator LMS – The LMS for Creators, Coaches, and Trainers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026The Events Calendar: Unauthorized accessCVE-2025-15043 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.
Product
The Events Calendar
Affected
up to 6.15.13
What to do
Affects up to 6.15.13. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to lCVE-2026-1221 · Other software · BROWAN COMMUNICATIONS · reported by twcert@cert.org.twCritical 9.3
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to the database using hardcoded database credentials stored in the firmware.
Product
PrismX MX100 AP controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 19, 2026Custom Fonts – Host Your Fonts Locally: Unauthorized loss of dataCVE-2025-14351 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google_Fonts_Compatibility' class constructor function in all versions up to, and including, 2.1.16. This makes it possible for unauthenticated attackers to delete font directory and rewrite theme.json file.
Product
Custom Fonts – Host Your Fonts Locally
Affected
up to 2.1.16
What to do
Affects up to 2.1.16. Update Custom Fonts – Host Your Fonts Locally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 19, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net): Unauthorized modification of dataCVE-2025-14978 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders.
Product
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net)
Affected
up to 1.119.8
What to do
Affects up to 1.119.8. Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 19, 2026Image Photo Gallery Final Tiles Grid: Unauthorized access and modification of dataCVE-2025-15466 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.