Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,650 results · page 194 of 773
Jan 27, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before CVE-2026-24871 · Other software · pilgrimage233 · reported by cve_disclosure@tech.gov.sgCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before 3.0.
- Product
- Minecraft-Rcon-Manage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.CVE-2026-24832 · Other software · ixray-team · reported by cve_disclosure@tech.gov.sgCritical 9.8
Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.
- Product
- ixray-1.6-stcop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026xrdp is an open source RDP server.CVE-2025-68670 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands througCVE-2021-47900 · Other software · Gila CMS · reported by VulnCheckCritical 9.3
Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through manipulated HTTP headers. Attackers can inject PHP code in the User-Agent header with shell_exec() to run system commands by sending crafted requests to the admin endpoint.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system.CVE-2026-1470 · Other software · N8n · reported by reefs@jfrog.comCritical 9.9
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
- Product
- N8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Jan 27, 2026Integer Overflow or Wraparound vulnerability in Ralim IronOS.This issue affects IronOS: before v2.23-rc2.CVE-2026-24830 · Other software · Ralim · reported by cve_disclosure@tech.gov.sgCritical 9.8
Integer Overflow or Wraparound vulnerability in Ralim IronOS.This issue affects IronOS: before v2.23-rc2.
- Product
- IronOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver tCVE-2026-24826 · Other software · cadaver · reported by cve_disclosure@tech.gov.sgCritical 10
Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver turso3d.This issue affects .
- Product
- turso3d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT X-TRACK (Software/X-Track/USER/App/Utils/CVE-2026-24823 · Other software · FASTSHIFT · reported by cve_disclosure@tech.gov.sgCritical 10
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT X-TRACK (Software/X-Track/USER/App/Utils/lv_img_png/PNGdec/src modules). This vulnerability is associated with program files inflate.C. This issue affects X-TRACK: through v2.7.
- Product
- X-TRACK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules).CVE-2026-24822 · Other software · ttttupup · reported by cve_disclosure@tech.gov.sgCritical 10
Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is associated with program files mongoose.C. This issue affects wxhelper: through 3.9.10.19-v1.
- Product
- wxhelper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules).CVE-2026-24821 · Other software · turanszkij · reported by cve_disclosure@tech.gov.sgCritical 9.3
Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C. This issue affects WickedEngine: through 0.71.727.
- Product
- WickedEngine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis (tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules)CVE-2026-24816 · Other software · datavane · reported by cve_disclosure@tech.gov.sgCritical 10
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis (tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules). This vulnerability is associated with program files ChangeDomainAction.Java. This issue affects tis: before v4.3.0.
- Product
- tis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extCVE-2026-24815 · Other software · datavane · reported by cve_disclosure@tech.gov.sgCritical 10
Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules). This vulnerability is associated with program files XmlFile.Java. This issue affects tis: before v4.3.0.
- Product
- tis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules).CVE-2026-24814 · Other software · swoole · reported by cve_disclosure@tech.gov.sgCritical 10
Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is associated with program files sds.C. This issue affects swoole-src: before 6.0.2.
- Product
- swoole-src
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Vulnerability in root-project root (builtins/zlib modules).CVE-2026-24812 · Other software · root-project · reported by cve_disclosure@tech.gov.sgCritical 9.3
Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inftrees.C. This issue affects root: through 6.36.00-rc1.
- Product
- root
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Vulnerability in root-project root (builtins/zlib modules).CVE-2026-24811 · Other software · root-project · reported by cve_disclosure@tech.gov.sgCritical 9.3
Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inffast.C. This issue affects root.
- Product
- root
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules).CVE-2026-24810 · Other software · rethinkdb · reported by cve_disclosure@tech.gov.sgCritical 10
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules). This vulnerability is associated with program files cJSON.Cc. This issue affects rethinkdb: through v2.4.4.
- Product
- rethinkdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules).CVE-2026-24804 · Other software · coolsnowwolf · reported by cve_disclosure@tech.gov.sgCritical 9.2
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.
- Product
- lede
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modulesCVE-2026-24803 · Other software · coolsnowwolf · reported by cve_disclosure@tech.gov.sgCritical 9.2
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.
- Product
- lede
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules).CVE-2026-24800 · Other software · tildearrow · reported by cve_disclosure@tech.gov.sgCritical 10
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.
- Product
- furnace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules).CVE-2026-24798 · Other software · GaijinEntertainment · reported by cve_disclosure@tech.gov.sgCritical 9.3
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules). This vulnerability is associated with program files upnpreplyparse.C. This issue affects DagorEngine: through dagor_2025_01_15.
- Product
- DagorEngine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardboardpowered/impl/worCVE-2026-24794 · Other software · CardboardPowered · reported by cve_disclosure@tech.gov.sgCritical 9.2
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardboardpowered/impl/world modules). This vulnerability is associated with program files WorldImpl.Java. This issue affects cardboard: before 1.21.4.
- Product
- cardboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules).CVE-2026-24793 · Other software · azerothcore · reported by cve_disclosure@tech.gov.sgCritical 10
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects azerothcore-wotlk: through v4.0.0.
- Product
- azerothcore-wotlk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training.CVE-2026-24479 · Other software · zhblue · reported by GitHubCritical 9.3
HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.
- Product
- hustoj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-22709 · Other software · patriksimek · reported by GitHubCritical 9.8
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives).CVE-2026-22696 · Other software · Phala-Network · reported by GitHubCritical 9.3
dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral (including qe_identity, qe_identity_signature, and qe_identity_issuer_chain) from the PCCS. However, it skips to verify the QE Identity signature against its certificate chain and does not enforce policy constraints on the QE Report. An attacker can forge the QE Identity data to whitelist a malicious or non-Intel Quoting Enclave. This allows the attacker to forge the QE and sign untrusted quotes that the verifier will accept as valid. Effectively, this bypasses the entire remote attestation security model, as the verifier can no longer trust the entity responsible for signing the quotes. All deployments utilizing the dcap-qvl library for SGX or TDX quote verification are affected. The vulnerability has been patched in dcap-qvl version 0.3.9. The fix implements the missing cryptographic verification for the QE Identity signature and enforces the required checks for MRSIGNER, ISVPRODID, and ISVSVN against the QE
- Product
- dcap-qvl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpCVE-2026-24436 · Other software · Shenzhen Tenda Technology Co., Ltd. · reported by VulnCheckCritical 9.2
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.
- Product
- W30E V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtendacn.comvulncheck.com
Jan 26, 2026Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account thaCVE-2026-24429 · Other software · Shenzhen Tenda Technology Co., Ltd. · reported by VulnCheckCritical 9.3
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default credentials to gain authenticated access to the management interface.
- Product
- W30E V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtendacn.comvulncheck.com
Jan 26, 2026Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.CVE-2025-70982 · Other software · Bladex · reported by MITRECritical 9.9
Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.
- Product
- Springblade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 26, 2026** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.CVE-2016-15057 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.9
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Continuum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jan 26, 2026By default, the password for the Access Manager's web interface, is set to 'admin'.CVE-2025-59108 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.2
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.
- Product
- Access Manager 92xx-k5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions.CVE-2025-59103 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.2
The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users with hardcoded and weak passwords that can be used to access the devices via SSH. The passwords can be also guessed very easily. The password of at least one user is set to a random value after the first deployment, with the restriction that the password is only randomized if the configured date is prior to 2022. Therefore, under certain circumstances, the passwords are not randomized. For example, if the clock is never set on the device, the battery of the clock module has been changed, the Access Manager has been factory reset and has not received a time yet.
- Product
- Access Manager 92xx-k5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026The exos 9300 application can be used to configure Access Managers (e.g.CVE-2025-59097 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.3
The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps. This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication: - Re-configure Access Managers (e.g. remove alarming system requirements) - Freely re-configure the inputs and outputs - Open all connected doors permanently - Open all doors for a defined time interval - Change the admin password - and many more Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure conf
- Product
- Access Manager 92xx-k5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005.CVE-2025-59091 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.3
Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the Access Managers via this interface is also possible. To send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors.
- Product
- Kaba exos 9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026On the exos 9300 server, a SOAP API is reachable on port 8002.CVE-2025-59090 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.3
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.
- Product
- Kaba exos 9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 24, 2026Kalrav AI Agent: Arbitrary file uploadsCVE-2025-13374 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Kalrav AI Agent
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Kalrav AI Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 23, 2026A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shadCVE-2025-13952 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceCritical 9.8
A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. The shader code contained in the web page executes a path in the compiler that held onto an out of date pointer, pointing to a freed memory object.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026ChatterMate is a no-code AI chatbot agent framework.CVE-2026-24399 · Other software · chattermate · reported by GitHubCritical 9.3
ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an <iframe> payload containing a javascript: URI can be processed and executed in the browser context. This allows access to sensitive client-side data such as localStorage tokens and cookies, resulting in client-side injection. This issue has been fixed in version 1.0.9.
- Product
- chattermate.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, UnsubCVE-2026-22586 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, SubscrCVE-2026-22585 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module)CVE-2026-22583 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) CVE-2026-22582 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28.CVE-2025-52025 · Other software · Aptsys · reported by MITRECritical 9.4
An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users.CVE-2025-52024 · Other software · Aptsys · reported by MITRECritical 9.4
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.CVE-2025-70985 · Other software · Ruoyi · reported by MITRECritical 9.1
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Jan 23, 2026Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.CVE-2025-70983 · Other software · Bladex · reported by MITRECritical 9.9
Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.
- Product
- Springblade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 23, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
- Product
- SmarterMail
- On CISA’s list since
- Feb 5, 2026 (federal fix deadline Feb 26, 2026)
- What to do
- Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcode-white.comsmartertools.com
Jan 23, 2026An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof bacCVE-2025-67229 · Other software · Todesktop · reported by MITRECritical 9.8
An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.
- Product
- Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtodesktop.comtodesktop.com
Jan 23, 2026An issue was discovered in Dynamicweb before 9.12.8.CVE-2022-25369 · Other software · reported by MITRECritical 9.8
An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have added, it is possible to upload an executable file and achieve command execution. This is fixed in 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9.8, 9.10.18, 9.12.8, and 9.13.0 (and later).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassetnote.iodynamicweb.com
Jan 23, 2026Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands.CVE-2021-47891 · Other software · Unified Intents AB · reported by VulnCheckCritical 9.3
Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit the service by connecting to port 9512 and sending specially crafted packets to open a command prompt and download and execute malicious payloads.
- Product
- Unified Remote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comunifiedremote.com
Jan 23, 2026In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bCVE-2026-22984 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: changelog ]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.