Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,650 results · page 195 of 773
Jan 23, 2026In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_CVE-2025-71159 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_get_or_create_delayed_node() set the delayed_node's refcount before acquiring the root->delayed_nodes lock. Commit e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes") moved refcount_set inside the critical section, which means there is no longer a memory barrier between setting the refcount and setting btrfs_inode->delayed_node. Without that barrier, the stores to node->refs and btrfs_inode->delayed_node may become visible out of order. Another thread can then read btrfs_inode->delayed_node and attempt to increment a refcount that hasn't been set yet, leading to a refcounting bug and a use-after-free warning. The fix is to move refcount_set back to where it was to take advantage of the implicit memory barrier provided by lock acquisition. Because the allocations now happen outside of the lock's critical section, they can use GFP_NOFS instead of GFP_ATOMIC.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 23, 2026An issue was discovered in Free5gc NRF 1.4.0.CVE-2025-66719 · Other software · Free5gc · reported by MITRECritical 9.1
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope.
- Product
- NRF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology SolutionCVE-2025-4320 · Other software · Birebirsoft Software and Technology Solutions · reported by iletisim@usom.gov.trCritical 10
Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation. This issue affects Sufirmam: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Sufirmam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 23, 2026Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and TecCVE-2025-4319 · Other software · Birebirsoft Software and Technology Solutions · reported by iletisim@usom.gov.trCritical 9.4
Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Brute Force, Password Recovery Exploitation. This issue affects Sufirmam: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Sufirmam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 23, 2026IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative funCVE-2026-1364 · Other software · JNC · reported by twcert@cert.org.twCritical 9.3
IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities.
- Product
- IAQS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 23, 2026IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administratoCVE-2026-1363 · Other software · JNC · reported by twcert@cert.org.twCritical 9.3
IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end.
- Product
- IAQS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 22, 2026ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability.CVE-2026-0794 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SIP calls. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28303.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-0793 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the InformaCast functionality. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28302.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-0792 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Alert-Info header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28301.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-0791 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Replaces header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28300.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability.CVE-2026-0787 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SAC module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28296.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0773 · Other software · Upsonic · reported by zdi-disclosures@trendmicro.comCritical 9.8
Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the add_tool endpoint, which listens on TCP port 7541 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26845.
- Product
- Upsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCVE-2026-0770 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comExploitedCritical 9.8
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
- Product
- Langflow
- On CISA’s list since
- Jul 21, 2026 (federal fix deadline Jul 24, 2026)
- What to do
- Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogzerodayinitiative.comcisa.gov
Jan 22, 2026Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability.CVE-2026-0769 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comCritical 9.8
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
- Product
- Langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Langflow code Code Injection Remote Code Execution Vulnerability.CVE-2026-0768 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comCritical 9.8
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.
- Product
- Langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0764 · Other software · GPT Academic · reported by zdi-disclosures@trendmicro.comCritical 9.8
GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upload endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27957.
- Product
- GPT Academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0763 · Other software · GPT Academic · reported by zdi-disclosures@trendmicro.comCritical 9.8
GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run_in_subprocess_wrapper_func function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27958.
- Product
- GPT Academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability.CVE-2026-0761 · Other software · Foundation Agents · reported by zdi-disclosures@trendmicro.comCritical 9.8
Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the actionoutput_str_to_mapping function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28124.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0760 · Other software · Foundation Agents · reported by zdi-disclosures@trendmicro.comCritical 9.8
Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deserialize_message function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28121.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability.CVE-2026-0759 · Other software · Katana Network · reported by zdi-disclosures@trendmicro.comCritical 9.8
Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Katana Network Development Starter Kit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeCommand method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27786.
- Product
- Development Starter Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability.CVE-2026-0756 · Other software · github-kanban-mcp-server · reported by zdi-disclosures@trendmicro.comCritical 9.8
github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the create_issue parameter. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27784.
- Product
- github-kanban-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability.CVE-2026-0755 · Other software · Gemini MCP Tool · reported by zdi-disclosures@trendmicro.comCritical 9.8
gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.
- Product
- gemini-mcp-tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability.CVE-2025-15063 · Other software · Ollama MCP Server · reported by zdi-disclosures@trendmicro.comCritical 9.8
Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27683.
- Product
- Ollama MCP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability.CVE-2025-15061 · Other software · Framelink · reported by zdi-disclosures@trendmicro.comCritical 9.8
Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the fetchWithRetry method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27877.
- Product
- Figma MCP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Jan 22, 2026Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-24304 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Resource Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-24307 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-24306 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Front Door
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Azure Entra ID Elevation of Privilege VulnerabilityCVE-2026-24305 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Azure Entra ID Elevation of Privilege Vulnerability
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing ovCVE-2026-21264 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections.CVE-2025-54816 · Other software · EVMAPA · reported by ics-cert@hq.dhs.govCritical 9.4
This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
- Product
- EVMAPA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Gitea does not properly validate repository ownership when linking attachments to releases.CVE-2026-20912 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.1
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Jan 22, 2026Gitea does not properly validate repository ownership when deleting Git LFS locks.CVE-2026-20897 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.1
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Jan 22, 2026Gitea does not properly validate project ownership in organization project operations.CVE-2026-20750 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.1
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Jan 22, 2026An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remoCVE-2026-1201 · Other software · Hubitat · reported by ics-cert@hq.dhs.govCritical 9.4
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.
- Product
- Elevation C3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10.CVE-2025-56590 · Other software · Apryse · reported by MITRECritical 9.8
An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server.
- Product
- Html2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo uCVE-2025-69828 · Other software · reported by MITRECritical 10
File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo upload in /Customer/AddEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtmsglobalsoft.com
Jan 22, 2026Xpro Elementor Addons: Unrestricted Upload of File with Dangerous TypeCVE-2025-69312 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.
- Product
- Xpro Elementor Addons
- Affected
- up to 1.4.19.1
- What to do
- Affects up to 1.4.19.1. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Workreap Core: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-69101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.
- Product
- Workreap Core
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Workreap Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Sound | Musical Instruments Online Store: Deserialization of Untrusted DataCVE-2025-69079 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.
- Product
- Sound | Musical Instruments Online Store
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Sound | Musical Instruments Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Registration & Login with Mobile Phone Number for WooCommerce: Missing AuthorizationCVE-2025-69052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for WooCommerce: from n/a through <= 1.3.1.
- Product
- Registration & Login with Mobile Phone Number for WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Miion: Unrestricted Upload of File with Dangerous TypeCVE-2025-68986 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through <= 1.2.7.
- Product
- Miion
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Miion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Blogzee: Unrestricted Upload of File with Dangerous TypeCVE-2025-68910 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a through <= 1.0.5.
- Product
- Blogzee
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Blogzee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Blogistic: Unrestricted Upload of File with Dangerous TypeCVE-2025-68909 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogistic blogistic allows Using Malicious Files.This issue affects Blogistic: from n/a through <= 1.0.5.
- Product
- Blogistic
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Blogistic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026LazyTasks: Incorrect Privilege AssignmentCVE-2025-68869 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37.
- Product
- LazyTasks
- Affected
- up to 1.2.37
- What to do
- Affects up to 1.2.37. Update LazyTasks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Paid Downloads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68857 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through <= 3.15.
- Product
- Paid Downloads
- Affected
- up to 3.15
- What to do
- Affects up to 3.15. Update Paid Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026CleverReach® WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68034 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.21.
- Product
- CleverReach® WP
- Affected
- up to 1.5.21
- What to do
- Affects up to 1.5.21. Update CleverReach® WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Order Listener for WooCommerce: Missing AuthorizationCVE-2025-68018 · WordPress plugins & themes · reported by PatchstackCritical 9.4
Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.
- Product
- Order Listener for WooCommerce
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Order Listener for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Event Tickets with Ticket Scanner: Improper Control of Generation of Code ('Code Injection')CVE-2025-68015 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.
- Product
- Event Tickets with Ticket Scanner
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026g-FFL Checkout: Unrestricted Upload of File with Dangerous TypeCVE-2025-68001 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through <= 2.1.0.
- Product
- g-FFL Checkout
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update g-FFL Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Real Homes CRM: Unrestricted Upload of File with Dangerous TypeCVE-2025-67968 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through <= 1.0.0.
- Product
- Real Homes CRM
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Real Homes CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.