Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

38,650 results · page 197 of 773

Jan 19, 2026An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauCVE-2025-11043 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comCritical 9.1
An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.
Product
B&R Automation Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record br-automation.com
Jan 19, 2026SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12CVE-2026-0610 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Jan 19, 2026Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requCVE-2026-1181 · Other software · Altium · reported by 4760f414-e1ae-4ff1-bdad-c7a9c3538b79Critical 9
Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.
Product
Altium 365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record altium.com
Jan 17, 2026Registration & Login with Mobile Phone Number for WooCommerce: Authentication BypassCVE-2025-10484 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.
Product
Registration & Login with Mobile Phone Number for WooCommerce
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record woocommerce.com wordfence.com
Jan 16, 2026RegistrationMagic: Privilege EscalationCVE-2025-15403 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
Product
RegistrationMagic
Affected
up to 6.0.7.1
What to do
Affects up to 6.0.7.1. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Modular DS: Incorrect Privilege AssignmentCVE-2026-23800 · WordPress plugins & themes · reported by PatchstackCritical 10
Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0.
Product
Modular DS
Fixed in
2.6.0
What to do
Update Modular DS to 2.6.0 or newer.
Full record and what to do →NVD record patchstack.com
Jan 16, 2026MCPJam inspector is the local-first development platform for MCP servers.CVE-2026-23744 · Other software · MCPJam · reported by GitHubCritical 9.8
MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.
Product
inspector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2026WeGIA is a Web Manager for Charitable Institutions.CVE-2026-23722 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.1
WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2.
Product
WeGIA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 16, 2026the bundled plupload example endpoint: Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file uploadCVE-2012-10064 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions, enabling an attacker to place attacker-controlled files under the plugin's uploads directory. This can lead to remote code execution if a server-executable file type is uploaded and subsequently accessed.
Product
the bundled plupload example endpoint
What to do
Update the bundled plupload example endpoint to the newest version.
Full record and what to do →NVD record packetstorm.news web.archive.org
Jan 16, 2026Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs.CVE-2026-23523 · Other software · OpenAgentPlatform · reported by GitHubCritical 9.6
Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim’s machine. This vulnerability is fixed in 0.13.0.
Product
Dive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2026Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.CVE-2026-21624 · Websites & servers · reported by security@joomla.orgCritical 9.4
Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record stackideas.com
Jan 16, 2026Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.CVE-2026-21623 · Websites & servers · reported by security@joomla.orgCritical 9.4
Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record stackideas.com
Jan 16, 2026Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, alCVE-2025-14894 · Other software · bee interactive · reported by cret@cert.orgCritical 9.8
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Product
Livewire Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com hackingbydoing.wixsite.com
Jan 16, 2026Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 beforCVE-2025-14510 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.2
Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120.
Product
ABB Ability OPTIMAX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com
Jan 16, 2026Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remoCVE-2025-60021 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter.. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
Product
Apache bRPC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jan 15, 2026Delta Electronics DIAView has multiple vulnerabilities.CVE-2025-62582 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.8
Delta Electronics DIAView has multiple vulnerabilities.
Product
DIAView
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Jan 15, 2026Delta Electronics DIAView has multiple vulnerabilities.CVE-2025-62581 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.8
Delta Electronics DIAView has multiple vulnerabilities.
Product
DIAView
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Jan 15, 2026The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code CVE-2025-65118 · Other software · AVEVA · reported by ics-cert@hq.dhs.govCritical 9.3
The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.
Product
Process Optimization
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com softwaresupportsp.aveva.com
Jan 15, 2026The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS systCVE-2025-64691 · Other software · AVEVA · reported by ics-cert@hq.dhs.govCritical 9.3
The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server.
Product
Process Optimization
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com softwaresupportsp.aveva.com
Jan 15, 2026The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and aCVE-2025-61943 · Other software · AVEVA · reported by ics-cert@hq.dhs.govCritical 9.3
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.
Product
Process Optimization
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com softwaresupportsp.aveva.com
Jan 15, 2026The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potCVE-2025-61937 · Other software · AVEVA · reported by ics-cert@hq.dhs.govCritical 10
The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server.
Product
Process Optimization
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com softwaresupportsp.aveva.com
Jan 15, 2026Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to CVE-2025-14237 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to triggerCVE-2025-14236 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmentCVE-2025-14235 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to triggCVE-2025-14234 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment toCVE-2025-14233 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment toCVE-2025-14232 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment tCVE-2025-14231 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.3
Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Product
Satera LBP670C Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon.jp psirt.canon
Jan 15, 2026GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the schCVE-2021-47812 · Other software · Getgrav · reported by VulnCheckCritical 9.3
GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.
Product
GravCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record getgrav.org exploit-db.com
Jan 15, 2026Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2026-22863 · Other software · denoland · reported by GitHubCritical 9.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.
Product
deno
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 15, 2026A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content.CVE-2026-1009 · Other software · Altium · reported by 4760f414-e1ae-4ff1-bdad-c7a9c3538b79Critical 9
A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.
Product
Altium Live
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record altium.com
Jan 15, 2026A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacCVE-2025-67822 · Email & office · Mitel · reported by MITRECritical 9.4
A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gain unauthorized access to user or admin accounts in the system.
Product
Mivoice Mx-one
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mitel.com mitel.com
Jan 15, 2026Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution.CVE-2023-7334 · Other software · Changjetong Information Technology Co., Ltd. · reported by VulnCheckCritical 9.3
Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).
Product
T+
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.csdn.net blog.csdn.net
Jan 15, 2026process_upload.php due to missing file type validation: Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file uploadCVE-2011-10041 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
Product
process_upload.php due to missing file type validation
Affected
up to 1.0
What to do
Affects up to 1.0. Update process_upload.php due to missing file type validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstorm.news wpscan.com
Jan 15, 2026Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an CVE-2026-23746 · Other software · Entrust Corporation · reported by VulnCheckCritical 9.3
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.
Product
Instant Financial Issuance (IF)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trustedcare.entrust.com entrust.com
Jan 15, 2026Arcane provides modern docker management.CVE-2026-23520 · Other software · getarcaneapp · reported by GitHubCritical 9
Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.
Product
arcane
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 15, 2026Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions.CVE-2025-62193 · Other software · National Oceanic and Atmospheric Administration (NOAA) · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.
Product
Live Access Server (LAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 15, 2026File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PCVE-2025-67079 · Other software · Agora-project · reported by MITRECritical 9.8
File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.
Product
Agora-project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record agora-project.net helx.io
Jan 15, 2026ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capaCVE-2021-47819 · Other software · Projeqtor · reported by VulnCheckCritical 9.3
ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capabilities. Attackers can upload a PHP script through the profile attachment section and execute system commands by accessing the uploaded file with a specially crafted request parameter.
Product
ProjeQtOr Project Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com projeqtor.org
Jan 15, 2026phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension CVE-2021-47753 · Websites & servers · Phpkf · reported by VulnCheckCritical 9.3
phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers can upload a PHP file disguised as a PNG, rename it, and execute system commands through a crafted web shell parameter.
Product
phpKF CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com phpkf.com
Jan 15, 2026File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executCVE-2025-67084 · Other software · Invoiceplane · reported by MITRECritical 9.9
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Product
Invoiceplane
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com helx.io
Jan 15, 2026Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.CVE-2026-22908 · Other software · SICK AG · reported by psirt@sick.deCritical 9.1
Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.
Product
TDC-X401GL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com cisa.gov
Jan 15, 2026An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-22907 · Other software · SICK AG · reported by psirt@sick.deCritical 9.9
An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
Product
TDC-X401GL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com cisa.gov
Jan 14, 2026FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().CVE-2025-70968 · Other software · Freeimage Project · reported by MITRECritical 9.8
FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().
Product
Freeimage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 14, 2026A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements.CVE-2025-37184 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.
Product
EdgeConnect SD-WAN Orchestrator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Jan 14, 2026The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs.CVE-2026-22240 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password.
Product
BLUVOYIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blusparkglobal.com
Jan 14, 2026The vulnerability exists in BLUVOYIX due to design flaws in the email sending API.CVE-2026-22239 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.
Product
BLUVOYIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blusparkglobal.com
Jan 14, 2026The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs.CVE-2026-22238 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to create a new user with admin privileges. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in to the newly-created admin user.
Product
BLUVOYIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blusparkglobal.com
Jan 14, 2026The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation.CVE-2026-22237 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability could allow the attacker to cause damage to the targeted platform by abusing internal functionality.
Product
BLUVOYIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blusparkglobal.com
Jan 14, 2026The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs.CVE-2026-22236 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable APIs. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform.
Product
BLUVOYIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blusparkglobal.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.