Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,827 results · page 22 of 137
Jan 28, 2026A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.CVE-2025-71004 · Other software · Oneflow · reported by MITREMedium 6.5
A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Product
- Oneflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creationCVE-2025-69517 · Other software · reported by MITREHigh 8.8
An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via the POST /api/v3/newagent/ endpoint. The agent_id parameter accepts up to 255 characters and is improperly sanitized using DOMPurify.sanitize() with the html: true option enabled, which fails to adequately filter HTML input. The injected HTML is rendered in the Tactical RMM management panel when an administrator attempts to remove or shut down the affected agent, potentially leading to client-side attacks such as UI manipulation or phishing. NOTE: the Supplier's position is that this has incorrect information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 28, 2026Vulnerable cross-model authorization in juju.CVE-2026-1237 · Other software · Canonical · reported by security@ubuntu.comLow 2.1
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
- Product
- juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-67645 · Other software · openemr · reported by GitHubHigh 8.8
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request parameters (pubpid / pid) to reference another user’s record; the server accepts the modified IDs and applies the changes to that other user’s profile. This allows one user to alter another user’s profile data (name, contact info, etc.), and could enable account takeover. Version 7.0.4 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-54373 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sensitive data is unintentionally revealed to unauthorized parties. Contents of Clinical Notes and Care Plan, where an encounter has Sensitivity=high, can be viewed and changed by users who do not have Sensitivities=high privilege. Version 7.0.4 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system.CVE-2026-1470 · Other software · N8n · reported by reefs@jfrog.comCritical 9.9
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
- Product
- N8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Jan 26, 2026QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" tCVE-2026-24480 · Other software · qgis · reported by GitHubHigh 8.7
QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code execution and repository compromise because it used the `pull_request_target` trigger and then checked out and executed untrusted pull request code in a privileged context. Workflows triggered by `pull_request_target` ran with the base repository's credentials and access to secrets. If these workflows then checked out and executed code from the head of an external pull request (which could have been attacker controlled), the attacker could have executed arbitrary commands with elevated privileges. This insecure pattern has been documented as a security risk by GitHub and security researchers. Commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 removed the vulnerable code.
- Product
- QGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization.CVE-2025-9820 · Other software · Red Hat · reported by Red HatMedium 4
A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 26, 2026The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges.CVE-2025-59106 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
- Product
- Access Manager 92xx-k7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption.CVE-2025-59105 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database.
- Product
- Access Manager 92xx-k5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable).CVE-2025-59104 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.
- Product
- Access Manager 92xx-k7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 26, 2026Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in.CVE-2025-59101 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.7
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.
- Product
- Access Manager 92xx-k5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 23, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
- Product
- SmarterMail
- On CISA’s list since
- Feb 5, 2026 (federal fix deadline Feb 26, 2026)
- What to do
- Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcode-white.comsmartertools.com
Jan 23, 2026The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for heaCVE-2026-1299 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Electrician - Electrical Service: Server-Side Request Forgery (SSRF)CVE-2026-22358 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 5.6.
- Product
- Electrician - Electrical Service
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update Electrician - Electrical Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Sound | Musical Instruments Online Store: Deserialization of Untrusted DataCVE-2025-69079 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.
- Product
- Sound | Musical Instruments Online Store
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Sound | Musical Instruments Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.CVE-2026-22822 · Other software · external-secrets · reported by GitHubCritical 9.3
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.
- Product
- external-secrets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers CVE-2021-47846 · Other software · I Want Source Codes · reported by VulnCheckHigh 8.8
Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.
- Product
- Digital Crime Report Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantfilemanager.comiwantsourcecodes.com
Jan 21, 2026A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse poCVE-2026-1035 · Other software · Red Hat · reported by Red HatLow 3.1
A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 20, 2026IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM LiCVE-2025-12985 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.
- Product
- IBM Licensing Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots.CVE-2026-23875 · Other software · crawlchat · reported by GitHubMedium 5.7
CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the CrawlChat's Discord bot allows non-manage guild users to put malicious content onto the collection knowledge base. Usually, admin / mods of a Discord guild use the `jigsaw` emoji to save a specific message (chain) onto the collection's knowledge base of CrawlChat. Unfortunately an permission check (for e.g. MANAGE_SERVER; MANAGE_MESSAGES etc.) was not done, allowing normal users of the guild to information to the knowledge base. With targeting specific parts that are commonly asked, users can manipulate the content given out by the bot (on all integrations), to e.g. redirect users to a malicious site, or send information to a malicious user. Version 0.0.8 patches the issue.
- Product
- crawlchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026HCL AION version 2 is affected by a Technical Error Disclosure vulnerability.CVE-2025-55250 · Other software · HCL Software · reported by psirt@hcl.comLow 1.8
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks.
- Product
- AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 19, 2026A vulnerability was detected in technical-laohu mpay up to 1.2.4.CVE-2026-1153 · Other software · technical-laohu · reported by VulDBLow 2.1
A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- Product
- mpay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026A security vulnerability has been detected in technical-laohu mpay up to 1.2.4.CVE-2026-1152 · Other software · technical-laohu · reported by VulDBLow 2
A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Handler. Such manipulation of the argument codeimg leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- mpay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026A weakness has been identified in technical-laohu mpay up to 1.2.4.CVE-2026-1151 · Other software · technical-laohu · reported by VulDBLow 1.9
A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation of the argument Nickname causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- mpay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.CVE-2025-61873 · Other software · bestpractical · reported by MITRELow 2.6
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.com
Jan 15, 2026The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URICVE-2026-1002 · Other software · Eclipse Vert.x · reported by emo@eclipse.orgMedium 6.9
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web): https://github.com/eclipse-vertx/vert.x/pull/5895 Steps to reproduce Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html Mitgation Disabling Static Handler cache fixes the issue. StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allCVE-2025-59961 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.8
An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the resource. This vulnerability allows any low-privileged user logged into the system to connect to the Unix socket and issue commands to manage the DHCP service, in essence, taking administrative control of the local DHCP server or DHCP relay. This issue affects: Junos OS: * all versions before 21.2R3-S10, * all versions of 22.2, * from 21.4 before 21.4R3-S12, * from 22.4 before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S6, * from 24.2 before 24.2R2-S2, * from 24.4 before 24.4R2, * from 25.2 before 25.2R1-S1, 25.2R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * from 23.2 before 23.2R2-S5-EVO, * from 23.4 before 23.4R2-S6-EVO, * from 24.2 before 24.2R2-S2-EVO, * from 24.4 before 24.4R2-EVO, * from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netsupportportal.juniper.net
Jan 15, 2026An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leadinCVE-2026-22916 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify ControCVE-2025-14058 · Other software · Lenovo · reported by psirt@lenovo.comLow 2.4
A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.
- Product
- Tab M11 TB330FU TB330XU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.CVE-2025-13453 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.1
A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.
- Product
- ThinkPlus FU100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanCVE-2025-65396 · Other software · Blurams · reported by MITREMedium 6.1
A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during the boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.
- Product
- Dome Flare Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK72CVE-2025-67399 · Other software · Airth · reported by MITREMedium 4.6
An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-Fi and BLE module) on the device is open to access
- Product
- Smart Home AQI Monitor Bootloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026In the Linux kernel, the following vulnerability has been resolved: via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driverCVE-2025-71114 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses allocate_resource() to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a name, which causes the kernel resource tree to contain an entry marked as "<BAD>" under /proc/iomem on x86 platforms. During boot, this unnamed resource can lead to a critical hang because subsequent resource lookups and conflict checks fail to handle the invalid entry properly.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 13, 2026Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.CVE-2023-54333 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents.
- Product
- Social-Share-Buttons
- What to do
- Update Social-Share-Buttons to the newest version.
Full record and what to do →NVD recordgithub.comsupsystic.com
Jan 13, 2026e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path trCVE-2022-50939 · Other software · E107 · reported by VulnCheckHigh 8.6
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.
- Product
- e107 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.CVE-2026-20936 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.CVE-2026-20834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack.CVE-2026-20828 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-20803 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2022 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.CVE-2025-58409 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceLow 3.5
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical EtherneCVE-2026-0407 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 6.1
An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel.
- Product
- EX5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Jan 12, 2026Iris is a web collaborative platform that helps incident responders share technical details during investigations.CVE-2026-22783 · Other software · dfir-iris · reported by GitHubCritical 9.6
Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.CVE-2026-20974 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.2
Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jan 8, 2026An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical access to the UART pins CVE-2025-65731 · Other software · Dlink · reported by MITREMedium 6.8
An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical access to the UART pins to execute arbitrary commands due to presence of root terminal access on a serial interface without proper access control.
- Product
- Dir-605l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 8, 2026Asseco ADMX system is used for processing medical records.CVE-2025-4596 · Other software · Asseco · reported by cvd@cert.plMedium 5.3
Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 version of ADMX.
- Product
- AMDX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector.CVE-2025-8307 · Other software · Asseco · reported by cvd@cert.plMedium 5.9
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0
- Product
- InfoMedica Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector.CVE-2025-8306 · Other software · Asseco · reported by cvd@cert.plMedium 5.1
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control. Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0
- Product
- InfoMedica Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging.CVE-2026-21851 · Other software · Project-MONAI · reported by GitHubMedium 5.3
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability exists in MONAI's `_download_from_ngc_private()` function. The function uses `zipfile.ZipFile.extractall()` without path validation, while other similar download functions in the same codebase properly use the existing `safe_extract_member()` function. Commit 4014c8475626f20f158921ae0cf98ed259ae4d59 fixes this issue.
- Product
- MONAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network.CVE-2025-62224 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.