| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-69344 | Med | 0.28 | 4.3 | 0.00 | Jan 7, 2026 | Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6. | ||
| CVE-2025-69333 | Med | 0.28 | 4.3 | 0.00 | Jan 7, 2026 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1. | ||
| CVE-2025-69082 | Hig | 0.46 | 7.1 | 0.00 | Jan 7, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3. | ||
| CVE-2025-69081 | Hig | 0.53 | 8.1 | 0.00 | Jan 7, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0. | ||
| CVE-2025-69080 | Hig | 0.53 | 8.1 | 0.00 | Jan 7, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8. | ||
| CVE-2025-68637 | Cri | 0.52 | 9.1 | 0.00 | Jan 7, 2026 | The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle… | ||
| CVE-2025-47396 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption occurs when a secure application is launched on a device with insufficient memory. | ||
| CVE-2025-47395 | Med | 0.42 | 6.5 | 0.00 | Jan 7, 2026 | Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. | ||
| CVE-2025-47394 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. | ||
| CVE-2025-47393 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption when accessing resources in kernel driver. | ||
| CVE-2025-47388 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while passing pages to DSP with an unaligned starting address. | ||
| CVE-2025-47380 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while preprocessing IOCTLs in sensors. | ||
| CVE-2025-47369 | Med | 0.36 | 5.5 | 0.00 | Jan 7, 2026 | Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. | ||
| CVE-2025-47356 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory Corruption when multiple threads concurrently access and modify shared resources. | ||
| CVE-2025-47348 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while processing identity credential operations in the trusted application. | ||
| CVE-2025-47346 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while processing a secure logging command in the trusted application. | ||
| CVE-2025-47345 | Hig | 0.55 | 8.4 | 0.00 | Jan 7, 2026 | Cryptographic issue may occur while encrypting license data. | ||
| CVE-2025-47344 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while handling sensor utility operations. | ||
| CVE-2025-47343 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while processing a video session to set video parameters. | ||
| CVE-2025-47339 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while deinitializing a HDCP session. | ||
| CVE-2025-47337 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while accessing a synchronization object during concurrent operations. | ||
| CVE-2025-47336 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while performing sensor register read operations. | ||
| CVE-2025-47335 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while parsing clock configuration data for a specific hardware type. | ||
| CVE-2025-47334 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while processing shared command buffer packet between camera userspace and kernel. | ||
| CVE-2025-47333 | Med | 0.43 | 6.6 | 0.00 | Jan 7, 2026 | Memory corruption while handling buffer mapping operations in the cryptographic driver. | ||
| CVE-2025-47332 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while processing a config call from userspace. | ||
| CVE-2025-47331 | Med | 0.40 | 6.1 | 0.00 | Jan 7, 2026 | Information disclosure while processing a firmware event. | ||
| CVE-2025-47330 | Med | 0.36 | 5.5 | 0.00 | Jan 7, 2026 | Transient DOS while parsing video packets received from the video firmware. | ||
| CVE-2025-32300 | Hig | 0.46 | 7.1 | 0.00 | Jan 7, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25. | ||
| CVE-2025-31964 | Low | 0.14 | 2.2 | 0.00 | Jan 7, 2026 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication… | ||
| CVE-2025-31963 | Low | 0.19 | 2.9 | 0.00 | Jan 7, 2026 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests. | ||
| CVE-2025-31962 | Low | 0.13 | 2.0 | 0.00 | Jan 7, 2026 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods. | ||
| CVE-2025-31643 | Hig | 0.57 | 8.8 | 0.00 | Jan 7, 2026 | Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0. | ||
| CVE-2025-15474 | Med | 0.34 | — | 0.00 | Jan 7, 2026 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts… | ||
| CVE-2025-15472 | Hig | 0.49 | 7.2 | 0.22 | Jan 7, 2026 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been… | ||
| CVE-2025-15158 | Hig | 0.57 | 8.8 | 0.01 | Jan 7, 2026 | The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Author-level access… | ||
| CVE-2025-15058 | Med | 0.42 | 6.4 | 0.00 | Jan 7, 2026 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… | ||
| CVE-2025-15018 | Cri | 0.64 | 9.8 | 0.00 | Jan 7, 2026 | The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect… | ||
| CVE-2025-15000 | Med | 0.29 | 4.4 | 0.00 | Jan 7, 2026 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | ||
| CVE-2025-14999 | Med | 0.28 | 4.3 | 0.00 | Jan 7, 2026 | The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings update handler in admin-page.php. This makes it possible for unauthenticated attackers… | ||
| CVE-2025-14904 | Med | 0.28 | 4.3 | 0.00 | Jan 7, 2026 | The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated attackers to update… | ||
| CVE-2025-14901 | Med | 0.42 | 6.5 | 0.00 | Jan 7, 2026 | The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the… | ||
| CVE-2025-14891 | Med | 0.35 | 6.4 | 0.00 | Jan 7, 2026 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2025-14888 | Med | 0.29 | 4.4 | 0.00 | Jan 7, 2026 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,… | ||
| CVE-2025-14887 | Med | 0.29 | 4.4 | 0.00 | Jan 7, 2026 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible… | ||
| CVE-2025-14875 | Med | 0.33 | 6.1 | 0.00 | Jan 7, 2026 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2025-14867 | Med | 0.42 | 6.5 | 0.00 | Jan 7, 2026 | The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to read the contents… | ||
| CVE-2025-14845 | Med | 0.28 | 4.3 | 0.00 | Jan 7, 2026 | The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers… | ||
| CVE-2025-14842 | Med | 0.40 | 6.1 | 0.00 | Jan 7, 2026 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for… | ||
| CVE-2025-14835 | Hig | 0.46 | 7.1 | 0.00 | Jan 7, 2026 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.
- risk 0.53cvss 8.1epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.
- risk 0.53cvss 8.1epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.
- risk 0.52cvss 9.1epss 0.00
The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle…
- risk 0.51cvss 7.8epss 0.00
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
- risk 0.42cvss 6.5epss 0.00
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when accessing resources in kernel driver.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while passing pages to DSP with an unaligned starting address.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while preprocessing IOCTLs in sensors.
- risk 0.36cvss 5.5epss 0.00
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption when multiple threads concurrently access and modify shared resources.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing identity credential operations in the trusted application.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing a secure logging command in the trusted application.
- risk 0.55cvss 8.4epss 0.00
Cryptographic issue may occur while encrypting license data.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while handling sensor utility operations.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing a video session to set video parameters.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while deinitializing a HDCP session.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while accessing a synchronization object during concurrent operations.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while performing sensor register read operations.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while parsing clock configuration data for a specific hardware type.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing shared command buffer packet between camera userspace and kernel.
- risk 0.43cvss 6.6epss 0.00
Memory corruption while handling buffer mapping operations in the cryptographic driver.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing a config call from userspace.
- risk 0.40cvss 6.1epss 0.00
Information disclosure while processing a firmware event.
- risk 0.36cvss 5.5epss 0.00
Transient DOS while parsing video packets received from the video firmware.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25.
- risk 0.14cvss 2.2epss 0.00
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication…
- risk 0.19cvss 2.9epss 0.00
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
- risk 0.13cvss 2.0epss 0.00
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
- risk 0.57cvss 8.8epss 0.00
Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0.
- risk 0.34cvss —epss 0.00
AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts…
- risk 0.49cvss 7.2epss 0.22
A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been…
- risk 0.57cvss 8.8epss 0.01
The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Author-level access…
- risk 0.42cvss 6.4epss 0.00
The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
- risk 0.64cvss 9.8epss 0.00
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect…
- risk 0.29cvss 4.4epss 0.00
The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
- risk 0.28cvss 4.3epss 0.00
The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings update handler in admin-page.php. This makes it possible for unauthenticated attackers…
- risk 0.28cvss 4.3epss 0.00
The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated attackers to update…
- risk 0.42cvss 6.5epss 0.00
The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the…
- risk 0.35cvss 6.4epss 0.00
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.29cvss 4.4epss 0.00
The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
- risk 0.29cvss 4.4epss 0.00
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible…
- risk 0.33cvss 6.1epss 0.00
The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.42cvss 6.5epss 0.00
The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to read the contents…
- risk 0.28cvss 4.3epss 0.00
The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers…
- risk 0.40cvss 6.1epss 0.00
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for…
- risk 0.46cvss 7.1epss 0.00
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…