Skip to content
OpenAdvisories

Archive

6 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /6 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-15471 EPSS 14%

    TRENDnet TEW-713RE formFSrvX os command injection

    A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results in os command injection. It is possible to launch the attack remotely. The expl…

    Trendnet TEW-713RE
  • Critical 9.9
    CVE-2025-30996

    Arbitrary File Upload Vulnerability in WordPress themes by Themify

    Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows …

    Themify Themify Folo Themify Edmin Photobox Web / CMS
  • Critical 9.4
    CVE-2025-14942

    Authentication Bypass

    wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21…

    wolfSSL wolfSSH
  • Critical 9.8
    CVE-2025-39477

    WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through 3.5.8.

    sfwebservice InWave Jobs
  • Critical 9.8
    CVE-2020-36925

    Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass

    Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions …

    Arteco-Global Arteco Web Client DVR/NVR
  • Critical 9.8
    CVE-2020-36923

    Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR

    Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access res…

    Sony Electronics Sony BRAVIA Digital Signage
  • Critical 9.8
    CVE-2020-36912

    Plexus anblick Digital Signage Management 3.1.13 Open Redirect via Pagina Parameter

    Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'pagina' GET parameter. Attackers can craft malicious links that redirect users to arbitrary website…

    Plexus Plexus anblick Digital Signage Management
  • Critical 9.8
    CVE-2025-15001 Public exploit

    FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover

    The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. Thi…

    fsylum FS Registration Password Web / CMS
  • Critical 9.8
    CVE-2025-14996

    AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover

    The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updati…

    Akshar Soft Solutions AS Password Field In Default Registration Form Web / CMS
  • Critical 9.8
    CVE-2026-21675

    iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion

    iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

    InternationalColorConsortium iccDEV
  • Critical 9.8
    CVE-2025-15385

    Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authenticatio…

    TECNO Mobile com.afmobi.boomplayer
  • Critical 9.8
    CVE-2025-15444

    Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

    Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org…

    IAMB Crypt::Sodium::XS libsodium Azure Linux
  • Critical 9.8
    CVE-2025-60262

    An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a m…

  • Critical 9.8
    CVE-2025-60534

    Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selecti…

  • Critical 9.8
    CVE-2025-65212

    An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the de…