Skip to content
OpenAdvisories

Archive

14 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /14 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.2
    CVE-2026-23498 Public exploit

    Shopware Improper Control of Generation of Code in Twig rendered views

    Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

    shopware shopware shopware/core shopware/shopware Packagist
  • Critical 10.0
    CVE-2026-23550 Public exploit Scanner template EPSS 21%

    WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.

    Modular DS Modular DS
  • Critical 9.8
    CVE-2025-14502 Public exploit

    News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion

    The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files…

    vaghasia3 News and Blog Designer Bundle Web / CMS
  • Medium 6.1
    CVE-2026-0594 Public exploit Scanner template

    List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha

    The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti…

    mallsop List Site Contributors Web / CMS
  • Medium 4.6
    CVE-2025-67399 Public exploit

    An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive …