Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.21. CVSSv3.1 9.3 (CRITICAL)
Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through <= 2.1.0. CVSSv3.1 10.0 (CRITICAL)
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6. CVSSv3.1 8.2 (HIGH) · EPSS 14th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2. CVSSv3.1 9.3 (CRITICAL)
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.1.8. CVSSv3.1 9.1 (CRITICAL)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Depot depot allows PHP Local File Inclusion.This issue affects Depot: from n/a through <= 1.16. CVSSv3.1 8.1 (HIGH)
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1. CVSSv3.1 8.8 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Amuli amuli allows PHP Local File Inclusion.This issue affects Amuli: from n/a through <= 2.3.0. CVSSv3.1 8.1 (HIGH)
Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: from n/a through <= 1.1.2. CVSSv3.1 10.0 (CRITICAL)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Athens athens allows PHP Local File Inclusion.This issue affects Athens: from n/a through <= 1.1.6. CVSSv3.1 8.1 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5. CVSSv3.1 9.3 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5. CVSSv3.1 8.5 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39. CVSSv3.1 8.5 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ninetheme Anarkali anarkali allows PHP Local File Inclusion.This issue affects Anarkali: from n/a through <= 1.0.9. CVSSv3.1 8.1 (HIGH)
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. T CVSSv3.1 8.1 (HIGH)
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. N CVSSv3.1 9.8 (CRITICAL)
Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025. CVSSv3.1 8.1 (HIGH) · EPSS 5th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection. This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.0 (HIGH) · EPSS 7th percentile
Pwn2Own Automotive 2026 Day Two concluded with 29 unique 0-day vulnerabilities disclosed across automotive infotainment systems, EV chargers, and embedded platforms, awarding $439,250 USD. Cumulative event totals reached $955,750 USD across 66 unique 0-days, with command injection, buffer overflows, and authentication bypasses dominating the attack surface. Fuzzware.io maintains the Master of Pwn lead heading into the final competition day.
watchTowr Labs disclosed WT-2026-0001, a critical authentication bypass in SmarterTools SmarterMail allowing unauthenticated attackers to reset the system administrator password via the /api/v1/auth/force-reset-password endpoint. The vulnerability chains directly to RCE through built-in admin functionality for executing OS commands via volume mount configuration. The vulnerability was patched in version 9511 (January 15, 2026), but is already being actively exploited in the wild within days of patch release, indicating attackers performed patch diffing to reconstruct the vulnerability.
EmEditor's official download page was compromised in late December 2025 to distribute trojanized installers delivering multistage PowerShell-based malware. The malware disables ETW logging, steals credentials from Windows Credential Manager, performs system fingerprinting, and exfiltrates data to a C&C server; geofencing patterns suggest Russian or CIS-origin threat actors. Active exploitation has already occurred with multiple confirmed infections prior to vendor disclosure.
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed i CVSSv3.1 8.8 (HIGH)
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM CVSSv3.1 8.8 (HIGH)
Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_2 CVSSv3.1 8.8 (HIGH)
SpecterOps researcher Garrett Foster disclosed critical vulnerabilities in Microsoft Deployment Toolkit (MDT) that enable unauthenticated credential theft and lateral movement. Rather than patch the issues, Microsoft chose to retire MDT entirely as of January 6, 2026, leaving enterprises with unpatched systems. The attack chain combines unauthenticated WDS/PXE discovery, XXE injection in the MDT monitoring service, and authentication coercion to extract privileged service account credentials.