{
"Source": "CVE FEED",
"Title": "CVE-2025-68890 - WordPress e-shops plugin <= 1.0.4 - reflected cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68890
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68892 - WordPress Scroll rss excerpt plugin <= 5.0 - reflected cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68892
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerpt allows Reflected XSS.This issue affects Scroll rss excerpt: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-69169 - WordPress Easy Media Download plugin <= 1.1.11 - css injection vulnerability",
"Content": "CVE ID : CVE-2025-69169
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflection Injection.This issue affects Easy Media Download: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-0674 - WordPress Campaign Monitor for WordPress plugin <= 2.9.0 - broken access control vulnerability",
"Content": "CVE ID : CVE-2026-0674
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress forms-for-campaign-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Campaign Monitor for WordPress: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68889 - WordPress Pinpoll plugin <= 4.0.0 - cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68889
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects Pinpoll: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68891 - WordPress WP App Bar plugin <= 1.5 - reflected cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68891
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.This issue affects WP App Bar: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68867 - WordPress Effect Maker plugin <= 1.2.1 - cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68867
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68873 - WordPress PRIMER by chloédigital plugin <= 1.0.25 - reflected cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68873
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chloédigital PRIMER by chloédigital primer-by-chloedigital allows Reflected XSS.This issue affects PRIMER by chloédigital: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68874 - WordPress Visitor Stats Widget plugin <= 1.5.0 - reflected cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68874
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This issue affects Visitor Stats Widget: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68875 - WordPress Flaming Password Reset plugin <= 1.0.3 - cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68875
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset allows Stored XSS.This issue affects Flaming Password Reset: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-68887 - WordPress WP-BusinessDirectory plugin <= 3.1.5 - cross site scripting (xss) vulnerability",
"Content": "CVE ID : CVE-2025-68887
Published : Jan. 8, 2026, 10:15 a.m. | 29 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through <=
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-62877 - Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer",
"Content": "CVE ID : CVE-2025-62877
Published : Jan. 8, 2026, 12:29 p.m. | 17 minutes ago
Description : Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password  if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-22032 - Directus has open redirect in SAML",
"Content": "CVE ID : CVE-2026-22032
Published : Jan. 8, 2026, 2:32 p.m. | 19 minutes ago
Description : Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-66002 - Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation",
"Content": "CVE ID : CVE-2025-66002
Published : Jan. 8, 2026, 2:25 p.m. | 26 minutes ago
Description : An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-22028 - Preact has JSON VNode Injection issue",
"Content": "CVE ID : CVE-2026-22028
Published : Jan. 8, 2026, 2:16 p.m. | 35 minutes ago
Description : Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed to be strings and passed unmodified to Preact as children, a specially-crafted JSON payload could be constructed that would be incorrectly treated as a valid VNode. When this chain of failures occurs it can result in HTML injection, which can allow arbitrary script execution if not mitigated by CSP or other means. Applications using affected Preact versions are vulnerable if they meet all of the following conditions: first, pass unmodified, unsanitized values from user-modifiable data sources (APIs, databases, local storage, etc.) directly into the render tree; second assume these values are strings but the data source could return actual JavaScript objects instead of JSON strings; and third, the data source either fails to perform type sanitization AND blindly stores/returns raw objects interchangeably with strings, OR is compromised (e.g., poisoned local storage, filesystem, or database). Versions 10.26.10, 10.27.3, and 10.28.2 patch the issue. The patch versions restore the previous strict equality checks that prevent JSON-parsed objects from being treated as valid VNodes. Other mitigations are available for those who cannot immediately upgrade. Validate input types, cast or validate network data, sanitize external data, and use Content Security Policy (CSP).
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-21876 - OWASP CRS has multipart bypass using multiple content-type parts",
"Content": "CVE ID : CVE-2026-21876
Published : Jan. 8, 2026, 2:15 p.m. | 36 minutes ago
Description : The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-21885 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources",
"Content": "CVE ID : CVE-2026-21885
Published : Jan. 8, 2026, 2:15 p.m. | 36 minutes ago
Description : Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-21891 - ZimaOS has Authentication Bypass via System-Level Username",
"Content": "CVE ID : CVE-2026-21891
Published : Jan. 8, 2026, 2:15 p.m. | 36 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-21892 - Parsl Monitoring Visualization Vulnerable to SQL Injection",
"Content": "CVE ID : CVE-2026-21892
Published : Jan. 8, 2026, 2:15 p.m. | 36 minutes ago
Description : Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-21895 - rsa crate has potential panic on a prime being equal to 1",
"Content": "CVE ID : CVE-2026-21895
Published : Jan. 8, 2026, 2:15 p.m. | 36 minutes ago
Description : The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-14025 - Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions",
"Content": "CVE ID : CVE-2025-14025
Published : Jan. 8, 2026, 2:15 p.m. | 36 minutes ago
Description : A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "08 Jan 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹