CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-01-06 (6)

2026-01-06 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-01-06

6 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2025-59157 — 9.9 — Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. …
  • CVE-2025-14996 — 9.8 — The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly valid…
  • CVE-2025-15001 — 9.8 — The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identit…
  • CVE-2025-64419 — 9.6 — Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If …
  • CVE-2025-27807 — 9.1 — An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. …
  • CVE-2025-68456 — 9.1 — Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially l…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.