2026-01-24

CVE-2026-24399 Jan 24, 01:15 CRITICAL POC PATCH Act Now

Stored XSS in ChatterMate AI chatbot framework versions 1.0.8 and below. The chatbot accepts and renders malicious HTML/JavaScript from user input. PoC and patch available.

CVE-2025-13374 Jan 24, 08:16 CRITICAL Act Now

Arbitrary file upload in Kalrav AI Agent WordPress plugin due to missing file type validation in the kalrav_upload_file AJAX action.

CVE-2026-22583 Jan 24, 01:15 CRITICAL Act Now

Argument injection in Salesforce Marketing Cloud Engagement CloudPagesURL component. Second Salesforce Marketing Cloud CVE with same root cause.

CVE-2026-22582 Jan 24, 01:15 CRITICAL Act Now

Argument injection in Salesforce Marketing Cloud Engagement MicrositeURL component allows command execution. First of four critical Salesforce Marketing Cloud CVEs.

CVE-2025-13952 Jan 24, 03:16 CRITICAL Act Now

Write-after-free crash in GPU compiler process triggered by unusual GPU shader code loaded from the web. Browser vulnerability through WebGPU shader compilation.

CVE-2026-22586 Jan 24, 01:15 CRITICAL Act Now

Hardcoded cryptographic key in Salesforce Marketing Cloud Engagement used across CloudPages, Forward to a Friend, Profile Center, and Subscription Center. Fourth critical Salesforce CVE.

CVE-2026-22585 Jan 24, 01:15 CRITICAL Act Now

Use of broken/risky cryptographic algorithm in Salesforce Marketing Cloud Engagement affecting CloudPages, Forward to a Friend, Profile Center, and Subscription Center components.