CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- totolink lr350, lr350 firmware +1 moreTotolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflow8.7 High
- janobe e-learning systemSourceCodester E-Learning System Lesson index.php cross site scripting5.3 Medium
- technical-laohu mpaytechnical-laohu mpay cross-site request forgery5.3 Medium
- altium 365Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access9.0 Critical
scalycrates.ioscaly: Multiple soundness issues in Rust safe APIs8.7 High- technical-laohu mpaytechnical-laohu mpay QR Code Image unrestricted upload5.1 Medium
- technical-laohu mpaytechnical-laohu mpay User Center cross site scripting4.8 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection5.3 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection5.3 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery5.3 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scripting5.1 Medium
- apache linkisApache Linkis: Password Exposure6.5 Medium
- apache linkisApache Linkis: Arbitrary File Read via Double URL Encoding Bypass7.5 High
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scripting5.1 Medium
- quickjs-ng quickjsquickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow5.3 Medium
- quickjs-ng quickjsquickjs-ng quickjs Atomics Ops quickjs.c use after free5.3 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflow8.7 High
- phpgurukul news portalPHPGurukul News Portal cross-site request forgery5.3 Medium
- phpgurukul news portalPHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization5.3 Medium
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W ConfigExceptAli strcpy buffer overflow8.7 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W ConfigExceptMSN strcpy buffer overflow8.7 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W ConfigExceptQQ strcpy buffer overflow8.7 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formWebAuthGlobalConfig strcpy buffer overflow8.7 High
- lcg0124 bootdolcg0124 BootDo ContentController save cross site scripting5.1 Medium
- angeljudesuarez society management systemitsourcecode Society Management System activity.php cross site scripting5.3 Medium
- jv harfbuzz::shaper, harfbuzz\ +1 moreHarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability7.5 High
- angeljudesuarez society management systemitsourcecode Society Management System expenses.php cross site scripting5.3 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter folder.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter edit_folder.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter save_catalog.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter worksadd_plan.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter worksadd.jsp sql injection6.9 Medium
- openstack keystonemiddleware, red hat openshift container platform 4.17, openshift container platform 4.18 +7 more +9 moreAn issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and...9.9 Critical
- open5gsOpen5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of service6.9 Medium
- axllent mailpitMailpit has SMTP Header Injection via Regex Bypass5.3 Medium
- assimpOpen Asset Import Library Assimp LWOMaterial.cpp FindUVChannels use after free4.8 Medium
- lobehub lobe-chatLobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)6.4 Medium
- esm esm.shesm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages7.7 High
- kimaiKimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)6.8 Medium
- 1panel-dev 1panel1panel App Store vulnerable to Cross-site Scripting6.4 Medium
- lwj flowlwj flow SVG File FormResource.java uploadFile unrestricted upload5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_wifidog_settings sub_412E7C command injection6.9 Medium
- n8nSandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.8.5 High
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_report.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_mod.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_info.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter del_workplan.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter del_work.jsp sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System delete_activity.php sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System add_activity.php sql injection5.3 Medium
- Show moreLoading…