CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- mineadminMineAdmin JWT Token refresh data authenticity2.3 Low
- No product listedThe WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.1-jira9, 4.24.1...6.1 Medium
- abacre retail point of saleAbacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS)...6.1 Medium
- abacre retail point of saleAbacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The...6.5 Medium
- pithikos websocket serverAn input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to...7.5 High
- hotwired turboTurbo Frame responses can restore stale session cookies4.8 Medium
- trustwallet trust wallet coreA buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit...7.5 High
- opensagres xdocreportXDocReport affected by an XML External Entity (XXE) vulnerability9.8 Critical
- opensagres xdocreportXDocReport affected by a Server-Side Template Injection (SSTI) vulnerability9.8 Critical
- owntone serverA NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of...7.5 High
- owntone serverA NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit...7.5 High
- owntone serverNULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in...7.5 High
- owntone serverNULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server...7.5 High
- justdoit0910 tinymqttIn tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), a memory leak occurs...7.5 High
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...9.8 Critical
- iptime a1004 firmware, a1004ns firmware, a1004v firmware +160 more +162 moreipTIME routers A2003NS-MU 10.00.6 to 12.16.2 , N600 10.00.8 to 12.16.2, A604-V3 10.01.6 to 10.07...9.8 Critical
- mineadminMineAdmin Swagger information disclosure6.9 Medium
- wp chill image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management5.4 Medium
- chainlitChainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element8.3 High
- chainlitChainlit < 2.9.4 Arbitrary File Read via /project/element7.1 High
- mineadminMineAdmin View view improper authorization5.3 Medium
- tosei online store management system ネット店舗管理システム, tosei-corporation online store management system +1 moreTosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection6.9 Medium
gnutlsTuxCare,gnutls-c++TuxCare,gnutls-daneTuxCare +2 more +4 moreUpdate of gnutlsNo score- yonyou ksoaYonyou KSOA HTTP GET Parameter user_popedom.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter select.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter save_folder.jsp sql injection6.9 Medium
- arcaneArcane allows unauthenticated proxy access to remote environments8.0 High
- alchemy-cms alchemy cmsAlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper6.4 Medium
- itsourcecode school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- swift-otel swift-w3c-trace-contextSwift W3C TraceContext has malformed HTTP header that can cause a crash5.3 Medium
- hackucf onboardliteOnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over7.3 High
- swingmx swing music, swingmusic +1 moreDirectory Traversal & Filesystem can be accessed by a non-admin user5.3 Medium
- crawlchatCrawlChat's Discord Bot has a Knowledge Permission vulnerability5.7 Medium
- whisper.money whisper money, whisper-money +1 moreWhisper Money has IDOR Vulnerability on sync/balances endpoint4.9 Medium
- filebrowserFile Browser vulnerable to Username Enumeration via Timing Attack in /api/login5.3 Medium
- franklioxygen mytubeMyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing6.5 Medium
- birkir primebirkir prime GraphQL Directive graphql information exposure6.9 Medium
- franklioxygen mytubeMyTube has an Authorization Bypass vulnerability9.8 Critical
- birkir primebirkir prime GraphQL Alias graphql resource consumption6.9 Medium
- b3log siyuanSiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute5.8 Medium
- b3log siyuanSiYuan Vulnerable to Arbitrary File Read via File Copy Functionality8.3 High
- b3log siyuanSiYuan vulnerable to arbitrary file read7.8 High
- b3log siyuanSiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon2.1 Low
rust1.91openSUSE,rust1.92openSUSE +1 moreSecurity update for rust1.91, rust1.92No score- quenary tugtainerTugtainer vulnerable to Password Exposure via URL Query Parameter8.1 High
- birkir primebirkir prime GraphQL Array Based Query Batch graphql denial of service6.9 Medium
- pterodactyl wingsEndless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered8.3 High
- convoypanel panel, pterodactyl wings +1 morePterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances8.3 High
- convoypanel panelPterodactyl's improper resource locking allows raced queries to create more resources than alloted6.0 Medium
- birkir primebirkir prime GraphQL Directive graphql denial of service6.9 Medium
- Show moreLoading…