CVEs published January 1, 2026
35 CVEs were published on January 1, 2026: 2 critical, 6 high.
- Published
- 35
- Critical
- 2
- High
- 6
- Medium
- 26
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- signalk-server
- 6
- code-projects Online Guitar Store
- 4
- Apache Software Foundation Apache NuttX RTOS
- 2
- getsolus eopkg
- 2
- Open5GS
- 2
- WebAssembly wabt
- 2
- xnx3 wangmarket
- 2
- Apache Software Foundation Apache StreamPipes · org.apache.…
- 1
- campcodes School File Management System
- 1
- Comments
- 1
Critical 2
High 6
- CVE-2025-68619Signal K Server Vulnerable to Remote Code Execution via Malicious npm Packagesignalk-server
- CVE-2025-55065CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Kopek Reem ReKord client
- CVE-2025-68272Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Floodingsignalk-server
- CVE-2026-21428cpp-httplib has CRLF injection in http headersyhirose cpp-httplib
- CVE-2025-47411Apache StreamPipes: Leverage of User ID for Privilege EscalationApache Software Foundation Apache StreamPipes · org.apache.…
- CVE-2025-11157Arbitrary Code Execution in feast-dev/feastfeast-dev/feast · feast
Medium, low and unrated 27
- CVE-2025-15418Open5GS Bearer QoS IE Length types.c ogs_gtp2_parse_bearer_qos denial of serviceOpen5GS
- CVE-2025-15417Open5GS GTPv2-C F-TEID s11-handler.c sgwc_s11_handle_create_session_request denial of serviceOpen5GS
- CVE-2025-15416xnx3 wangmarket Add Global Variable save.do cross site scriptingxnx3 wangmarket
- CVE-2025-15415xnx3 wangmarket XML File uploadImage.do uploadImage unrestricted uploadxnx3 wangmarket
- CVE-2025-15414go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgerygo-sonic sonic
- CVE-2025-15413wasm3 m3_exec.h op_CallIndirect memory corruptionwasm3
- CVE-2025-15412WebAssembly wabt wasm-decompile VarName out-of-boundsWebAssembly wabt
- CVE-2025-15411WebAssembly wabt wasm-decompile InsertNode memory corruptionWebAssembly wabt
- CVE-2025-15410code-projects Online Guitar Store login.php sql injectioncode-projects Online Guitar Store
- CVE-2025-69203Signal K Server Vulnerable to Access Request Spoofingsignalk-server
- CVE-2025-15409code-projects Online Guitar Store Delete_product.php sql injectioncode-projects Online Guitar Store
- CVE-2025-68273Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpointssignalk-server
- CVE-2026-21437eopkg vulnerable to package file list integrity bypassgetsolus eopkg
- CVE-2026-21436eopkg has Path Traversal: '../filedir' vulnerabilitygetsolus eopkg
- CVE-2025-15408code-projects Online Guitar Store Create_product.php sql injectioncode-projects Online Guitar Store
- CVE-2025-15407code-projects Online Guitar Store Create_category.php sql injectioncode-projects Online Guitar Store
- CVE-2025-15406PHPGurukul Online Course Registration authorizationPHPGurukul Online Course Registration
- CVE-2025-14627WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypasssmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-14428My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletionpremio All-in-one Sticky Floating Contact Form, Call, Click…
- CVE-2025-48769Apache NuttX RTOS: fs/vfs/fs_rename: use after freeApache Software Foundation Apache NuttX RTOS
- CVE-2025-48768Apache NuttX RTOS: fs/inode: fs_inoderemove root inode removalApache Software Foundation Apache NuttX RTOS
- CVE-2025-66023NanoMQ has Use-After-Free of malformed bridging messagenanomq
- CVE-2025-15405PHPEMS cross-site request forgeryPHPEMS
- CVE-2025-15404campcodes School File Management System save_file.php unrestricted uploadcampcodes School File Management System
- CVE-2026-0544itsourcecode School Management System index.php sql injectionitsourcecode School Management System
- CVE-2025-13820Comments – wpDiscuz < 7.6.40 - Unauthenticated Account TakeoverComments
- CVE-2025-69413In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.Gitea · code.gitea.io/gitea