# CVEs published 2026-01-01

35 CVEs were published on January 1, 2026: 2 critical, 6 high. Days are UTC.

- [CVE-2025-15418](https://cve.now/CVE-2025-15418.md): Open5GS Bearer QoS IE Length types.c ogs\_gtp2\_parse\_bearer\_qos denial of service (CVSS 4.8, Open5GS)
- [CVE-2025-15417](https://cve.now/CVE-2025-15417.md): Open5GS GTPv2-C F-TEID s11-handler.c sgwc\_s11\_handle\_create\_session\_request denial of service (CVSS 4.8, Open5GS)
- [CVE-2025-15416](https://cve.now/CVE-2025-15416.md): xnx3 wangmarket Add Global Variable save.do cross site scripting (CVSS 4.8, xnx3 wangmarket)
- [CVE-2025-15415](https://cve.now/CVE-2025-15415.md): xnx3 wangmarket XML File uploadImage.do uploadImage unrestricted upload (CVSS 5.1, xnx3 wangmarket)
- [CVE-2025-15414](https://cve.now/CVE-2025-15414.md): go-sonic Theme Fetching API git\_fetcher.go FetchTheme server-side request forgery (CVSS 5.1, go-sonic sonic)
- [CVE-2025-15413](https://cve.now/CVE-2025-15413.md): wasm3 m3\_exec.h op\_CallIndirect memory corruption (CVSS 4.8, wasm3)
- [CVE-2025-15412](https://cve.now/CVE-2025-15412.md): WebAssembly wabt wasm-decompile VarName out-of-bounds (CVSS 4.8, WebAssembly wabt)
- [CVE-2025-15411](https://cve.now/CVE-2025-15411.md): WebAssembly wabt wasm-decompile InsertNode memory corruption (CVSS 4.8, WebAssembly wabt)
- [CVE-2025-15410](https://cve.now/CVE-2025-15410.md): code-projects Online Guitar Store login.php sql injection (CVSS 6.9, code-projects Online Guitar Store)
- [CVE-2025-69203](https://cve.now/CVE-2025-69203.md): Signal K Server Vulnerable to Access Request Spoofing (CVSS 6.3, signalk-server)
- [CVE-2025-68619](https://cve.now/CVE-2025-68619.md): Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package (CVSS 7.3, signalk-server)
- [CVE-2025-15409](https://cve.now/CVE-2025-15409.md): code-projects Online Guitar Store Delete\_product.php sql injection (CVSS 6.9, code-projects Online Guitar Store)
- [CVE-2025-55065](https://cve.now/CVE-2025-55065.md): CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 7.5, Kopek Reem ReKord client)
- [CVE-2025-68620](https://cve.now/CVE-2025-68620.md): Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling (CVSS 9.1, signalk-server)
- [CVE-2025-68273](https://cve.now/CVE-2025-68273.md): Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints (CVSS 5.3, signalk-server)
- [CVE-2025-68272](https://cve.now/CVE-2025-68272.md): Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding (CVSS 7.5, signalk-server)
- [CVE-2026-21437](https://cve.now/CVE-2026-21437.md): eopkg vulnerable to package file list integrity bypass (CVSS 2.0, getsolus eopkg)
- [CVE-2026-21436](https://cve.now/CVE-2026-21436.md): eopkg has Path Traversal: '../filedir' vulnerability (CVSS 5.8, getsolus eopkg)
- [CVE-2025-15408](https://cve.now/CVE-2025-15408.md): code-projects Online Guitar Store Create\_product.php sql injection (CVSS 6.9, code-projects Online Guitar Store)
- [CVE-2025-66398](https://cve.now/CVE-2025-66398.md): Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) (CVSS 9.7, signalk-server)
- [CVE-2026-21428](https://cve.now/CVE-2026-21428.md): cpp-httplib has CRLF injection in http headers (CVSS 7.7, yhirose cpp-httplib)
- [CVE-2025-15407](https://cve.now/CVE-2025-15407.md): code-projects Online Guitar Store Create\_category.php sql injection (CVSS 6.9, code-projects Online Guitar Store)
- [CVE-2025-15406](https://cve.now/CVE-2025-15406.md): PHPGurukul Online Course Registration authorization (CVSS 5.3, PHPGurukul Online Course Registration)
- [CVE-2025-47411](https://cve.now/CVE-2025-47411.md): Apache StreamPipes: Leverage of User ID for Privilege Escalation (CVSS 8.1, Apache Software Foundation Apache StreamPipes · org.apache.…)
- [CVE-2025-14627](https://cve.now/CVE-2025-14627.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass (CVSS 6.4, smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…)
- [CVE-2025-14428](https://cve.now/CVE-2025-14428.md): My Sticky Elements \<= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion (CVSS 4.3, premio All-in-one Sticky Floating Contact Form, Call, Click…)
- [CVE-2025-48769](https://cve.now/CVE-2025-48769.md): Apache NuttX RTOS: fs/vfs/fs\_rename: use after free (CVSS 5.3, Apache Software Foundation Apache NuttX RTOS)
- [CVE-2025-48768](https://cve.now/CVE-2025-48768.md): Apache NuttX RTOS: fs/inode: fs\_inoderemove root inode removal (CVSS 5.3, Apache Software Foundation Apache NuttX RTOS)
- [CVE-2025-66023](https://cve.now/CVE-2025-66023.md): NanoMQ has Use-After-Free of malformed bridging message (CVSS 6.9, nanomq)
- [CVE-2025-15405](https://cve.now/CVE-2025-15405.md): PHPEMS cross-site request forgery (CVSS 5.3, PHPEMS)
- [CVE-2025-15404](https://cve.now/CVE-2025-15404.md): campcodes School File Management System save\_file.php unrestricted upload (CVSS 5.3, campcodes School File Management System)
- [CVE-2026-0544](https://cve.now/CVE-2026-0544.md): itsourcecode School Management System index.php sql injection (CVSS 6.9, itsourcecode School Management System)
- [CVE-2025-11157](https://cve.now/CVE-2025-11157.md): Arbitrary Code Execution in feast-dev/feast (CVSS 7.8, feast-dev/feast · feast)
- [CVE-2025-13820](https://cve.now/CVE-2025-13820.md): Comments – wpDiscuz \< 7.6.40 - Unauthenticated Account Takeover (CVSS 5.3, Comments)
- [CVE-2025-69413](https://cve.now/CVE-2025-69413.md): In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. (CVSS 5.3, Gitea · code.gitea.io/gitea)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.