CVEs published January 2, 2026
103 CVEs were published on January 2, 2026: 7 critical, 27 high.
- Published
- 103
- Critical
- 7
- High
- 27
- Medium
- 46
- Low
- 23
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- QNAP Systems QTS · QNAP Systems QuTS hero
- 22
- Yonyou KSOA
- 7
- bagisto · bagisto/bagisto
- 6
- emlog
- 5
- code-projects Content Management System
- 4
- Nuvation Energy Multi-Stack Controller
- 4
- UTT 进取
- 4
- code-projects Online Music Site
- 3
- QNAP Systems QTS
- 3
- EmpireSoft EmpireCMS
- 2
Critical 7
- CVE-2025-64121Nuvation Energy Multi-Stack Controller Authentication BypassNuvation Energy Multi-Stack Controller
- CVE-2025-64120Nuvation Energy Multi-Stack Controller OS Command InjectionNuvation Energy Multi-Stack Controller
- CVE-2025-64119Nuvation Energy BMS Client-side AuthenticationNuvation Energy Battery Management System
- CVE-2026-21440AdonisJS Path Traversal in Multipart File Handlingadonisjs core · @adonisjs/bodyparser
- CVE-2025-14998Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeoverwpmudev Branda – White Label & Branding, Free Login Page Cu…
- CVE-2025-65125SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information.
- CVE-2025-67268gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file.
High 27
- CVE-2025-64123Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS accessNuvation Energy Multi-Stack Controller
- CVE-2025-64122Nuvation Energy Multi-Stack Controller Private Key Stored on DeviceNuvation Energy Multi-Stack Controller
- CVE-2026-21452MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocationmsgpack-java · org.msgpack:msgpack-core
- CVE-2026-21450Bagisto has SSTI in parameter that can lead to RCEbagisto · bagisto/bagisto
- CVE-2026-21449Bagisto has SSTI via first and last name from low-privilege user (not admin)bagisto · bagisto/bagisto
- CVE-2026-21448Bagisto has Normal & Blind SSTI from low-privilege user when ordering productbagisto · bagisto/bagisto
- CVE-2026-21447Bagisto has IDOR in Customer Order Reorder Functionalitybagisto · bagisto/bagisto
- CVE-2026-21446Bagisto Missing Authentication on Installer API Endpointsbagisto · bagisto/bagisto
- CVE-2026-21445Langflow Missing Authentication on Critical API Endpointslangflow-ai langflow · langflow-base +1
- CVE-2026-21433Emlog vulnerable to Server-Side Request Forgery (SSRF)emlog
- CVE-2026-21430Emlog: CSRF chained with stored XSS leads to ATOemlog
- CVE-2025-69415In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether Plex Media Server
- CVE-2025-69414Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient accessPlex Media Server
- CVE-2025-59389Hyper Data ProtectorQNAP Systems Hyper Data Protector
- CVE-2025-62842HBS 3 Hybrid Backup SyncQNAP Systems HBS 3 Hybrid Backup Sync
- CVE-2025-62840HBS 3 Hybrid Backup SyncQNAP Systems HBS 3 Hybrid Backup Sync
- CVE-2025-11837Malware RemoverQNAP Systems Malware Remover
- CVE-2025-59387MARS (Multi-Application Recovery Service)QNAP Systems MARS
- CVE-2025-59384QfilingQNAP Systems Qfiling
- CVE-2025-15431UTT 进取 512W formFtpServerDirConfig strcpy buffer overflowUTT 进取
- CVE-2025-15430UTT 进取 512W formFtpServerShareDirSelcet strcpy buffer overflowUTT 进取
- CVE-2025-15429UTT 进取 512W formConfigCliForEngineerOnly strcpy buffer overflowUTT 进取
- CVE-2025-15428UTT 进取 512W formRemoteControl strcpy buffer overflowUTT 进取
- CVE-2025-67158An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitiv
- CVE-2025-67159Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.
- CVE-2025-67160An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.
- CVE-2025-67269An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b0
Medium, low and unrated 69
- CVE-2026-21483listmonk Vulnerable to Stored XSS Leading to Admin Account Takeoverknadh listmonk · github.com/knadh/listmonk
- CVE-2026-21451Bagisto has HTML Filter Bypass that Enables Stored XSSbagisto · bagisto/bagisto
- CVE-2026-0571yeqifu warehouse AppFileUtils.java createResponseEntity path traversalyeqifu warehouse
- CVE-2026-21444libtpms returns wrong initialization vector when certain symmetric ciphers are usedstefanberger libtpms
- CVE-2026-0570code-projects Online Music Site Feedback.php sql injectioncode-projects Online Music Site
- CVE-2026-21432Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATOemlog
- CVE-2026-21431Emlog vulnerable to stored Cross-site Scripting via image nameemlog
- CVE-2026-0569code-projects Online Music Site AlbumByCategory.php sql injectioncode-projects Online Music Site
- CVE-2026-0568code-projects Online Music Site ViewSongs.php sql injectioncode-projects Online Music Site
- CVE-2026-0567code-projects Content Management System pages.php sql injectioncode-projects Content Management System
- CVE-2026-21429Emlog has Broken Access Control (BAC)emlog
- CVE-2025-15439Daptin Aggregate API resource_aggregate.go goqu.L sql injectionDaptin
- CVE-2025-69417In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrplex.tv backend
- CVE-2025-69416In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrplex.tv backend
- CVE-2026-0566code-projects Content Management System edit_posts.php unrestricted uploadcode-projects Content Management System
- CVE-2025-69284In plane.io, a Guest User to a Workspace can still be able to see list of membersmakeplane plane
- CVE-2025-62852QTS, QuTS heroQNAP Systems QTS
- CVE-2025-59381QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-59380QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53597License CenterQNAP Systems License Center
- CVE-2025-53594Qfinder Pro, Qsync, QVPNQNAP Systems Qfinder Pro Mac · QNAP Systems Qsync for Mac +1
- CVE-2025-52871License CenterQNAP Systems License Center
- CVE-2025-48721QTS, QuTS heroQNAP Systems QTS
- CVE-2025-9110QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-57705QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-54166QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-54165QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-54164QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53596QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53593QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53592QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53591QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53590QTSQNAP Systems QTS
- CVE-2025-53589QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53414QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53405QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52872QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52864QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52863QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52431QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52430QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52426QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-47208QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-44013QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-62857QuMagieQNAP Systems QuMagie
- CVE-2025-15438PluXml Media Management medias.php __destruct deserializationPluXml
- CVE-2026-0565code-projects Content Management System delete.php sql injectioncode-projects Content Management System
- CVE-2026-0547PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted uploadPHPGurukul Online Course Registration
- CVE-2026-0546code-projects Content Management System search.php sql injectioncode-projects Content Management System
- CVE-2025-15437LigeroSmart Environment Variable cross site scriptingLigeroSmart
- CVE-2025-15436Yonyou KSOA work_edit.jsp sql injectionYonyou KSOA
- CVE-2025-15435Yonyou KSOA work_update.jsp sql injectionYonyou KSOA
- CVE-2025-15434Yonyou KSOA PrintZPYG.jsp sql injectionYonyou KSOA
- CVE-2025-15432yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversalyeqifu carRental
- CVE-2025-14072Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission DisclosureNinja Forms
- CVE-2025-13456Shopbuilder < 3.2.2 - Reflected XSSShopBuilder
- CVE-2025-13153Logo Slider < 4.9.0 - Contributor+ Stored XSSLogo Slider
- CVE-2025-12685WPBookit <= 1.0.7 - Customer Deletion via CSRFWPBookit
- CVE-2025-15426jackying H-ui.admin preview.php unrestricted uploadjackying H-ui.admin
- CVE-2025-15425Yonyou KSOA HTTP GET Parameter del_user.jsp sql injectionYonyou KSOA
- CVE-2025-15424Yonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injectionYonyou KSOA
- CVE-2025-15423EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted uploadEmpireSoft EmpireCMS
- CVE-2025-14047WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletionwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2025-15422EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanismEmpireSoft EmpireCMS
- CVE-2025-15421Yonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injectionYonyou KSOA
- CVE-2025-15420Yonyou KSOA agent_work_report.jsp sql injectionYonyou KSOA
- CVE-2025-15419Open5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of serviceOpen5GS
- CVE-2024-55374REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.
- CVE-2025-45286A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafgithub.com/mccutchen/go-httpbin · github.com/mccutchen/go-h…