# CVEs published 2026-01-02

103 CVEs were published on January 2, 2026: 7 critical, 27 high. Days are UTC.

- [CVE-2025-64123](https://cve.now/CVE-2025-64123.md): Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access (CVSS 7.9, Nuvation Energy Multi-Stack Controller)
- [CVE-2025-64122](https://cve.now/CVE-2025-64122.md): Nuvation Energy Multi-Stack Controller Private Key Stored on Device (CVSS 7.2, Nuvation Energy Multi-Stack Controller)
- [CVE-2025-64121](https://cve.now/CVE-2025-64121.md): Nuvation Energy Multi-Stack Controller Authentication Bypass (CVSS 10.0, Nuvation Energy Multi-Stack Controller)
- [CVE-2025-64120](https://cve.now/CVE-2025-64120.md): Nuvation Energy Multi-Stack Controller OS Command Injection (CVSS 9.4, Nuvation Energy Multi-Stack Controller)
- [CVE-2025-64119](https://cve.now/CVE-2025-64119.md): Nuvation Energy BMS Client-side Authentication (CVSS 9.3, Nuvation Energy Battery Management System)
- [CVE-2026-21483](https://cve.now/CVE-2026-21483.md): listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover (CVSS 5.4, knadh listmonk · github.com/knadh/listmonk)
- [CVE-2026-21452](https://cve.now/CVE-2026-21452.md): MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation (CVSS 7.5, msgpack-java · org.msgpack:msgpack-core)
- [CVE-2026-21450](https://cve.now/CVE-2026-21450.md): Bagisto has SSTI in parameter that can lead to RCE (CVSS 7.3, bagisto · bagisto/bagisto)
- [CVE-2026-21451](https://cve.now/CVE-2026-21451.md): Bagisto has HTML Filter Bypass that Enables Stored XSS (CVSS 5.2, bagisto · bagisto/bagisto)
- [CVE-2026-21449](https://cve.now/CVE-2026-21449.md): Bagisto has SSTI via first and last name from low-privilege user (not admin) (CVSS 7.4, bagisto · bagisto/bagisto)
- [CVE-2026-21448](https://cve.now/CVE-2026-21448.md): Bagisto has Normal & Blind SSTI from low-privilege user when ordering product (CVSS 8.9, bagisto · bagisto/bagisto)
- [CVE-2026-21447](https://cve.now/CVE-2026-21447.md): Bagisto has IDOR in Customer Order Reorder Functionality (CVSS 7.1, bagisto · bagisto/bagisto)
- [CVE-2026-0571](https://cve.now/CVE-2026-0571.md): yeqifu warehouse AppFileUtils.java createResponseEntity path traversal (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-21446](https://cve.now/CVE-2026-21446.md): Bagisto Missing Authentication on Installer API Endpoints (CVSS 8.8, bagisto · bagisto/bagisto)
- [CVE-2026-21445](https://cve.now/CVE-2026-21445.md): Langflow Missing Authentication on Critical API Endpoints (CVSS 8.8, langflow-ai langflow · langflow-base +1)
- [CVE-2026-21444](https://cve.now/CVE-2026-21444.md): libtpms returns wrong initialization vector when certain symmetric ciphers are used (CVSS 5.5, stefanberger libtpms)
- [CVE-2026-21440](https://cve.now/CVE-2026-21440.md): AdonisJS Path Traversal in Multipart File Handling (CVSS 9.2, adonisjs core · @adonisjs/bodyparser)
- [CVE-2026-0570](https://cve.now/CVE-2026-0570.md): code-projects Online Music Site Feedback.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-21433](https://cve.now/CVE-2026-21433.md): Emlog vulnerable to Server-Side Request Forgery (SSRF) (CVSS 7.7, emlog)
- [CVE-2026-21432](https://cve.now/CVE-2026-21432.md): Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO (CVSS 6.8, emlog)
- [CVE-2026-21431](https://cve.now/CVE-2026-21431.md): Emlog vulnerable to stored Cross-site Scripting via image name (CVSS 2.0, emlog)
- [CVE-2026-21430](https://cve.now/CVE-2026-21430.md): Emlog: CSRF chained with stored XSS leads to ATO (CVSS 7.0, emlog)
- [CVE-2026-0569](https://cve.now/CVE-2026-0569.md): code-projects Online Music Site AlbumByCategory.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-0568](https://cve.now/CVE-2026-0568.md): code-projects Online Music Site ViewSongs.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-0567](https://cve.now/CVE-2026-0567.md): code-projects Content Management System pages.php sql injection (CVSS 6.9, code-projects Content Management System)
- [CVE-2026-21429](https://cve.now/CVE-2026-21429.md): Emlog has Broken Access Control (BAC) (CVSS 2.0, emlog)
- [CVE-2025-15439](https://cve.now/CVE-2025-15439.md): Daptin Aggregate API resource\_aggregate.go goqu.L sql injection (CVSS 5.3, Daptin)
- [CVE-2025-69417](https://cve.now/CVE-2025-69417.md): In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unr (CVSS 5.0, plex.tv backend)
- [CVE-2025-69416](https://cve.now/CVE-2025-69416.md): In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unr (CVSS 5.0, plex.tv backend)
- [CVE-2025-69415](https://cve.now/CVE-2025-69415.md): In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether (CVSS 7.1, Plex Media Server)
- [CVE-2025-69414](https://cve.now/CVE-2025-69414.md): Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access (CVSS 8.5, Plex Media Server)
- [CVE-2026-0566](https://cve.now/CVE-2026-0566.md): code-projects Content Management System edit\_posts.php unrestricted upload (CVSS 5.1, code-projects Content Management System)
- [CVE-2025-59389](https://cve.now/CVE-2025-59389.md): Hyper Data Protector (CVSS 8.1, QNAP Systems Hyper Data Protector)
- [CVE-2025-62842](https://cve.now/CVE-2025-62842.md): HBS 3 Hybrid Backup Sync (CVSS 7.0, QNAP Systems HBS 3 Hybrid Backup Sync)
- [CVE-2025-62840](https://cve.now/CVE-2025-62840.md): HBS 3 Hybrid Backup Sync (CVSS 7.0, QNAP Systems HBS 3 Hybrid Backup Sync)
- [CVE-2025-11837](https://cve.now/CVE-2025-11837.md): Malware Remover (CVSS 8.1, QNAP Systems Malware Remover)
- [CVE-2025-69284](https://cve.now/CVE-2025-69284.md): In plane.io, a Guest User to a Workspace can still be able to see list of members (CVSS 4.3, makeplane plane)
- [CVE-2025-62852](https://cve.now/CVE-2025-62852.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS)
- [CVE-2025-59387](https://cve.now/CVE-2025-59387.md): MARS (Multi-Application Recovery Service) (CVSS 8.1, QNAP Systems MARS)
- [CVE-2025-59384](https://cve.now/CVE-2025-59384.md): Qfiling (CVSS 8.1, QNAP Systems Qfiling)
- [CVE-2025-59381](https://cve.now/CVE-2025-59381.md): QTS, QuTS hero (CVSS 6.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-59380](https://cve.now/CVE-2025-59380.md): QTS, QuTS hero (CVSS 4.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53597](https://cve.now/CVE-2025-53597.md): License Center (CVSS 1.2, QNAP Systems License Center)
- [CVE-2025-53594](https://cve.now/CVE-2025-53594.md): Qfinder Pro, Qsync, QVPN (CVSS 4.4, QNAP Systems Qfinder Pro Mac · QNAP Systems Qsync for Mac +1)
- [CVE-2025-52871](https://cve.now/CVE-2025-52871.md): License Center (CVSS 1.3, QNAP Systems License Center)
- [CVE-2025-48721](https://cve.now/CVE-2025-48721.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS)
- [CVE-2025-9110](https://cve.now/CVE-2025-9110.md): QTS, QuTS hero (CVSS 2.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-57705](https://cve.now/CVE-2025-57705.md): QTS, QuTS hero (CVSS 4.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-54166](https://cve.now/CVE-2025-54166.md): QTS, QuTS hero (CVSS 4.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-54165](https://cve.now/CVE-2025-54165.md): QTS, QuTS hero (CVSS 4.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-54164](https://cve.now/CVE-2025-54164.md): QTS, QuTS hero (CVSS 4.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53596](https://cve.now/CVE-2025-53596.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53593](https://cve.now/CVE-2025-53593.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53592](https://cve.now/CVE-2025-53592.md): QTS, QuTS hero (CVSS 1.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53591](https://cve.now/CVE-2025-53591.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53590](https://cve.now/CVE-2025-53590.md): QTS (CVSS 1.2, QNAP Systems QTS)
- [CVE-2025-53589](https://cve.now/CVE-2025-53589.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53414](https://cve.now/CVE-2025-53414.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53405](https://cve.now/CVE-2025-53405.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52872](https://cve.now/CVE-2025-52872.md): QTS, QuTS hero (CVSS 1.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52864](https://cve.now/CVE-2025-52864.md): QTS, QuTS hero (CVSS 1.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52863](https://cve.now/CVE-2025-52863.md): QTS, QuTS hero (CVSS 1.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52431](https://cve.now/CVE-2025-52431.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52430](https://cve.now/CVE-2025-52430.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52426](https://cve.now/CVE-2025-52426.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-47208](https://cve.now/CVE-2025-47208.md): QTS, QuTS hero (CVSS 4.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-44013](https://cve.now/CVE-2025-44013.md): QTS, QuTS hero (CVSS 1.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-62857](https://cve.now/CVE-2025-62857.md): QuMagie (CVSS 2.2, QNAP Systems QuMagie)
- [CVE-2025-15438](https://cve.now/CVE-2025-15438.md): PluXml Media Management medias.php \_\_destruct deserialization (CVSS 5.1, PluXml)
- [CVE-2026-0565](https://cve.now/CVE-2026-0565.md): code-projects Content Management System delete.php sql injection (CVSS 6.9, code-projects Content Management System)
- [CVE-2026-0547](https://cve.now/CVE-2026-0547.md): PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload (CVSS 5.3, PHPGurukul Online Course Registration)
- [CVE-2026-0546](https://cve.now/CVE-2026-0546.md): code-projects Content Management System search.php sql injection (CVSS 6.9, code-projects Content Management System)
- [CVE-2025-15437](https://cve.now/CVE-2025-15437.md): LigeroSmart Environment Variable cross site scripting (CVSS 5.1, LigeroSmart)
- [CVE-2025-15436](https://cve.now/CVE-2025-15436.md): Yonyou KSOA work\_edit.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15435](https://cve.now/CVE-2025-15435.md): Yonyou KSOA work\_update.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15434](https://cve.now/CVE-2025-15434.md): Yonyou KSOA PrintZPYG.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15432](https://cve.now/CVE-2025-15432.md): yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal (CVSS 6.9, yeqifu carRental)
- [CVE-2025-15431](https://cve.now/CVE-2025-15431.md): UTT 进取 512W formFtpServerDirConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-14072](https://cve.now/CVE-2025-14072.md): Ninja Forms \< 3.13.3 - Unauthenticated Token Generation and Submission Disclosure (CVSS 5.3, Ninja Forms)
- [CVE-2025-13456](https://cve.now/CVE-2025-13456.md): Shopbuilder \< 3.2.2 - Reflected XSS (CVSS 6.1, ShopBuilder)
- [CVE-2025-13153](https://cve.now/CVE-2025-13153.md): Logo Slider \< 4.9.0 - Contributor+ Stored XSS (CVSS 6.1, Logo Slider)
- [CVE-2025-12685](https://cve.now/CVE-2025-12685.md): WPBookit \<= 1.0.7 - Customer Deletion via CSRF (CVSS 6.5, WPBookit)
- [CVE-2025-15430](https://cve.now/CVE-2025-15430.md): UTT 进取 512W formFtpServerShareDirSelcet strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15429](https://cve.now/CVE-2025-15429.md): UTT 进取 512W formConfigCliForEngineerOnly strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15428](https://cve.now/CVE-2025-15428.md): UTT 进取 512W formRemoteControl strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15426](https://cve.now/CVE-2025-15426.md): jackying H-ui.admin preview.php unrestricted upload (CVSS 6.9, jackying H-ui.admin)
- [CVE-2025-15425](https://cve.now/CVE-2025-15425.md): Yonyou KSOA HTTP GET Parameter del\_user.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15424](https://cve.now/CVE-2025-15424.md): Yonyou KSOA HTTP GET Parameter agent\_worksdel.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15423](https://cve.now/CVE-2025-15423.md): EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload (CVSS 5.3, EmpireSoft EmpireCMS)
- [CVE-2025-14998](https://cve.now/CVE-2025-14998.md): Branda – White Label & Branding, Free Login Page Customizer \<= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, wpmudev Branda – White Label & Branding, Free Login Page Cu…)
- [CVE-2025-14047](https://cve.now/CVE-2025-14047.md): WP User Frontend \<= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3, wedevs User Frontend: AI Powered Frontend Posting, User Dir…)
- [CVE-2025-15422](https://cve.now/CVE-2025-15422.md): EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism (CVSS 6.9, EmpireSoft EmpireCMS)
- [CVE-2025-15421](https://cve.now/CVE-2025-15421.md): Yonyou KSOA HTTP GET Parameter agent\_worksadd.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15420](https://cve.now/CVE-2025-15420.md): Yonyou KSOA agent\_work\_report.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2025-15419](https://cve.now/CVE-2025-15419.md): Open5GS GTPv2-C Flow s5c-handler.c sgwc\_s5c\_handle\_create\_session\_response denial of service (CVSS 4.8, Open5GS)
- [CVE-2024-55374](https://cve.now/CVE-2024-55374.md): REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts. (CVSS 5.3)
- [CVE-2025-45286](https://cve.now/CVE-2025-45286.md): A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a craf (CVSS 6.1, github.com/mccutchen/go-httpbin · github.com/mccutchen/go-h…)
- [CVE-2025-65125](https://cve.now/CVE-2025-65125.md): SQL injection in gosaliajainam/online-movie-booking 5.5 in movie\_details.php allows attackers to gain sensitive information. (CVSS 9.8)
- [CVE-2025-67158](https://cve.now/CVE-2025-67158.md): An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitiv (CVSS 7.5)
- [CVE-2025-67159](https://cve.now/CVE-2025-67159.md): Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. (CVSS 7.5)
- [CVE-2025-67160](https://cve.now/CVE-2025-67160.md): An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. (CVSS 7.5)
- [CVE-2025-67268](https://cve.now/CVE-2025-67268.md): gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver\_nmea2000.c file. (CVSS 9.8)
- [CVE-2025-67269](https://cve.now/CVE-2025-67269.md): An integer underflow vulnerability exists in the \`nextstate()\` function in \`gpsd/packet.c\` of gpsd versions prior to commit \`ffa1d6f40bca0b0 (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.