# CVEs published 2026-01-03

10 CVEs were published on January 3, 2026: 1 critical, 1 high. Days are UTC.

- [CVE-2025-3660](https://cve.now/CVE-2025-3660.md): Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint (CVSS 6.9, Petlibrio Smart Pet Feeder Platform)
- [CVE-2025-3654](https://cve.now/CVE-2025-3654.md): Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint (CVSS 6.9, Petlibrio Smart Pet Feeder Platform)
- [CVE-2025-3653](https://cve.now/CVE-2025-3653.md): Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint (CVSS 6.9, Petlibrio Smart Pet Feeder Platform)
- [CVE-2025-3652](https://cve.now/CVE-2025-3652.md): Petlibro Smart Pet Feeder Platform through 1.7.31 Audio Information Disclosure via API endpoint (CVSS 6.9, Petlibrio Smart Pet Feeder Platform)
- [CVE-2025-3646](https://cve.now/CVE-2025-3646.md): Petlibro Smart Pet Feeder Platform through 1.7.31 Authorization Bypass via Device Share API (CVSS 6.9, Petlibrio Smart Pet Feeder Platform)
- [CVE-2025-15115](https://cve.now/CVE-2025-15115.md): Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint (CVSS 6.9, Petlibrio Smart Pet Feeder Platform)
- [CVE-2025-34171](https://cve.now/CVE-2025-34171.md): CasaOS \<= 0.4.15 Unauthenticated File and Debug Data Exposure (CVSS 6.9, IceWhale Tech CasaOS)
- [CVE-2026-21484](https://cve.now/CVE-2026-21484.md): AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery (CVSS 5.3, Mintplex-Labs anything-llm)
- [CVE-2025-64124](https://cve.now/CVE-2025-64124.md): Nuvation Energy Multi-Stack Controller OS Command Injection (CVSS 8.7, Nuvation Energy Multi-Stack Controller)
- [CVE-2025-64125](https://cve.now/CVE-2025-64125.md): Nuvation Energy nCloud Client-to-Client Communication (CVSS 9.4, Nuvation Energy nCloud VPN Service)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.