# CVEs published 2026-01-04

9 CVEs were published on January 4, 2026: 0 critical, 0 high. Days are UTC.

- [CVE-2026-0579](https://cve.now/CVE-2026-0579.md): code-projects Online Product Reservation System POST Parameter edit.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2026-0578](https://cve.now/CVE-2026-0578.md): code-projects Online Product Reservation System delete.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2025-15443](https://cve.now/CVE-2025-15443.md): CRMEB product\_export sql injection (CVSS 5.1, CRMEB)
- [CVE-2025-15442](https://cve.now/CVE-2025-15442.md): CRMEB product\_list sql injection (CVSS 5.1, CRMEB)
- [CVE-2026-0577](https://cve.now/CVE-2026-0577.md): code-projects Online Product Reservation System prod.php unrestricted upload (CVSS 5.3, code-projects Online Product Reservation System)
- [CVE-2025-14830](https://cve.now/CVE-2025-14830.md): JFrog Artifactory Cross-Site Scripting (CVSS 4.9, JFrog Artifactory)
- [CVE-2026-0576](https://cve.now/CVE-2026-0576.md): code-projects Online Product Reservation System Parameter prod.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2026-0575](https://cve.now/CVE-2026-0575.md): code-projects Online Product Reservation System Administrator Login adminlogin.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2026-0574](https://cve.now/CVE-2026-0574.md): yeqifu warehouse Request UserController.java saveUserRole improper authorization (CVSS 5.3, yeqifu warehouse)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.