# CVEs published 2026-01-05

151 CVEs were published on January 5, 2026: 18 critical, 51 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-21439](https://cve.now/CVE-2026-21439.md): badkeys vulnerable to ASCII control character injection on console via malformed input (CVSS 2.0, badkeys)
- [CVE-2025-69230](https://cve.now/CVE-2025-69230.md): AIOHTTP Vulnerable to Cookie Parser Warning Storm (CVSS 2.7, aio-libs aiohttp · aiohttp)
- [CVE-2025-69229](https://cve.now/CVE-2025-69229.md): AIOHTTP vulnerable to DoS through chunked messages (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2026-0607](https://cve.now/CVE-2026-0607.md): code-projects Online Music Site AdminViewSongs.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2025-69228](https://cve.now/CVE-2025-69228.md): AIOHTTP vulnerable to denial of service through large payloads (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2025-69227](https://cve.now/CVE-2025-69227.md): AIOHTTP vulnerable to DoS when bypassing asserts (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2025-69225](https://cve.now/CVE-2025-69225.md): AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields (CVSS 2.7, aio-libs aiohttp · aiohttp)
- [CVE-2026-0606](https://cve.now/CVE-2026-0606.md): code-projects Online Music Site Albums.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2025-69226](https://cve.now/CVE-2025-69226.md): AIOHTTP allows for a brute-force leak of internal static filepath components (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2025-69224](https://cve.now/CVE-2025-69224.md): AIOHTTP's Unicode processing of header values could cause parsing discrepancies (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2025-68456](https://cve.now/CVE-2025-68456.md): Unauthenticated Craft CMS users can trigger a database backup (CVSS 7.0, craftcms cms · craftcms/cms)
- [CVE-2025-69223](https://cve.now/CVE-2025-69223.md): AIOHTTP's HTTP Parser auto\_decompress feature is vulnerable to zip bomb (CVSS 7.5, aio-libs aiohttp · aiohttp)
- [CVE-2025-68455](https://cve.now/CVE-2025-68455.md): Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior (CVSS 8.6, craftcms cms · craftcms/cms)
- [CVE-2025-68454](https://cve.now/CVE-2025-68454.md): Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI (CVSS 5.2, craftcms cms · craftcms/cms)
- [CVE-2025-68953](https://cve.now/CVE-2025-68953.md): Certain Frappe requests are vulnerable to Path Traversal (CVSS 7.5, frappe)
- [CVE-2025-68437](https://cve.now/CVE-2025-68437.md): Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation (CVSS 5.0, craftcms cms · craftcms/cms)
- [CVE-2025-68436](https://cve.now/CVE-2025-68436.md): Craft CMS vulnerable to potential information disclosure via unchecked asset relocation (CVSS 4.9, craftcms cms · craftcms/cms)
- [CVE-2025-68428](https://cve.now/CVE-2025-68428.md): jsPDF has Local File Inclusion/Path Traversal vulnerability (CVSS 9.2, parallax jsPDF · jspdf)
- [CVE-2025-67732](https://cve.now/CVE-2025-67732.md): Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint (CVSS 8.4, langgenius dify)
- [CVE-2025-66648](https://cve.now/CVE-2025-66648.md): \`vega-functions\` vulnerable to Cross-site Scripting via \`setdata\` function (CVSS 7.2, vega · vega-functions)
- [CVE-2025-65110](https://cve.now/CVE-2025-65110.md): Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope (CVSS 8.1, vega · vega-selections)
- [CVE-2026-0625](https://cve.now/CVE-2026-0625.md): D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint (CVSS 9.3, D-Link DSL-2640B · D-Link DSL-2740R +15)
- [CVE-2025-61916](https://cve.now/CVE-2025-61916.md): Spinnaker vulnerable to SSRF due to improper restrictions on http from user input (CVSS 7.9, spinnaker · io.spinnaker.clouddriver:clouddriver-artifacts)
- [CVE-2026-0621](https://cve.now/CVE-2026-0621.md): MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS (CVSS 8.7, Anthropic MCP TypeScript SDK · @modelcontextprotocol/sdk)
- [CVE-2025-64425](https://cve.now/CVE-2025-64425.md): Coolify has host header injection in forgot password (CVSS 8.5, coollabsio coolify)
- [CVE-2025-64424](https://cve.now/CVE-2025-64424.md): Colify has command injection vulnerability in project git source (CVSS 9.4, coollabsio coolify)
- [CVE-2025-64423](https://cve.now/CVE-2025-64423.md): Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links (CVSS 7.7, coollabsio coolify)
- [CVE-2026-0605](https://cve.now/CVE-2026-0605.md): code-projects Online Music Site login.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2025-64422](https://cve.now/CVE-2025-64422.md): Rate-limit bypass on login via X-Forwarded-Host header (CVSS 5.5, coollabsio coolify)
- [CVE-2025-64421](https://cve.now/CVE-2025-64421.md): Coolify has a privilege escalation - low privileged user can invite themselves as an admin user (CVSS 8.7, coollabsio coolify)
- [CVE-2025-64420](https://cve.now/CVE-2025-64420.md): Coolify members can see private key of root user (CVSS 10.0, coollabsio coolify)
- [CVE-2025-64419](https://cve.now/CVE-2025-64419.md): Coolify vulnerable to command injection via docker-compose.yaml parameters (CVSS 9.7, coollabsio coolify)
- [CVE-2025-61781](https://cve.now/CVE-2025-61781.md): GraphQL IDOR allows authenticated user to delete workspace content of other users (CVSS 7.1, OpenCTI-Platform opencti · pycti)
- [CVE-2025-59955](https://cve.now/CVE-2025-59955.md): Coolify leaksensitive information \`email\_change\_code\` in \`/api/v1/teams/{team\_id | current}/members\` API endpoint (CVSS 5.7, coollabsio coolify)
- [CVE-2025-59158](https://cve.now/CVE-2025-59158.md): Coolify has Stored XSS in Project Name (CVSS 9.4, coollabsio coolify)
- [CVE-2025-59157](https://cve.now/CVE-2025-59157.md): Coolify has Git Repository RCE (CVSS 10.0, coollabsio coolify)
- [CVE-2025-59156](https://cve.now/CVE-2025-59156.md): Coolify has Docker Compose Injection issue (CVSS 9.4, coollabsio coolify)
- [CVE-2025-55204](https://cve.now/CVE-2025-55204.md): muffon has One-click Remote Code Execution via XSS and Custom URL Handling (CVSS 8.8, staniel359 muffon)
- [CVE-2025-10933](https://cve.now/CVE-2025-10933.md): Silicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds read (CVSS 5.3, silabs.com Z-Wave Protocol Controller)
- [CVE-2025-39484](https://cve.now/CVE-2025-39484.md): WordPress Entrada Theme \<= 5.7.7 - SQL Injection vulnerability (CVSS 9.3, Waituk Entrada)
- [CVE-2025-39497](https://cve.now/CVE-2025-39497.md): WordPress Dokan Pro plugin \<= 3.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Dokan Pro)
- [CVE-2025-39561](https://cve.now/CVE-2025-39561.md): WordPress LoginWP - Pro Plugin \<= 4.0.8.5 - Broken Access Control vulnerability (CVSS 6.5, Marketing Fire LoginWP - Pro)
- [CVE-2026-21635](https://cve.now/CVE-2026-21635.md): An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink fea (CVSS 5.3, Ubiquiti UniFi Connect EV Station Lite)
- [CVE-2026-21634](https://cve.now/CVE-2026-21634.md): A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery pr (CVSS 6.5, Ubiquiti UniFi Protect Application)
- [CVE-2025-59467](https://cve.now/CVE-2025-59467.md): A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation (CVSS 7.5, Ubiquiti UCRM Argentina AFIP invoices Plugin)
- [CVE-2026-21633](https://cve.now/CVE-2026-21633.md): A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery p (CVSS 8.8, Ubiquiti UniFi Protect Application)
- [CVE-2025-46255](https://cve.now/CVE-2025-46255.md): WordPress LoginWP - Pro Plugin \<= 4.0.8.5 - Settings Change vulnerability (CVSS 7.5, Marketing Fire LoginWP - Pro)
- [CVE-2025-53344](https://cve.now/CVE-2025-53344.md): WordPress Thim Core Plugin \<= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, ThimPress Thim Core)
- [CVE-2024-53735](https://cve.now/CVE-2024-53735.md): WordPress iPhone Webclip Manager plugin \<= 0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, corourke iPhone Webclip Manager)
- [CVE-2024-30516](https://cve.now/CVE-2024-30516.md): WordPress Booking Package plugin \<= 1.6.27 - Price Manipulation vulnerability (CVSS 7.5, SaasProject Booking Package)
- [CVE-2024-30461](https://cve.now/CVE-2024-30461.md): WordPress Tumult Hype Animations plugin \<= 1.9.11 - CSRF to XSS vulnerability (CVSS 7.1, Tumult Hype Animations)
- [CVE-2025-14346](https://cve.now/CVE-2025-14346.md): WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. (CVSS 9.8, WHILL Model C2 Electric Wheelchair · WHILL Model F Power Ch…)
- [CVE-2025-15029](https://cve.now/CVE-2025-15029.md): An unauthenticated user is able to introduce SQL Injection using the Awie export module (CVSS 9.8, Centreon Infra Monitoring)
- [CVE-2026-0597](https://cve.now/CVE-2026-0597.md): Campcodes Supplier Management System edit\_profile.php sql injection (CVSS 5.3, Campcodes Supplier Management System)
- [CVE-2025-15026](https://cve.now/CVE-2025-15026.md): Unauthenticated configuration import allows administrative account creation using AWIE component (CVSS 9.8, Centreon Infra Monitoring)
- [CVE-2025-12511](https://cve.now/CVE-2025-12511.md): A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-68280](https://cve.now/CVE-2025-68280.md): Apache SIS: XML External Entity (XXE) vulnerability (CVSS 6.5, Apache Software Foundation Apache SIS · org.apache.sis.core…)
- [CVE-2025-12513](https://cve.now/CVE-2025-12513.md): A user with elevated privileges can inject XSS in the Hosts configuration parameters page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2024-23511](https://cve.now/CVE-2024-23511.md): WordPress The Plus Addons for Elementor plugin \<= 5.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2023-52212](https://cve.now/CVE-2023-52212.md): WordPress WP Job Manager plugin \<= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Automattic WP Job Manager)
- [CVE-2026-0592](https://cve.now/CVE-2026-0592.md): code-projects Online Product Reservation System User Registration register\_code.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2023-51513](https://cve.now/CVE-2023-51513.md): WordPress Geo Controller plugin \<= 8.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, INTINITUM FORM Geo Controller)
- [CVE-2023-50897](https://cve.now/CVE-2023-50897.md): WordPress Media File Renamer plugin \<= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability (CVSS 9.1, Meow Apps Media File Renamer)
- [CVE-2023-49186](https://cve.now/CVE-2023-49186.md): WordPress Machic Core plugin \<= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, KlbTheme Machic Core)
- [CVE-2026-0591](https://cve.now/CVE-2026-0591.md): code-projects Online Product Reservation System Cart Update update.php sql injection (CVSS 5.3, code-projects Online Product Reservation System)
- [CVE-2026-0590](https://cve.now/CVE-2026-0590.md): code-projects Online Product Reservation System POST Parameter delete.php sql injection (CVSS 5.3, code-projects Online Product Reservation System)
- [CVE-2026-0589](https://cve.now/CVE-2026-0589.md): code-projects Online Product Reservation System Administration Backend improper authentication (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2026-0588](https://cve.now/CVE-2026-0588.md): Xinhu Rainrock RockOA API rockfun.php cross site scripting (CVSS 5.1, Xinhu Rainrock RockOA)
- [CVE-2026-0587](https://cve.now/CVE-2026-0587.md): Xinhu Rainrock RockOA Cover Image rock\_page\_gong.php cross site scripting (CVSS 5.1, Xinhu Rainrock RockOA)
- [CVE-2025-68865](https://cve.now/CVE-2025-68865.md): WordPress Infility Global plugin \<= 2.15.06 - SQL Injection vulnerability (CVSS 9.3, Infility Global)
- [CVE-2025-68850](https://cve.now/CVE-2025-68850.md): WordPress Sell Downloads plugin \<= 1.1.12 - Broken Access Control vulnerability (CVSS 7.5, codepeople Sell Downloads)
- [CVE-2025-68547](https://cve.now/CVE-2025-68547.md): WordPress Follow My Blog Post plugin \<= 2.4.0 - Arbitrary Content Deletion vulnerability (CVSS 7.5, wpweb Follow My Blog Post)
- [CVE-2025-68044](https://cve.now/CVE-2025-68044.md): WordPress Five Star Restaurant Reservations plugin \<= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 8.6, Rustaurius Five Star Restaurant Reservations)
- [CVE-2025-68033](https://cve.now/CVE-2025-68033.md): WordPress Custom Related Posts plugin \<= 1.8.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, Brecht Custom Related Posts)
- [CVE-2025-68029](https://cve.now/CVE-2025-68029.md): WordPress Wallet System for WooCommerce plugin \<= 2.7.3 - Sensitive Data Exposure vulnerability (CVSS 6.3, WP Swings Wallet System for WooCommerce)
- [CVE-2025-68014](https://cve.now/CVE-2025-68014.md): WordPress AweBooking plugin \<= 3.2.26 - Sensitive Data Exposure vulnerability (CVSS 6.5, awethemes AweBooking)
- [CVE-2026-0586](https://cve.now/CVE-2026-0586.md): code-projects Online Product Reservation System prod.php cross site scripting (CVSS 5.3, code-projects Online Product Reservation System)
- [CVE-2025-31048](https://cve.now/CVE-2025-31048.md): WordPress Shopo \<= 1.1.4 - Arbitrary File Upload Vulnerability (CVSS 9.9, Themify Shopo)
- [CVE-2025-31047](https://cve.now/CVE-2025-31047.md): WordPress Themify Edmin theme \<= 2.0.0 - PHP Object Injection Vulnerability (CVSS 8.8, Themify Edmin)
- [CVE-2025-31046](https://cve.now/CVE-2025-31046.md): WordPress AnyWhere Elementor Pro plugin \<= 2.29 - Broken Access Control Vulnerability (CVSS 4.3, WPvibes AnyWhere Elementor Pro)
- [CVE-2025-31044](https://cve.now/CVE-2025-31044.md): WordPress Premium SEO Pack \<= 3.3.2 - SQL Injection Vulnerability (CVSS 8.5, AA-Team Premium SEO Pack)
- [CVE-2025-30633](https://cve.now/CVE-2025-30633.md): WordPress Amazon Native Shopping Recommendations Plugin \<= 1.3 - SQL Injection Vulnerability (CVSS 9.3, AA-Team Amazon Native Shopping Recommendations)
- [CVE-2025-69087](https://cve.now/CVE-2025-69087.md): WordPress FreeAgent theme \<= 2.1.2 - Local File Inclusion vulnerability (CVSS 8.1, jwsthemes FreeAgent)
- [CVE-2025-12519](https://cve.now/CVE-2025-12519.md): Information disclosure on Administration parameters API endpoint (CVSS 5.3, Centreon Infra Monitoring)
- [CVE-2025-13056](https://cve.now/CVE-2025-13056.md): A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page (CVSS 6.8, Centreon Infra Monitoring)
- [CVE-2025-5965](https://cve.now/CVE-2025-5965.md): RCE via the backup feature available only to user with high privilege (CVSS 7.2, Centreon Infra Monitoring)
- [CVE-2026-0585](https://cve.now/CVE-2026-0585.md): code-projects Online Product Reservation System GET Parameter order\_view.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2025-68766](https://cve.now/CVE-2025-68766.md): irqchip/mchp-eic: Fix error code in mchp\_eic\_domain\_alloc() (no CVSS, Linux)
- [CVE-2025-68765](https://cve.now/CVE-2025-68765.md): mt76: mt7615: Fix memory leak in mt7615\_mcu\_wtbl\_sta\_add() (no CVSS, Linux)
- [CVE-2025-68764](https://cve.now/CVE-2025-68764.md): NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (CVSS 7.8, Linux)
- [CVE-2025-68763](https://cve.now/CVE-2025-68763.md): crypto: starfive - Correctly handle return of sg\_nents\_for\_len (no CVSS, Linux)
- [CVE-2025-68762](https://cve.now/CVE-2025-68762.md): net: netpoll: initialize work queue before error checks (no CVSS, Linux)
- [CVE-2025-68761](https://cve.now/CVE-2025-68761.md): hfs: fix potential use after free in hfs\_correct\_next\_unused\_CNID() (CVSS 7.8, Linux)
- [CVE-2025-68760](https://cve.now/CVE-2025-68760.md): iommu/amd: Fix potential out-of-bounds read in iommu\_mmio\_show (no CVSS, Linux)
- [CVE-2025-68759](https://cve.now/CVE-2025-68759.md): wifi: rtl818x: Fix potential memory leaks in rtl8180\_init\_rx\_ring() (no CVSS, Linux)
- [CVE-2025-68758](https://cve.now/CVE-2025-68758.md): backlight: led-bl: Add devlink to supplier LEDs (no CVSS, Linux)
- [CVE-2025-68757](https://cve.now/CVE-2025-68757.md): drm/vgem-fence: Fix potential deadlock on release (no CVSS, Linux)
- [CVE-2025-68756](https://cve.now/CVE-2025-68756.md): block: Use RCU in blk\_mq\_\[un\]quiesce\_tagset() instead of set-\>tag\_list\_lock (no CVSS, Linux)
- [CVE-2025-68755](https://cve.now/CVE-2025-68755.md): staging: most: remove broken i2c driver (no CVSS, Linux)
- [CVE-2025-68754](https://cve.now/CVE-2025-68754.md): rtc: amlogic-a4: fix double free caused by devm (no CVSS, Linux)
- [CVE-2025-68753](https://cve.now/CVE-2025-68753.md): ALSA: firewire-motu: add bounds check in put\_user loop for DSP events (CVSS 7.1, Linux)
- [CVE-2025-68752](https://cve.now/CVE-2025-68752.md): iavf: Implement settime64 with -EOPNOTSUPP (no CVSS, Linux)
- [CVE-2025-68751](https://cve.now/CVE-2025-68751.md): s390/fpu: Fix false-positive kmsan report in fpu\_vstl() (no CVSS, Linux)
- [CVE-2026-0584](https://cve.now/CVE-2026-0584.md): code-projects Online Product Reservation System left\_cart.php sql injection (CVSS 5.3, code-projects Online Product Reservation System)
- [CVE-2026-0583](https://cve.now/CVE-2026-0583.md): code-projects Online Product Reservation System User Login login.php sql injection (CVSS 6.9, code-projects Online Product Reservation System)
- [CVE-2025-66518](https://cve.now/CVE-2025-66518.md): Apache Kyuubi: Unauthorized directory access due to missing path normalization (CVSS 8.8, Apache Software Foundation Apache Kyuubi · org.apache.kyuub…)
- [CVE-2026-0582](https://cve.now/CVE-2026-0582.md): itsourcecode Society Management System edit\_activity\_query.php sql injection (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2025-15240](https://cve.now/CVE-2025-15240.md): Quanta Computer｜QOCA aim AI Medical Cloud Platform - Arbitrary File Upload (CVSS 8.7, Quanta Computer QOCA aim AI Medical Cloud Platform)
- [CVE-2025-15239](https://cve.now/CVE-2025-15239.md): Quanta Computer｜QOCA aim AI Medical Cloud Platform - SQL Injection (CVSS 7.1, Quanta Computer QOCA aim AI Medical Cloud Platform)
- [CVE-2026-0581](https://cve.now/CVE-2026-0581.md): Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection (CVSS 5.3, Tenda AC1206)
- [CVE-2025-15238](https://cve.now/CVE-2025-15238.md): Quanta Computer｜QOCA aim AI Medical Cloud Platform - SQL Injection (CVSS 7.1, Quanta Computer QOCA aim AI Medical Cloud Platform)
- [CVE-2025-15022](https://cve.now/CVE-2025-15022.md): Cross-site scripting in Action caption (CVSS 4.8, vaadin · vaadin-spreadsheet-flow +3)
- [CVE-2025-15237](https://cve.now/CVE-2025-15237.md): Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal (CVSS 5.3, Quanta Computer QOCA aim AI Medical Cloud Platform)
- [CVE-2025-15236](https://cve.now/CVE-2025-15236.md): Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal (CVSS 5.3, Quanta Computer QOCA aim AI Medical Cloud Platform)
- [CVE-2026-0580](https://cve.now/CVE-2026-0580.md): SourceCodester API Key Manager App Import Key cross site scripting (CVSS 5.1, SourceCodester API Key Manager App)
- [CVE-2025-15235](https://cve.now/CVE-2025-15235.md): Quanta Computer｜QOCA aim AI Medical Cloud Platform - Missing Authorization (CVSS 7.1, Quanta Computer QOCA aim AI Medical Cloud Platform)
- [CVE-2025-15462](https://cve.now/CVE-2025-15462.md): UTT 进取 520W ConfigAdvideo strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15461](https://cve.now/CVE-2025-15461.md): UTT 进取 520W formTaskEdit strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15460](https://cve.now/CVE-2025-15460.md): UTT 进取 520W formPptpClientConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-9543](https://cve.now/CVE-2025-9543.md): FlexTable Google Sheets Connector \< 3.19.2 - Admin+ Stored XSS (CVSS 3.5, FlexTable)
- [CVE-2025-14124](https://cve.now/CVE-2025-14124.md): Team \< 5.0.11 - Unauthenticated SQLi (CVSS 8.6, Team)
- [CVE-2025-15459](https://cve.now/CVE-2025-15459.md): UTT 进取 520W formUser strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15458](https://cve.now/CVE-2025-15458.md): bg5sbk MiniCMS Article post-edit.php improper authentication (CVSS 6.9, bg5sbk MiniCMS)
- [CVE-2025-15457](https://cve.now/CVE-2025-15457.md): bg5sbk MiniCMS Trash File Restore post.php improper authentication (CVSS 6.9, bg5sbk MiniCMS)
- [CVE-2025-15456](https://cve.now/CVE-2025-15456.md): bg5sbk MiniCMS Publish page-edit.php improper authentication (CVSS 6.9, bg5sbk MiniCMS)
- [CVE-2025-15455](https://cve.now/CVE-2025-15455.md): bg5sbk MiniCMS File Recovery Request page.php delete\_page improper authentication (CVSS 6.9, bg5sbk MiniCMS)
- [CVE-2025-15454](https://cve.now/CVE-2025-15454.md): zhanglun lettura RSS ContentRender.tsx cross site scripting (CVSS 2.3, zhanglun lettura)
- [CVE-2025-15453](https://cve.now/CVE-2025-15453.md): milvus HTTP Endpoint expr.go expr.Exec deserialization (CVSS 5.3, milvus)
- [CVE-2025-15452](https://cve.now/CVE-2025-15452.md): xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting (CVSS 4.8, xnx3 wangmarket)
- [CVE-2025-15451](https://cve.now/CVE-2025-15451.md): xnx3 wangmarket System Variables variableSave.do cross site scripting (CVSS 4.8, xnx3 wangmarket)
- [CVE-2025-15450](https://cve.now/CVE-2025-15450.md): sfturing hosp\_order orderHos findOrderHosNum sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-15449](https://cve.now/CVE-2025-15449.md): cld378632668 JavaMall MinioController.java delete path traversal (CVSS 5.3, cld378632668 JavaMall)
- [CVE-2025-5591](https://cve.now/CVE-2025-5591.md): Stored Cross-site Scripting (XSS) in Kentico Xperience 13 (CVSS 7.7, Kentico Xperience)
- [CVE-2025-15448](https://cve.now/CVE-2025-15448.md): cld378632668 JavaMall MinioController.java upload unrestricted upload (CVSS 5.3, cld378632668 JavaMall)
- [CVE-2025-27807](https://cve.now/CVE-2025-27807.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, (CVSS 9.1)
- [CVE-2025-43706](https://cve.now/CVE-2025-43706.md): An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, (CVSS 7.5)
- [CVE-2025-49495](https://cve.now/CVE-2025-49495.md): An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. (CVSS 8.4)
- [CVE-2025-52515](https://cve.now/CVE-2025-52515.md): An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. (CVSS 5.1)
- [CVE-2025-52516](https://cve.now/CVE-2025-52516.md): An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. (CVSS 6.2)
- [CVE-2025-52517](https://cve.now/CVE-2025-52517.md): An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. (CVSS 5.1)
- [CVE-2025-52519](https://cve.now/CVE-2025-52519.md): An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. (CVSS 7.1)
- [CVE-2025-53966](https://cve.now/CVE-2025-53966.md): An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. (CVSS 8.4)
- [CVE-2025-57836](https://cve.now/CVE-2025-57836.md): An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. (CVSS 7.8)
- [CVE-2025-65328](https://cve.now/CVE-2025-65328.md): Mega-Fence (webgate-lib.\*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating (CVSS 6.5)
- [CVE-2025-65922](https://cve.now/CVE-2025-65922.md): PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. (CVSS 4.3)
- [CVE-2025-66376](https://cve.now/CVE-2025-66376.md): Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d (CVSS 7.2, KEV, Zimbra Collaboration)
- [CVE-2025-67303](https://cve.now/CVE-2025-67303.md): An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. (CVSS 7.5, comfyui-manager)
- [CVE-2025-67316](https://cve.now/CVE-2025-67316.md): An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in Hey (CVSS 5.4)
- [CVE-2025-67397](https://cve.now/CVE-2025-67397.md): An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific p (CVSS 9.1)
- [CVE-2025-67419](https://cve.now/CVE-2025-67419.md): A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's res (CVSS 7.5, @evershop/evershop)
- [CVE-2025-67427](https://cve.now/CVE-2025-67427.md): A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to (CVSS 6.5, @evershop/evershop)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.