# CVEs published 2026-01-10

74 CVEs were published on January 10, 2026: 4 critical, 29 high. Days are UTC.

- [CVE-2026-0824](https://cve.now/CVE-2026-0824.md): questdb ui Web Console cross site scripting (CVSS 5.1, questdb ui · @questdb/web-console)
- [CVE-2025-13393](https://cve.now/CVE-2025-13393.md): Featured Image from URL (FIFU) \<= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu\_input\_url' (CVSS 4.3, marceljm Featured Image from URL)
- [CVE-2025-12379](https://cve.now/CVE-2025-12379.md): Shortcodes and extra features for Phlox theme \<= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2026-0822](https://cve.now/CVE-2026-0822.md): quickjs-ng quickjs quickjs.c js\_typed\_array\_sort heap-based overflow (CVSS 5.3, quickjs-ng quickjs)
- [CVE-2026-0821](https://cve.now/CVE-2026-0821.md): quickjs-ng quickjs quickjs.c js\_typed\_array\_constructor heap-based overflow (CVSS 6.9, quickjs-ng quickjs)
- [CVE-2025-14555](https://cve.now/CVE-2025-14555.md): Countdown Timer - Widget Countdown \<= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpdevart Countdown Timer – Widget Countdown)
- [CVE-2025-15504](https://cve.now/CVE-2025-15504.md): lief-project LIEF ELF Binary Parser.tcc parse\_binary null pointer dereference (CVSS 4.8, lief-project LIEF · lief)
- [CVE-2025-14506](https://cve.now/CVE-2025-14506.md): ConvertForce Popup Builder \<= 0.0.7 - Stored Cross-Site Scripting via entrance\_animation (CVSS 6.4, imtiazrayhan ConvertForce Popup Builder)
- [CVE-2025-52435](https://cve.now/CVE-2025-52435.md): Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller (CVSS 7.5, Apache Software Foundation Apache Mynewt NimBLE)
- [CVE-2025-53470](https://cve.now/CVE-2025-53470.md): Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver (CVSS 3.1, Apache Software Foundation Apache Mynewt NimBLE)
- [CVE-2025-53477](https://cve.now/CVE-2025-53477.md): Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer (CVSS 7.5, Apache Software Foundation Apache Mynewt NimBLE)
- [CVE-2025-62235](https://cve.now/CVE-2025-62235.md): Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing (CVSS 8.1, Apache Software Foundation Apache Mynewt NimBLE)
- [CVE-2026-0831](https://cve.now/CVE-2026-0831.md): Templately \<= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write (CVSS 5.3, wpdevteam Templately – Elementor & Gutenberg Template Libra…)
- [CVE-2025-15503](https://cve.now/CVE-2025-15503.md): Sangfor Operation and Maintenance Management System common.jsp unrestricted upload (CVSS 6.9, Sangfor Operation and Maintenance Management System)
- [CVE-2025-14976](https://cve.now/CVE-2025-14976.md): User Registration & Membership \<= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 5.4, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-15502](https://cve.now/CVE-2025-15502.md): Sangfor Operation and Maintenance Management System session SessionController os command injection (CVSS 6.9, Sangfor Operation and Maintenance Management System)
- [CVE-2025-14948](https://cve.now/CVE-2025-14948.md): miniOrange OTP Verification and SMS Notification for WooCommerce \<= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification (CVSS 5.3, cyberlord92 miniOrange OTP Verification and SMS Notificatio…)
- [CVE-2026-22777](https://cve.now/CVE-2026-22777.md): ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler (CVSS 7.5, Comfy-Org ComfyUI-Manager · comfy-cli)
- [CVE-2026-22773](https://cve.now/CVE-2026-22773.md): vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-14943](https://cve.now/CVE-2025-14943.md): Blog2Social: Social Media Auto Post & Scheduler \<= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2026-22704](https://cve.now/CVE-2026-22704.md): HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover (CVSS 8.1, haxtheweb issues · @haxtheweb/haxcms-nodejs)
- [CVE-2026-22705](https://cve.now/CVE-2026-22705.md): RustCrypto: Signatures has timing side-channel in ML-DSA decomposition (CVSS 6.4, RustCrypto signatures · ml-dsa)
- [CVE-2026-22703](https://cve.now/CVE-2026-22703.md): Cosign verification accepts any valid Rekor entry under certain conditions (CVSS 5.5, sigstore cosign · github.com/sigstore/cosign/v3 +2)
- [CVE-2026-22702](https://cve.now/CVE-2026-22702.md): virtualenv Has TOCTOU Vulnerabilities in Directory Creation (CVSS 4.5, pypa virtualenv · virtualenv)
- [CVE-2026-22701](https://cve.now/CVE-2026-22701.md): filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock (CVSS 5.3, tox-dev filelock · filelock)
- [CVE-2026-22693](https://cve.now/CVE-2026-22693.md): Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS (CVSS 5.3, harfbuzz)
- [CVE-2026-22689](https://cve.now/CVE-2026-22689.md): Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails (CVSS 6.5, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-22685](https://cve.now/CVE-2026-22685.md): DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation (CVSS 8.8, DevToys-app DevToys)
- [CVE-2026-22611](https://cve.now/CVE-2026-22611.md): AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value (CVSS 3.7, aws-sdk-net · AWSSDK.Core)
- [CVE-2026-22700](https://cve.now/CVE-2026-22700.md): RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE (CVSS 7.5, RustCrypto elliptic-curves · sm2)
- [CVE-2026-22699](https://cve.now/CVE-2026-22699.md): RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() (CVSS 7.5, RustCrypto elliptic-curves · sm2)
- [CVE-2026-22698](https://cve.now/CVE-2026-22698.md): RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability (CVSS 8.7, RustCrypto elliptic-curves · sm2)
- [CVE-2026-22691](https://cve.now/CVE-2026-22691.md): pypdf has possible long runtimes for malformed startxref (CVSS 2.7, py-pdf pypdf · pypdf)
- [CVE-2026-22690](https://cve.now/CVE-2026-22690.md): pypdf has possible long runtimes for missing /Root object with large /Size values (CVSS 2.7, py-pdf pypdf · pypdf)
- [CVE-2026-22688](https://cve.now/CVE-2026-22688.md): WeKnora has Command Injection in MCP stdio test (CVSS 10.0, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-22687](https://cve.now/CVE-2026-22687.md): WeKnora vulnerable to SQL Injection (CVSS 5.6, Tencent WeKnora · github.com/Tencent/WeKnora)
- [CVE-2026-22610](https://cve.now/CVE-2026-22610.md): Angular has XSS Vulnerability via Unsanitized SVG Script Attributes (CVSS 8.5, angular · @angular/compiler +1)
- [CVE-2025-13457](https://cve.now/CVE-2025-13457.md): WooCommerce Square \<= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get\_token\_by\_id (CVSS 7.5, WooCommerce Square)
- [CVE-2026-22589](https://cve.now/CVE-2026-22589.md): Spree API has Unauthenticated IDOR - Guest Address (CVSS 7.5, spree · spree\_core)
- [CVE-2025-61674](https://cve.now/CVE-2025-61674.md): October CMS Vulnerable to Stored XSS via Editor and Branding Styles (CVSS 6.1, octobercms october · october/system)
- [CVE-2025-61676](https://cve.now/CVE-2025-61676.md): October CMS Vulnerable to Stored XSS via Branding Styles (CVSS 6.1, octobercms october · october/system)
- [CVE-2025-65091](https://cve.now/CVE-2025-65091.md): XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService (CVSS 10.0, xwiki-contrib macro-fullcalendar · org.xwiki.contrib:macro-…)
- [CVE-2025-65090](https://cve.now/CVE-2025-65090.md): XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService (CVSS 5.3, xwiki-contrib macro-fullcalendar · org.xwiki.contrib:macro-…)
- [CVE-2026-22597](https://cve.now/CVE-2026-22597.md): Ghost has SSRF via External Media Inliner (CVSS 5.1, TryGhost Ghost · ghost)
- [CVE-2026-22596](https://cve.now/CVE-2026-22596.md): Ghost has SQL Injection in Members Activity Feed (CVSS 6.7, TryGhost Ghost · ghost)
- [CVE-2026-22595](https://cve.now/CVE-2026-22595.md): Ghost has Staff Token permission bypass (CVSS 8.1, TryGhost Ghost · ghost)
- [CVE-2026-22594](https://cve.now/CVE-2026-22594.md): Ghost has Staff 2FA bypass (CVSS 8.1, TryGhost Ghost · ghost)
- [CVE-2026-22030](https://cve.now/CVE-2026-22030.md): React Router has CSRF issue in Action/Server Action Request Processing (CVSS 6.5, remix-run react-router · react-router +1)
- [CVE-2026-22029](https://cve.now/CVE-2026-22029.md): React Router vulnerable to XSS via Open Redirects (CVSS 8.0, remix-run react-router · @remix-run/router +1)
- [CVE-2026-21884](https://cve.now/CVE-2026-21884.md): React Router SSR XSS in ScrollRestoration (CVSS 8.2, remix-run react-router · react-router +1)
- [CVE-2025-61686](https://cve.now/CVE-2025-61686.md): React Router has Path Traversal in File Session Storage (CVSS 9.1, remix-run react-router · @react-router/node +2)
- [CVE-2025-59057](https://cve.now/CVE-2025-59057.md): React Router has XSS Vulnerability (CVSS 7.6, remix-run react-router · react-router +1)
- [CVE-2025-68470](https://cve.now/CVE-2025-68470.md): React Router has unexpected external redirect via untrusted paths (CVSS 6.5, remix-run react-router · react-router)
- [CVE-2026-22612](https://cve.now/CVE-2026-22612.md): Fickling vulnerable to detection bypass due to "builtins" blindness (CVSS 8.9, trailofbits fickling · fickling)
- [CVE-2026-22609](https://cve.now/CVE-2026-22609.md): Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist (CVSS 8.9, trailofbits fickling · fickling)
- [CVE-2026-22608](https://cve.now/CVE-2026-22608.md): Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection (CVSS 8.9, trailofbits fickling · fickling)
- [CVE-2026-22607](https://cve.now/CVE-2026-22607.md): Fickling Blocklist Bypass: cProfile.run() (CVSS 8.9, trailofbits fickling · fickling)
- [CVE-2026-22606](https://cve.now/CVE-2026-22606.md): Fickling has a bypass via runpy.run\_path() and runpy.run\_module() (CVSS 8.9, trailofbits fickling · fickling)
- [CVE-2026-22605](https://cve.now/CVE-2026-22605.md): OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings (CVSS 4.3, opf openproject)
- [CVE-2026-22604](https://cve.now/CVE-2026-22604.md): OpenProject is vulnerable to user enumeration via the change password function (CVSS 6.9, opf openproject)
- [CVE-2026-22603](https://cve.now/CVE-2026-22603.md): OpenProject has no protection against brute-force attacks in the Change Password function (CVSS 6.9, opf openproject)
- [CVE-2026-22602](https://cve.now/CVE-2026-22602.md): OpenProject is Vulnerable to User Enumeration via User ID (CVSS 3.5, opf openproject)
- [CVE-2026-22601](https://cve.now/CVE-2026-22601.md): OpenProject is Vulnerable to Code Execution in E-Mail function (CVSS 8.6, opf openproject)
- [CVE-2026-22600](https://cve.now/CVE-2026-22600.md): OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder (CVSS 9.1, opf openproject)
- [CVE-2026-22697](https://cve.now/CVE-2026-22697.md): CryptoLib Has Heap Buffer Overflow Vulnerability in KMC Base64 Decode Handling (KMC JSON base64ciphertext/base64cleartext) (CVSS 7.5, nasa CryptoLib)
- [CVE-2026-22027](https://cve.now/CVE-2026-22027.md): CryptoLib Vulnerable to Heap Buffer Overflow in MariaDB SA Hexstring Conversion (CVSS 5.7, nasa CryptoLib)
- [CVE-2026-22026](https://cve.now/CVE-2026-22026.md): CryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion (CVSS 8.2, nasa CryptoLib)
- [CVE-2026-22025](https://cve.now/CVE-2026-22025.md): CryptoLib Memory Leak on HTTP Error Response in KMC Client (CVSS 6.3, nasa CryptoLib)
- [CVE-2026-22024](https://cve.now/CVE-2026-22024.md): CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion (CVSS 6.3, nasa CryptoLib)
- [CVE-2026-22023](https://cve.now/CVE-2026-22023.md): CryptoLib Has Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern (CVSS 8.2, nasa CryptoLib)
- [CVE-2026-21900](https://cve.now/CVE-2026-21900.md): CryptoLib Has Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern (CVSS 8.2, nasa CryptoLib)
- [CVE-2026-21899](https://cve.now/CVE-2026-21899.md): CryptoLib has an out-of-bounds read and crash vulnerability when decoding an empty Base64url string (CVSS 4.7, nasa CryptoLib)
- [CVE-2026-21898](https://cve.now/CVE-2026-21898.md): CryptoLib Has Out-of-bounds Read in Crypto\_AOS\_ProcessSecurity (CVSS 8.2, nasa CryptoLib)
- [CVE-2026-21897](https://cve.now/CVE-2026-21897.md): CryptoLib Has Out-of-Bounds Write in Crypto\_Config\_Add\_Gvcid\_Managed\_Parameters (CVSS 7.3, nasa CryptoLib)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.