# CVEs published 2026-01-11

13 CVEs were published on January 11, 2026: 0 critical, 7 high. Days are UTC.

- [CVE-2026-0851](https://cve.now/CVE-2026-0851.md): code-projects Online Music Site AdminAddUser.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-0850](https://cve.now/CVE-2026-0850.md): code-projects Intern Membership Management System delete\_activity.php sql injection (CVSS 5.1, code-projects Intern Membership Management System)
- [CVE-2025-68493](https://cve.now/CVE-2025-68493.md): Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component (CVSS 8.1, Apache Software Foundation Apache Struts · org.apache.st… +2)
- [CVE-2025-15506](https://cve.now/CVE-2025-15506.md): AcademySoftwareFoundation OpenColorIO FileRules.cpp ConvertToRegularExpression out-of-bounds (CVSS 4.8, AcademySoftwareFoundation OpenColorIO · opencolorio)
- [CVE-2026-0843](https://cve.now/CVE-2026-0843.md): jiujiujia/victor123/wxw850227 jjjfood/jjjshop\_food index sql injection (CVSS 5.3, jiujiujia jjjfood · jiujiujia jjjshop\_food +4)
- [CVE-2026-0842](https://cve.now/CVE-2026-0842.md): Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication (CVSS 5.3, Flycatcher Toys smART Sketcher)
- [CVE-2026-0841](https://cve.now/CVE-2026-0841.md): UTT 进取 520W formPictureUrl strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-0840](https://cve.now/CVE-2026-0840.md): UTT 进取 520W formConfigNoticeConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-0839](https://cve.now/CVE-2026-0839.md): UTT 进取 520W APSecurity strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-0838](https://cve.now/CVE-2026-0838.md): UTT 进取 520W ConfigWirelessBase strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-0837](https://cve.now/CVE-2026-0837.md): UTT 进取 520W formFireWall strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-0836](https://cve.now/CVE-2026-0836.md): UTT 进取 520W formConfigFastDirectionW strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15505](https://cve.now/CVE-2025-15505.md): Luxul XWR-600 Web Administration cross site scripting (CVSS 4.8, Luxul XWR-600)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.