CVEs published January 12, 2026
86 CVEs were published on January 12, 2026: 19 critical, 28 high.
- Published
- 86
- Critical
- 19
- High
- 28
- Medium
- 30
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Broadcom DX NetOps Spectrum
- 10
- avahi
- 3
- espressif esp-usb
- 3
- anomalyco opencode · opencode-ai
- 2
- Imaster MEMS Events CRM
- 2
- Imaster Patient Record Management System
- 2
- pnggroup libpng
- 2
- RIOT OS
- 2
- run-llama llama_index · llama-index
- 2
- SMEWebify WebErpMesv2
- 2
Critical 19
- CVE-2026-22813Malicious website can execute commands on the local system through XSS in the OpenCode web UIanomalyco opencode · opencode-ai
- CVE-2026-22799emlog Arbitrary File Upload Vulnerabilityemlog
- CVE-2026-22794Account Takeover Vulnerability in Appsmithappsmithorg appsmith
- CVE-2025-12420Unauthenticated Privilege Escalation in ServiceNow AI PlatformServiceNow Now Assist AI Agents · ServiceNow Virtual Agent…
- CVE-2026-22785orval MCP client is vulnerable to a code injection attack.orval-labs orval · @orval/mcp
- CVE-2026-22783Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Managementdfir-iris iris-web
- CVE-2026-22781TinyWeb CGI Command Injectionmaximmasiutin TinyWeb
- CVE-2026-22252LibreChat MCP Stdio Remote Command Executiondanny-avila LibreChat
- CVE-2025-41006Multiple vulnerabilities in Imaster products Open configuration optionsImaster MEMS Events CRM
- CVE-2025-52694Execution of arbitrary SQL commandsAdvantech IoTSuite and IoT Edge Products
- CVE-2025-29329Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute
- CVE-2025-46066An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges
- CVE-2025-46070An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component
- CVE-2025-51567A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute
- CVE-2025-63314A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the
- CVE-2025-65552D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel.
- CVE-2025-66802Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution).
- CVE-2025-67146Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php,
- CVE-2025-67147Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' paramet
High 28
- CVE-2024-58340LangChain <= 0.3.1 MRKLOutputParser ReDoSLangChain AI LangChain · langchain-exa
- CVE-2024-14021LlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserializationrun-llama llama_index · llama-index
- CVE-2024-58339LlamaIndex <= 0.12.2 VannaQueryEngine SQL Execution Allows Resource Exhaustionrun-llama llama_index · llama-index
- CVE-2025-15514Ollama Multi-Modal Model Image Processing NULL Pointer DereferenceOllama
- CVE-2026-22812OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Executionanomalyco opencode · opencode-ai
- CVE-2026-22804Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in BrowserTermix-SSH Termix
- CVE-2026-22788WebErpMesv2 allows unauthenticated API AccessSMEWebify WebErpMesv2
- CVE-2026-22786Gin-vue-admin has arbitrary file upload vulnerability caused by path traversalflipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…
- CVE-2026-22200osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File ReadEnhancesoft osTicket
- CVE-2026-22776cpp-httplib vulnerable to a denial of service (DOS) using a zip bombyhirose cpp-httplib
- CVE-2026-22771Envoy Extension Policy lua scripts injection causes arbitrary command executionenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-22033Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys fieldHumanSignal label-studio · label-studio
- CVE-2025-68472MindsDB has improper sanitation of filepath that leads to information disclosure and DOSmindsdb
- CVE-2025-71063Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.mrvladus Errands
- CVE-2025-41078Multiple vulnerabilities in Viafirma productsViafirma Documents
- CVE-2025-41077Multiple vulnerabilities in Viafirma productsViafirma Inbox
- CVE-2025-41005Multiple vulnerabilities in Imaster products Open configuration optionsImaster MEMS Events CRM
- CVE-2025-41004Multiple vulnerabilities in Imaster products Open configuration optionsImaster Patient Record Management System
- CVE-2025-14279DNS Rebinding Vulnerability in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-0855Merit LILIN｜IP Camera - OS Command InjectionMerit LILIN P2 · Merit LILIN P3 +3
- CVE-2026-0854Merit LILIN｜NVR - OS Command InjectionMerit LILIN DH032 · Merit LILIN DVR708 +18
- CVE-2025-69275Spectrum outdated java library in class-pathBroadcom DX NetOps Spectrum
- CVE-2025-69273Spectrum broken authenticationBroadcom DX NetOps Spectrum
- CVE-2025-69269Spectrum command injection in NCM serviceBroadcom DX NetOps Spectrum
- CVE-2025-69267Spectrum directory path traversalBroadcom DX NetOps Spectrum
- CVE-2023-36331Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via ma
- CVE-2025-46067An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file
- CVE-2025-46068An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism
Medium, low and unrated 39
- CVE-2026-22214RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame ParserRIOT OS
- CVE-2026-22213RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 UtilityRIOT OS
- CVE-2026-22212TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpioTinyOS
- CVE-2026-22801LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*pnggroup libpng
- CVE-2026-22695LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)pnggroup libpng
- CVE-2026-22805Metabase channel test endpoint can reach internal local addressesmetabase
- CVE-2026-22800PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferencesTHM-Health PILOS
- CVE-2026-22798hermes's raw options logging may disclose secrets passed in via subcommand options argumentsoftwarepub hermes · hermes
- CVE-2026-22789WebErpMesv2 has a File Upload Validation Bypass Leading to RCESMEWebify WebErpMesv2
- CVE-2026-22772Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypasssigstore fulcio · github.com/sigstore/fulcio
- CVE-2026-22784Lychee cross-album password propagation on Album unlockingLycheeOrg Lychee
- CVE-2026-22251wlc may leak API keys due to an insecure API key configurationWeblateOrg wlc · wlc
- CVE-2026-22250wlc can skip SSL verificationWeblateOrg wlc · wlc
- CVE-2025-68471Avahi has a reachable assertion in lookup_startavahi
- CVE-2025-68468Avahi has a reachable assertion in lookup_multicast_callbackavahi
- CVE-2025-68276Avahi has a reachable assertion in avahi_wide_area_scan_cacheavahi
- CVE-2025-68657espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Pathespressif esp-usb
- CVE-2025-68656Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerabilityespressif esp-usb
- CVE-2026-22050ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which NETAPP ONTAP
- CVE-2025-68622Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printingespressif esp-usb
- CVE-2025-41003Multiple vulnerabilities in Imaster products Open configuration optionsImaster Patient Record Management System
- CVE-2025-40978Multiple vulnerabilities in WorkDo productsWorkDo eCommerceGo SaaS
- CVE-2025-40977Multiple vulnerabilities in WorkDo productsWorkDo eCommerceGo SaaS
- CVE-2025-40976Multiple vulnerabilities in WorkDo productsWorkDo TicketGo
- CVE-2025-40975Multiple vulnerabilities in WorkDo productsWorkDo HRMGo
- CVE-2025-14579Quiz Maker < 6.7.0.89 - Admin+ Stored XSSQuiz Maker
- CVE-2025-69276Spectrum insecure deserialiationBroadcom DX NetOps Spectrum
- CVE-2025-69274Spectrum broken authorization schemeBroadcom DX NetOps Spectrum
- CVE-2025-69272Spectrum password returned in clearBroadcom DX NetOps Spectrum
- CVE-2025-69271Spectrum basic authentication in useBroadcom DX NetOps Spectrum
- CVE-2025-69270Spectrum session token in URLBroadcom DX NetOps Spectrum
- CVE-2025-69268Spectrum reflected XSSBroadcom DX NetOps Spectrum
- CVE-2026-0853A-Plus Video Technologies｜NVR - Sensitive Data ExposureA-Plus Video Technologies AP-RM864P · A-Plus Video Techn… +6
- CVE-2026-0852code-projects Online Music Site AdminUpdateUser.php sql injectioncode-projects Online Music Site
- CVE-2021-41074A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML documen
- CVE-2025-65553D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel.
- CVE-2025-66689A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the syst
- CVE-2025-66939Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon fi
- CVE-2025-67813Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication