# CVEs published 2026-01-12

86 CVEs were published on January 12, 2026: 19 critical, 28 high. Days are UTC.

- [CVE-2024-58340](https://cve.now/CVE-2024-58340.md): LangChain \<= 0.3.1 MRKLOutputParser ReDoS (CVSS 8.7, LangChain AI LangChain · langchain-exa)
- [CVE-2024-14021](https://cve.now/CVE-2024-14021.md): LlamaIndex \<= 0.11.6 BGEM3Index Unsafe Deserialization (CVSS 8.4, run-llama llama\_index · llama-index)
- [CVE-2024-58339](https://cve.now/CVE-2024-58339.md): LlamaIndex \<= 0.12.2 VannaQueryEngine SQL Execution Allows Resource Exhaustion (CVSS 8.7, run-llama llama\_index · llama-index)
- [CVE-2025-15514](https://cve.now/CVE-2025-15514.md): Ollama Multi-Modal Model Image Processing NULL Pointer Dereference (CVSS 8.7, Ollama)
- [CVE-2026-22214](https://cve.now/CVE-2026-22214.md): RIOT OS \<= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame Parser (CVSS 6.8, RIOT OS)
- [CVE-2026-22213](https://cve.now/CVE-2026-22213.md): RIOT OS \<= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility (CVSS 2.4, RIOT OS)
- [CVE-2026-22212](https://cve.now/CVE-2026-22212.md): TinyOS \<= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio (CVSS 4.8, TinyOS)
- [CVE-2026-22801](https://cve.now/CVE-2026-22801.md): LIBPNG has an integer truncation causing heap buffer over-read in png\_image\_write\_\* (CVSS 6.8, pnggroup libpng)
- [CVE-2026-22695](https://cve.now/CVE-2026-22695.md): LIBPNG has a heap buffer over-read in png\_image\_read\_direct\_scaled (regression from CVE-2025-65018 fix) (CVSS 6.1, pnggroup libpng)
- [CVE-2026-22813](https://cve.now/CVE-2026-22813.md): Malicious website can execute commands on the local system through XSS in the OpenCode web UI (CVSS 9.4, anomalyco opencode · opencode-ai)
- [CVE-2026-22812](https://cve.now/CVE-2026-22812.md): OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution (CVSS 8.8, anomalyco opencode · opencode-ai)
- [CVE-2026-22805](https://cve.now/CVE-2026-22805.md): Metabase channel test endpoint can reach internal local addresses (CVSS 2.1, metabase)
- [CVE-2026-22804](https://cve.now/CVE-2026-22804.md): Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser (CVSS 8.0, Termix-SSH Termix)
- [CVE-2026-22800](https://cve.now/CVE-2026-22800.md): PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences (CVSS 2.4, THM-Health PILOS)
- [CVE-2026-22799](https://cve.now/CVE-2026-22799.md): emlog Arbitrary File Upload Vulnerability (CVSS 9.3, emlog)
- [CVE-2026-22798](https://cve.now/CVE-2026-22798.md): hermes's raw options logging may disclose secrets passed in via subcommand options argument (CVSS 5.9, softwarepub hermes · hermes)
- [CVE-2026-22794](https://cve.now/CVE-2026-22794.md): Account Takeover Vulnerability in Appsmith (CVSS 9.7, appsmithorg appsmith)
- [CVE-2026-22789](https://cve.now/CVE-2026-22789.md): WebErpMesv2 has a File Upload Validation Bypass Leading to RCE (CVSS 5.4, SMEWebify WebErpMesv2)
- [CVE-2026-22788](https://cve.now/CVE-2026-22788.md): WebErpMesv2 allows unauthenticated API Access (CVSS 8.2, SMEWebify WebErpMesv2)
- [CVE-2025-12420](https://cve.now/CVE-2025-12420.md): Unauthenticated Privilege Escalation in ServiceNow AI Platform (CVSS 9.3, ServiceNow Now Assist AI Agents · ServiceNow Virtual Agent…)
- [CVE-2026-22786](https://cve.now/CVE-2026-22786.md): Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal (CVSS 7.3, flipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…)
- [CVE-2026-22772](https://cve.now/CVE-2026-22772.md): Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass (CVSS 5.8, sigstore fulcio · github.com/sigstore/fulcio)
- [CVE-2026-22785](https://cve.now/CVE-2026-22785.md): orval MCP client is vulnerable to a code injection attack. (CVSS 9.3, orval-labs orval · @orval/mcp)
- [CVE-2026-22784](https://cve.now/CVE-2026-22784.md): Lychee cross-album password propagation on Album unlocking (CVSS 2.3, LycheeOrg Lychee)
- [CVE-2026-22200](https://cve.now/CVE-2026-22200.md): osTicket (1.18.x \< 1.18.3, 1.17.x \< 1.17.7) PDF Export Arbitrary File Read (CVSS 8.7, Enhancesoft osTicket)
- [CVE-2026-22783](https://cve.now/CVE-2026-22783.md): Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management (CVSS 9.6, dfir-iris iris-web)
- [CVE-2026-22781](https://cve.now/CVE-2026-22781.md): TinyWeb CGI Command Injection (CVSS 10.0, maximmasiutin TinyWeb)
- [CVE-2026-22776](https://cve.now/CVE-2026-22776.md): cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb (CVSS 8.7, yhirose cpp-httplib)
- [CVE-2026-22771](https://cve.now/CVE-2026-22771.md): Envoy Extension Policy lua scripts injection causes arbitrary command execution (CVSS 8.8, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-22252](https://cve.now/CVE-2026-22252.md): LibreChat MCP Stdio Remote Command Execution (CVSS 9.1, danny-avila LibreChat)
- [CVE-2026-22251](https://cve.now/CVE-2026-22251.md): wlc may leak API keys due to an insecure API key configuration (CVSS 5.3, WeblateOrg wlc · wlc)
- [CVE-2026-22250](https://cve.now/CVE-2026-22250.md): wlc can skip SSL verification (CVSS 2.5, WeblateOrg wlc · wlc)
- [CVE-2026-22033](https://cve.now/CVE-2026-22033.md): Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom\_hotkeys field (CVSS 8.6, HumanSignal label-studio · label-studio)
- [CVE-2025-68471](https://cve.now/CVE-2025-68471.md): Avahi has a reachable assertion in lookup\_start (CVSS 6.5, avahi)
- [CVE-2025-68468](https://cve.now/CVE-2025-68468.md): Avahi has a reachable assertion in lookup\_multicast\_callback (CVSS 6.5, avahi)
- [CVE-2025-68276](https://cve.now/CVE-2025-68276.md): Avahi has a reachable assertion in avahi\_wide\_area\_scan\_cache (CVSS 5.5, avahi)
- [CVE-2025-68657](https://cve.now/CVE-2025-68657.md): espressif/usb\_host\_hid Double-Free Race Condition in USB Host HID Device Close Path (CVSS 6.4, espressif esp-usb)
- [CVE-2025-68656](https://cve.now/CVE-2025-68656.md): Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability (CVSS 6.8, espressif esp-usb)
- [CVE-2026-22050](https://cve.now/CVE-2026-22050.md): ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which (CVSS 6.9, NETAPP ONTAP)
- [CVE-2025-68622](https://cve.now/CVE-2025-68622.md): Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing (CVSS 6.8, espressif esp-usb)
- [CVE-2025-68472](https://cve.now/CVE-2025-68472.md): MindsDB has improper sanitation of filepath that leads to information disclosure and DOS (CVSS 8.1, mindsdb)
- [CVE-2025-71063](https://cve.now/CVE-2025-71063.md): Errands before 46.2.10 does not verify TLS certificates for CalDAV servers. (CVSS 8.2, mrvladus Errands)
- [CVE-2025-41078](https://cve.now/CVE-2025-41078.md): Multiple vulnerabilities in Viafirma products (CVSS 8.7, Viafirma Documents)
- [CVE-2025-41077](https://cve.now/CVE-2025-41077.md): Multiple vulnerabilities in Viafirma products (CVSS 8.6, Viafirma Inbox)
- [CVE-2025-41006](https://cve.now/CVE-2025-41006.md): Multiple vulnerabilities in Imaster products Open configuration options (CVSS 9.3, Imaster MEMS Events CRM)
- [CVE-2025-41005](https://cve.now/CVE-2025-41005.md): Multiple vulnerabilities in Imaster products Open configuration options (CVSS 8.7, Imaster MEMS Events CRM)
- [CVE-2025-41004](https://cve.now/CVE-2025-41004.md): Multiple vulnerabilities in Imaster products Open configuration options (CVSS 8.7, Imaster Patient Record Management System)
- [CVE-2025-41003](https://cve.now/CVE-2025-41003.md): Multiple vulnerabilities in Imaster products Open configuration options (CVSS 5.1, Imaster Patient Record Management System)
- [CVE-2025-40978](https://cve.now/CVE-2025-40978.md): Multiple vulnerabilities in WorkDo products (CVSS 5.1, WorkDo eCommerceGo SaaS)
- [CVE-2025-40977](https://cve.now/CVE-2025-40977.md): Multiple vulnerabilities in WorkDo products (CVSS 5.1, WorkDo eCommerceGo SaaS)
- [CVE-2025-40976](https://cve.now/CVE-2025-40976.md): Multiple vulnerabilities in WorkDo products (CVSS 5.1, WorkDo TicketGo)
- [CVE-2025-40975](https://cve.now/CVE-2025-40975.md): Multiple vulnerabilities in WorkDo products (CVSS 5.1, WorkDo HRMGo)
- [CVE-2025-14279](https://cve.now/CVE-2025-14279.md): DNS Rebinding Vulnerability in mlflow/mlflow (CVSS 8.1, mlflow/mlflow · mlflow)
- [CVE-2026-0855](https://cve.now/CVE-2026-0855.md): Merit LILIN｜IP Camera - OS Command Injection (CVSS 8.7, Merit LILIN P2 · Merit LILIN P3 +3)
- [CVE-2025-14579](https://cve.now/CVE-2025-14579.md): Quiz Maker \< 6.7.0.89 - Admin+ Stored XSS (CVSS 4.8, Quiz Maker)
- [CVE-2026-0854](https://cve.now/CVE-2026-0854.md): Merit LILIN｜NVR - OS Command Injection (CVSS 8.7, Merit LILIN DH032 · Merit LILIN DVR708 +18)
- [CVE-2025-69276](https://cve.now/CVE-2025-69276.md): Spectrum insecure deserialiation (CVSS 2.3, Broadcom DX NetOps Spectrum)
- [CVE-2025-69275](https://cve.now/CVE-2025-69275.md): Spectrum outdated java library in class-path (CVSS 7.1, Broadcom DX NetOps Spectrum)
- [CVE-2025-69274](https://cve.now/CVE-2025-69274.md): Spectrum broken authorization scheme (CVSS 2.3, Broadcom DX NetOps Spectrum)
- [CVE-2025-69273](https://cve.now/CVE-2025-69273.md): Spectrum broken authentication (CVSS 8.7, Broadcom DX NetOps Spectrum)
- [CVE-2025-69272](https://cve.now/CVE-2025-69272.md): Spectrum password returned in clear (CVSS 5.3, Broadcom DX NetOps Spectrum)
- [CVE-2025-69271](https://cve.now/CVE-2025-69271.md): Spectrum basic authentication in use (CVSS 2.3, Broadcom DX NetOps Spectrum)
- [CVE-2025-69270](https://cve.now/CVE-2025-69270.md): Spectrum session token in URL (CVSS 2.3, Broadcom DX NetOps Spectrum)
- [CVE-2025-69269](https://cve.now/CVE-2025-69269.md): Spectrum command injection in NCM service (CVSS 7.1, Broadcom DX NetOps Spectrum)
- [CVE-2025-69268](https://cve.now/CVE-2025-69268.md): Spectrum reflected XSS (CVSS 5.3, Broadcom DX NetOps Spectrum)
- [CVE-2025-69267](https://cve.now/CVE-2025-69267.md): Spectrum directory path traversal (CVSS 8.8, Broadcom DX NetOps Spectrum)
- [CVE-2026-0853](https://cve.now/CVE-2026-0853.md): A-Plus Video Technologies｜NVR - Sensitive Data Exposure (CVSS 6.9, A-Plus Video Technologies AP-RM864P · A-Plus Video Techn… +6)
- [CVE-2025-52694](https://cve.now/CVE-2025-52694.md): Execution of arbitrary SQL commands (CVSS 10.0, Advantech IoTSuite and IoT Edge Products)
- [CVE-2026-0852](https://cve.now/CVE-2026-0852.md): code-projects Online Music Site AdminUpdateUser.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2021-41074](https://cve.now/CVE-2021-41074.md): A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML documen (CVSS 5.4)
- [CVE-2023-36331](https://cve.now/CVE-2023-36331.md): Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via ma (CVSS 8.2)
- [CVE-2025-29329](https://cve.now/CVE-2025-29329.md): Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR\_4.121.0 allows remote attacker to execute (CVSS 9.8)
- [CVE-2025-46066](https://cve.now/CVE-2025-46066.md): An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges (CVSS 9.9)
- [CVE-2025-46067](https://cve.now/CVE-2025-46067.md): An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file (CVSS 8.2)
- [CVE-2025-46068](https://cve.now/CVE-2025-46068.md): An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism (CVSS 8.8)
- [CVE-2025-46070](https://cve.now/CVE-2025-46070.md): An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component (CVSS 9.8)
- [CVE-2025-51567](https://cve.now/CVE-2025-51567.md): A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute (CVSS 9.1)
- [CVE-2025-63314](https://cve.now/CVE-2025-63314.md): A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the (CVSS 10.0)
- [CVE-2025-65552](https://cve.now/CVE-2025-65552.md): D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. (CVSS 9.8)
- [CVE-2025-65553](https://cve.now/CVE-2025-65553.md): D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. (CVSS 6.5)
- [CVE-2025-66689](https://cve.now/CVE-2025-66689.md): A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the syst (CVSS 6.5)
- [CVE-2025-66802](https://cve.now/CVE-2025-66802.md): Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). (CVSS 9.8)
- [CVE-2025-66939](https://cve.now/CVE-2025-66939.md): Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon fi (CVSS 5.4)
- [CVE-2025-67146](https://cve.now/CVE-2025-67146.md): Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member\_search.php, (CVSS 9.4)
- [CVE-2025-67147](https://cve.now/CVE-2025-67147.md): Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' paramet (CVSS 9.8)
- [CVE-2025-67813](https://cve.now/CVE-2025-67813.md): Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.