CVEs published January 15, 2026
198 CVEs were published on January 15, 2026: 23 critical, 89 high.
- Published
- 198
- Critical
- 23
- High
- 89
- Medium
- 81
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 63
Most affected products
- Juniper Networks Junos OS
- 20
- SICK AG TDC-X401GL
- 13
- Canon Satera LBP670C Series · Canon Satera MF750C Series +19
- 7
- Altium Live
- 3
- Red Hat Hardened Images · Red Hat Enterprise Linux +2
- 3
- SICK AG Incoming Goods Suite
- 3
- 10-Strike Strike Network Inventory Explorer Pro
- 2
- Celestialsoftware AbsoluteTelnet
- 2
- Cisco Identity Services Engine Software
- 2
- denoland deno · deno
- 2
Critical 23
- CVE-2025-14237Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on theCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2025-14236Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the networCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2025-14235Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2025-14234Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2025-14233Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on thCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2025-14232Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on thCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2025-14231Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on tCanon Satera LBP670C Series · Canon Satera MF750C Series +19
- CVE-2021-47812GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)Getgrav GravCMS
- CVE-2026-22863Deno node:crypto doesn't finalize cipherdenoland deno · deno
- CVE-2026-1009Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data ExposureAltium Live
- CVE-2023-7334Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCEChangjetong Information Technology Co. T+
- CVE-2011-10041Uploadify <= 1.0 Unauthenticated Arbitrary File UploadSteven Uploadify
- CVE-2026-23746Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCEEntrust Instant Financial Issuance
- CVE-2026-23520Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEgetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2025-62193NOAA PMEL Live Access Server (LAS) PyFerret command injectionNational Oceanic and Atmospheric Administration (NOAA) Live…
- CVE-2021-47819ProjeQtOr Project Management 9.1.4 - Remote Code ExecutionProjeQtOr Project Management
- CVE-2021-47753phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)phpKF CMS
- CVE-2026-22908Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity SICK AG TDC-X401GL
- CVE-2026-22907An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.SICK AG TDC-X401GL
- CVE-2025-67079File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick l
- CVE-2025-67084File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which
- CVE-2025-67822A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an u
- CVE-2025-70892Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module.
High 89
- CVE-2021-47811Grocery crud 1.6.4 - 'order_by' SQL InjectionGrocerycrud Grocery crud
- CVE-2021-47810WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service PathWibuKey Runtime
- CVE-2021-47809Disk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service PathDisksorter Disk Sorter Enterprise
- CVE-2021-47807Sync Breeze 13.6.18 - 'Multiple' Unquoted Service PathSyncbreeze Sync Breeze
- CVE-2021-47806Dup Scout 13.5.28 - 'Multiple' Unquoted Service PathDupscout Dup Scout
- CVE-2021-47805Disk Savvy 13.6.14 - 'Multiple' Unquoted Service PathDisksavvy Disk Savvy
- CVE-2021-47804Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service PathWisecleaner Wise Care
- CVE-2021-47803iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service PathI-Funbox iFunbox
- CVE-2021-47801Vianeos OctoPUS 5 - 'login_user' SQLiVianeos OctoPUS
- CVE-2021-47796Denver SHO-110 IP Camera Unauthenticated Snapshot AccessDenver SHO-110
- CVE-2021-47795GeoVision Geowebserver 5.3.3 - Local FIle InclusionGeoVision Geowebserver
- CVE-2021-47794ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)ZesleCP
- CVE-2021-47792Remote Mouse 4.002 - Unquoted Service PathRemotemouse Remote Mouse
- CVE-2021-47790Active WebCam 11.5 - Unquoted Service PathPysoft Active WebCam
- CVE-2021-47788WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)WebsiteBaker
- CVE-2021-47787TotalAV 5.15.69 - Unquoted Service PathTotalAV
- CVE-2021-47785Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH)Mp3-Avi-Mpeg-Wmv-Rm-To-Audio-Cd-Burner Ether_MP3_CD_Burner
- CVE-2021-47782Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL InjectionOdinesolutions Odine Solutions GateKeeper
- CVE-2021-47780Macro Expert 4.7 - Unquoted Service PathMacro-Expert Macro Expert
- CVE-2021-47779Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationDolibarr CRM
- CVE-2021-47756Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)Laravel Valet
- CVE-2020-36930SysGauge 7.9.18 - ' SysGauge Server' Unquoted Service PathSysGauge
- CVE-2020-36929Brother BRPrint Auditor 3.0.7 - 'Multiple' Unquoted Service PathSupport Brother BRPrint Auditor
- CVE-2020-36928Brother BRAgent 1.38 - 'WBA_Agent_Client' Unquoted Service PathBrother BRAgent
- CVE-2020-36927DiskPulse 13.6.14 - Unquoted Service PathDiskPulse
- CVE-2026-1010Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege EscalationAltium Enterprise Server
- CVE-2026-22864Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypassdenoland deno · deno
- CVE-2026-1008Stored Cross-Site Scripting in Altium Live User Profile FieldsAltium Live
- CVE-2026-0915getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovlerThe GNU C Library glibc
- CVE-2026-21920Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crashJuniper Networks Junos OS
- CVE-2026-21918Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashesJuniper Networks Junos OS
- CVE-2026-21917Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crashJuniper Networks Junos OS
- CVE-2026-21914Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crashJuniper Networks Junos OS
- CVE-2026-21913Junos OS: EX4000: A high volume of traffic destined to the device leads to a crash and restartJuniper Networks Junos OS
- CVE-2026-21908Junos OS and Junos OS Evolved: Use after free vulnerability In 802.1X authentication daemon can cause crash of the dot1xd processJuniper Networks Junos OS
- CVE-2026-21906Junos OS: SRX Series: With GRE performance acceleration enabled, receipt of a specific ICMP packet causes the PFE to crashJuniper Networks Junos OS
- CVE-2026-21905Junos OS: SRX Series, MX Series with MX-SPC3 or MS-MPC: Receipt of multiple specific SIP messages results in flow management process crashJuniper Networks Junos OS
- CVE-2025-60003Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crashJuniper Networks Junos OS
- CVE-2025-59960Junos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP serverJuniper Networks Junos OS
- CVE-2026-23622CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeoveralextselegidis easyappointments · alextselegidis/easyappoin…
- CVE-2026-23527h3 v1 has Request Smuggling (TE.TE) issueh3js h3 · h3
- CVE-2026-23519RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnzRustCrypto utils · cmov
- CVE-2026-22775devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parsesveltejs devalue · devalue
- CVE-2026-22774devalue vulnerable to denial of service due to memory exhaustion in devalue.parsesveltejs devalue · devalue
- CVE-2026-22249Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)docmost
- CVE-2026-22803SvelteKit has a memory amplification DoS in Remote Functions binary form deserializersveltejs kit · @sveltejs/kit
- CVE-2025-67647SvelteKit Denial of service and possible SSRF when using prerenderingsveltejs kit · @sveltejs/kit +1
- CVE-2025-13845CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file)Schneider Electric EcoStruxure Power Build Rapsody
- CVE-2025-13844CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD fiSchneider Electric EcoStruxure Power Build Rapsody
- CVE-2025-36911In key-based pairing, there is a possible ID due to a logic error in the code.Google Android
- CVE-2026-23493Pimcore ENV Variables and Cookie Informations are exposed in http_error_logpimcore · pimcore/pimcore
- CVE-2026-22867LaSuite Doc affected by Stored XSS via Interlinking Blocksuitenumerique docs
- CVE-2026-22265Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCEroxy-wi
- CVE-2025-66417GLPI has an unauthenticated SQL injection through the inventory endpointglpi-project glpi
- CVE-2025-66292DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interfacedonknap dpanel · github.com/donknap/dpanel
- CVE-2025-64516GLPI incorrectly authorizes access to documentsglpi-project glpi
- CVE-2021-47799Visual Tools DVR VX16 4.2.28 - Local Privilege EscalationVisual-Tools Visual Tools DVR VX16
- CVE-2021-47777Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)Ribccs Build Smart ERP
- CVE-2021-47775YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)Litexmedia YouTube Video Grabber
- CVE-2021-47774Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)En Kingdia CD Extractor
- CVE-2021-47773Dynojet Power Core 2.3.0 - Unquoted Service PathDynojet Power Core
- CVE-2021-4777210-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)10-Strike Strike Network Inventory Explorer Pro
- CVE-2021-4776710-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service Path10-Strike Strike Network Inventory Explorer Pro
- CVE-2021-47766Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)Levelprograms Kmaleon
- CVE-2021-47763Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injectionAimeos Laravel ecommerce platform · aimeos/aimeos-laravel
- CVE-2021-47762HTTPDebuggerPro 9.11 - Unquoted Service PathHTTPDebuggerPro
- CVE-2021-47761MilleGPG5 5.7.2 Luglio 2021 (x64) - Local Privilege EscalationMilleGPG5
- CVE-2021-47758Chikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)dharashah Chikitsa Patient Management System
- CVE-2021-47757Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)dharashah Chikitsa Patient Management System
- CVE-2021-47755Oliver Library Server v5 - Arbitrary File DownloadSoftlink Education Oliver Library Server
- CVE-2021-47752AWebServer GhostBuilding 18 - Denial of Service (DoS)Sylkat-Tools AWebServer GhostBuilding
- CVE-2025-61973A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store.Epic Games Store
- CVE-2026-0897Denial of Service in Keras via Excessive Memory Allocation in HDF5 MetadataGoogle Keras · keras
- CVE-2025-13062Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypassdivisupreme Supreme Modules Lite – Divi Theme, Extra Theme…
- CVE-2026-22910The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized acSICK AG TDC-X401GL
- CVE-2026-22909Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, SICK AG TDC-X401GL
- CVE-2024-48077NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling.
- CVE-2025-67076Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via
- CVE-2025-67077File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via
- CVE-2025-67246A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler
- CVE-2025-67823A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could al
- CVE-2025-70298GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.
- CVE-2025-70304A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2025-70307A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .
- CVE-2025-70656Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C function.
- CVE-2025-70744Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function.
- CVE-2025-70893A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint.
- CVE-2025-71019Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function.
Medium, low and unrated 86
- CVE-2021-47815Nsauditor 3.2.3 - Denial of Service (PoC)Nsauditor
- CVE-2021-47814NBMonitor 1.6.8 - Denial of Service (PoC)Nsauditor NBMonitor
- CVE-2021-47813Backup Key Recovery 2.2.7 - Denial of Service (PoC)Nsauditor Backup Key Recovery
- CVE-2021-47808Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scriptingcotonti.com Cotonti Siena
- CVE-2021-47800b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)b2evolution
- CVE-2021-47798NoteBurner 2.35 - Denial Of Service (DoS) (PoC)NoteBurner
- CVE-2021-47797Leawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC)Leawo Prof. Media
- CVE-2021-47793Telegram Desktop 2.9.2 - Denial of Service (PoC)Telegram Desktop
- CVE-2021-47791SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of ServiceSmartFTP Client
- CVE-2021-47789Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial of Service (PoC)Yenkee Hornet Gaming Mouse
- CVE-2021-47786Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)Redragon Gaming Mouse
- CVE-2021-47783Phpwcms 1.9.30 - Arbitrary File UploadPhpwcms
- CVE-2020-36926SmarterTools SmarterTrack 7922 -Information DisclosureSmarterTools SmarterTrack
- CVE-2026-1011Stored Cross-Site Scripting in Altium Live Support Center Comment EndpointAltium Live
- CVE-2026-22045Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stalltraefik · github.com/traefik/traefik/v3 +2
- CVE-2025-68671lakeFS is Missing Timestamp Validation in S3 Gateway Authenticationtreeverse lakeFS · github.com/treeverse/lakefs
- CVE-2026-1002Eclipse Vert.x Web static handler file access denialEclipse Vert.x · io.vertx:vertx-core
- CVE-2026-21921Junos OS and Junos OS Evolved: When telemetry collectors are frequently subscribing and unsubscribing to sensors chassisd or rpd will crashJuniper Networks Junos OS
- CVE-2026-21912Junos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card resetJuniper Networks Junos OS
- CVE-2026-21911Junos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stopJuniper Networks Junos OS Evolved
- CVE-2026-21910Junos OS: EX4k Series, QFX5k Series: In an EVPN-VXLAN configuration link flaps cause Inter-VNI traffic dropJuniper Networks Junos OS
- CVE-2026-21909Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crashJuniper Networks Junos OS
- CVE-2026-21907Junos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)Juniper Networks Junos Space
- CVE-2026-21903Junos OS: Subscribing to telemetry sensors at scale causes all FPCs to crashJuniper Networks Junos OS
- CVE-2026-0203Junos OS: Receipt of a specifically malformed ICMP packet causes an FPC restartJuniper Networks Junos OS
- CVE-2025-60011Junos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flapJuniper Networks Junos OS
- CVE-2025-60007Junos OS: A specifically crafted 'show chassis' command causes chassisd to crashJuniper Networks Junos OS
- CVE-2025-59961Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writableJuniper Networks Junos OS
- CVE-2025-59959Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crashJuniper Networks Junos OS
- CVE-2025-52987Paragon Automation: A clickjacking vulnerability in the web server configuration has been addressedJuniper Networks Paragon Automation
- CVE-2025-15265Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)Svelte
- CVE-2026-23511ZITADEL has a user enumeration vulnerability in Login UIszitadel · github.com/zitadel/zitadel
- CVE-2026-0227PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and PortalPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-9014Null Pointer Dereference Vulnerability on TL-WR841NTP-Link Systems TL-WR841N
- CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorizationpimcore · pimcore/web2print-tools-bundle
- CVE-2026-23494Pimcore is Missing Function Level Authorization on "Static Routes" Listingpimcore · pimcore/pimcore
- CVE-2026-23495Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listingpimcore · pimcore/admin-ui-classic-bundle
- CVE-2026-20075Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2026-20047Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2026-20076Cisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2021-47843Tagstoo 2.0.1 - Stored XSS to RCETagstoo
- CVE-2021-47784Cyberfox Web Browser 52.9.1 - Denial of Service (PoC)Cyberfox Web Browser
- CVE-2021-47781Cmder Console Emulator 1.3.18 - 'Cmder.exe' Denial of Service (PoC)Cmder Console Emulator
- CVE-2021-47776Umbraco v8.14.1 - 'baseUrl' SSRFUmbraco · UmbracoCms
- CVE-2021-47771RDP Manager 4.9.9.3 - Denial-of-Service (PoC)Cinspiration RDP Manager
- CVE-2021-47769Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)Bdtask Isshue Shopping Cart
- CVE-2021-47768ImportExportTools NG 10.0.4 - HTML Injectionthundernest ImportExportTools NG
- CVE-2021-47765AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)Celestialsoftware AbsoluteTelnet
- CVE-2021-47764AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)Celestialsoftware AbsoluteTelnet
- CVE-2021-47759MTPutty 1.0.1.21 - SSH Password DisclosureTtyplus MTPutty
- CVE-2021-47754Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)Arunna
- CVE-2026-0992Libxml2: libxml2: denial of service via crafted xml catalogsRed Hat Hardened Images · Red Hat Enterprise Linux +2
- CVE-2026-0989Libxml2: unbounded relaxng include recursion leading to stack overflowRed Hat Hardened Images · Red Hat Enterprise Linux +2
- CVE-2026-0990Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingRed Hat Hardened Images · Red Hat Enterprise Linux +2
- CVE-2025-13859AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settingswpcenter AffiliateX – Amazon Affiliate Plugin
- CVE-2025-12895Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_requestLaborator Kalium 3 | Creative WordPress & WooCommerce Theme
- CVE-2026-22646Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackeSICK AG Incoming Goods Suite
- CVE-2026-22645The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity SICK AG Incoming Goods Suite
- CVE-2026-22644Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxSICK AG Incoming Goods Suite
- CVE-2026-22919An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attSICK AG TDC-X401GL
- CVE-2026-22918An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously craSICK AG TDC-X401GL
- CVE-2026-22917Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.SICK AG TDC-X401GL
- CVE-2026-22916An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictionsSICK AG TDC-X401GL
- CVE-2026-22915An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive informatioSICK AG TDC-X401GL
- CVE-2026-22914An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manSICK AG TDC-X401GL
- CVE-2026-22913Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login.SICK AG TDC-X401GL
- CVE-2026-22912Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication.SICK AG TDC-X401GL
- CVE-2026-22911Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unSICK AG TDC-X401GL
- CVE-2026-0976Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +1
- CVE-2025-14457Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletionglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-14448WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fieldscbutlerjr WP-Members Membership Plugin
- CVE-2025-65349A Stored Cross-Site Scripting (XSS) vulnerability in Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRo
- CVE-2025-65368SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.
- CVE-2025-67025Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment c
- CVE-2025-67078Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify
- CVE-2025-67081An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile.
- CVE-2025-67082An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generati
- CVE-2025-67083Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server.
- CVE-2025-70299A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI
- CVE-2025-70302A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2025-70303A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 fil
- CVE-2025-70305A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file.
- CVE-2025-70309A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WA
- CVE-2025-70310A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg fil
- CVE-2025-70890A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0.
- CVE-2025-70891A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module.