CVEs published January 18, 2026
29 CVEs were published on January 18, 2026: 0 critical, 2 high.
- Published
- 29
- Critical
- 0
- High
- 2
- Medium
- 27
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Yonyou KSOA
- 5
- cijliu librtsp
- 3
- itsourcecode Society Management System
- 2
- raysan5 raylib
- 2
- Sanluan PublicCMS
- 2
- 1Panel-dev 1Panel
- 1
- axllent mailpit · github.com/axllent/mailpit
- 1
- BYVoid OpenCC · opencc
- 1
- Chamilo LMS
- 1
- D-Link DIR-823X
- 1
High 2
Medium, low and unrated 27
- CVE-2025-15539Open5GS sgwc s11-handler.c sgwc_s11_handle_downlink_data_notification_ack denial of serviceOpen5GS
- CVE-2026-23829Mailpit has SMTP Header Injection via Regex Bypassaxllent mailpit · github.com/axllent/mailpit
- CVE-2025-15538Open Asset Import Library Assimp LWOMaterial.cpp FindUVChannels use after freeOpen Asset Import Library Assimp
- CVE-2026-23733Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)lobehub lobe-chat · @lobehub/chat
- CVE-2026-23626Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)kimai · kimai/kimai
- CVE-2026-235251panel App Store vulnerable to Cross-site Scripting1Panel-dev 1Panel
- CVE-2026-1126lwj flow SVG File FormResource.java uploadFile unrestricted uploadlwj flow
- CVE-2026-1125D-Link DIR-823X set_wifidog_settings sub_412E7C command injectionD-Link DIR-823X
- CVE-2026-1124Yonyou KSOA HTTP GET Parameter work_report.jsp sql injectionYonyou KSOA
- CVE-2026-1123Yonyou KSOA HTTP GET Parameter work_mod.jsp sql injectionYonyou KSOA
- CVE-2026-1122Yonyou KSOA HTTP GET Parameter work_info.jsp sql injectionYonyou KSOA
- CVE-2026-1121Yonyou KSOA HTTP GET Parameter del_workplan.jsp sql injectionYonyou KSOA
- CVE-2026-1120Yonyou KSOA HTTP GET Parameter del_work.jsp sql injectionYonyou KSOA
- CVE-2026-1119itsourcecode Society Management System delete_activity.php sql injectionitsourcecode Society Management System
- CVE-2026-1118itsourcecode Society Management System add_activity.php sql injectionitsourcecode Society Management System
- CVE-2025-15537Mapnik dbfile.cpp string_value heap-based overflowMapnik
- CVE-2025-15536BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflowBYVoid OpenCC · opencc
- CVE-2025-15535nicbarker clay clay.h Clay__MeasureTextCached null pointer dereferencenicbarker clay
- CVE-2025-15534raysan5 raylib rtext.c LoadFontData integer overflowraysan5 raylib
- CVE-2026-1112Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationSanluan PublicCMS
- CVE-2026-1111Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalSanluan PublicCMS
- CVE-2025-15533raysan5 raylib rtext.c GenImageFontAtlas heap-based overflowraysan5 raylib
- CVE-2026-1110cijliu librtsp rtsp_parse_method buffer overflowcijliu librtsp
- CVE-2026-1109cijliu librtsp rtsp_parse_request buffer overflowcijliu librtsp
- CVE-2026-1108cijliu librtsp rtsp_rely_dumps buffer overflowcijliu librtsp
- CVE-2026-1107EyouCMS Member Avatar Diyajax.php check_userinfo unrestricted uploadEyouCMS
- CVE-2026-1106Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorizationChamilo LMS