# CVEs published 2026-01-18

29 CVEs were published on January 18, 2026: 0 critical, 2 high. Days are UTC.

- [CVE-2025-15539](https://cve.now/CVE-2025-15539.md): Open5GS sgwc s11-handler.c sgwc\_s11\_handle\_downlink\_data\_notification\_ack denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-23829](https://cve.now/CVE-2026-23829.md): Mailpit has SMTP Header Injection via Regex Bypass (CVSS 5.3, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2025-15538](https://cve.now/CVE-2025-15538.md): Open Asset Import Library Assimp LWOMaterial.cpp FindUVChannels use after free (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2026-23733](https://cve.now/CVE-2026-23733.md): Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) (CVSS 6.4, lobehub lobe-chat · @lobehub/chat)
- [CVE-2026-23644](https://cve.now/CVE-2026-23644.md): esm.sh has path traversal in \`extractPackageTarball\` that enables file writes from malicious packages (CVSS 7.7, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2026-23626](https://cve.now/CVE-2026-23626.md): Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI) (CVSS 6.8, kimai · kimai/kimai)
- [CVE-2026-23525](https://cve.now/CVE-2026-23525.md): 1panel App Store vulnerable to Cross-site Scripting (CVSS 6.4, 1Panel-dev 1Panel)
- [CVE-2026-1126](https://cve.now/CVE-2026-1126.md): lwj flow SVG File FormResource.java uploadFile unrestricted upload (CVSS 5.3, lwj flow)
- [CVE-2026-1125](https://cve.now/CVE-2026-1125.md): D-Link DIR-823X set\_wifidog\_settings sub\_412E7C command injection (CVSS 6.9, D-Link DIR-823X)
- [CVE-2026-0863](https://cve.now/CVE-2026-0863.md): Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host. (CVSS 8.5, n8n)
- [CVE-2026-1124](https://cve.now/CVE-2026-1124.md): Yonyou KSOA HTTP GET Parameter work\_report.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1123](https://cve.now/CVE-2026-1123.md): Yonyou KSOA HTTP GET Parameter work\_mod.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1122](https://cve.now/CVE-2026-1122.md): Yonyou KSOA HTTP GET Parameter work\_info.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1121](https://cve.now/CVE-2026-1121.md): Yonyou KSOA HTTP GET Parameter del\_workplan.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1120](https://cve.now/CVE-2026-1120.md): Yonyou KSOA HTTP GET Parameter del\_work.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1119](https://cve.now/CVE-2026-1119.md): itsourcecode Society Management System delete\_activity.php sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2026-1118](https://cve.now/CVE-2026-1118.md): itsourcecode Society Management System add\_activity.php sql injection (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2025-15537](https://cve.now/CVE-2025-15537.md): Mapnik dbfile.cpp string\_value heap-based overflow (CVSS 4.8, Mapnik)
- [CVE-2025-15536](https://cve.now/CVE-2025-15536.md): BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow (CVSS 4.8, BYVoid OpenCC · opencc)
- [CVE-2025-15535](https://cve.now/CVE-2025-15535.md): nicbarker clay clay.h Clay\_\_MeasureTextCached null pointer dereference (CVSS 4.8, nicbarker clay)
- [CVE-2025-15534](https://cve.now/CVE-2025-15534.md): raysan5 raylib rtext.c LoadFontData integer overflow (CVSS 4.8, raysan5 raylib)
- [CVE-2026-1112](https://cve.now/CVE-2026-1112.md): Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization (CVSS 5.3, Sanluan PublicCMS)
- [CVE-2026-1111](https://cve.now/CVE-2026-1111.md): Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal (CVSS 5.1, Sanluan PublicCMS)
- [CVE-2025-15533](https://cve.now/CVE-2025-15533.md): raysan5 raylib rtext.c GenImageFontAtlas heap-based overflow (CVSS 4.8, raysan5 raylib)
- [CVE-2026-1110](https://cve.now/CVE-2026-1110.md): cijliu librtsp rtsp\_parse\_method buffer overflow (CVSS 4.8, cijliu librtsp)
- [CVE-2026-1109](https://cve.now/CVE-2026-1109.md): cijliu librtsp rtsp\_parse\_request buffer overflow (CVSS 4.8, cijliu librtsp)
- [CVE-2026-1108](https://cve.now/CVE-2026-1108.md): cijliu librtsp rtsp\_rely\_dumps buffer overflow (CVSS 4.8, cijliu librtsp)
- [CVE-2026-1107](https://cve.now/CVE-2026-1107.md): EyouCMS Member Avatar Diyajax.php check\_userinfo unrestricted upload (CVSS 5.3, EyouCMS)
- [CVE-2026-1106](https://cve.now/CVE-2026-1106.md): Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization (CVSS 5.3, Chamilo LMS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.