CVEs published January 19, 2026
113 CVEs were published on January 19, 2026: 10 critical, 39 high.
- Published
- 113
- Critical
- 10
- High
- 39
- Medium
- 54
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- FreeRDP
- 8
- Yonyou KSOA
- 8
- birkir prime
- 7
- HCL Software AION
- 7
- Totolink LR350
- 6
- UTT 进取
- 4
- leepeuker movary
- 3
- opf openproject
- 3
- siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- 3
- SourceCodester Patients Waiting Area Queue Management Syste…
- 3
Critical 10
- CVE-2026-23837MyTube has an Authorization Bypass vulnerabilityfranklioxygen MyTube
- CVE-2026-23841Movary vulnerable to Cross-site Scripting with `?categoryCreated=` paramleepeuker movary
- CVE-2026-23840Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` paramleepeuker movary
- CVE-2026-23839Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` paramleepeuker movary
- CVE-2026-23836HotCRP vulnerable to remote code execution through formulaskohler hotcrp
- CVE-2026-1162UTT HiPER 810 setSysAdm strcpy buffer overflowUTT HiPER
- CVE-2025-11043Improper Server Certificate Validation in Automation StudioB&R Industrial Automation B&R Automation Studio
- CVE-2026-0610SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12Devolutions Server
- CVE-2026-1181Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace AccessAltium
- CVE-2026-22797An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.1OpenStack keystonemiddleware
High 39
- CVE-2026-22219Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/elementChainlit
- CVE-2026-22218Chainlit < 2.9.4 Arbitrary File Read via /project/elementChainlit
- CVE-2026-23944Arcane allows unauthenticated proxy access to remote environmentsgetarcaneapp arcane
- CVE-2026-23880OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take OverHackUCF OnboardLite
- CVE-2026-23851SiYuan Vulnerable to Arbitrary File Read via File Copy Functionalitysiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-23850SiYuan vulnerable to arbitrary file readsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-23846Tugtainer vulnerable to Password Exposure via URL Query ParameterQuenary tugtainer
- CVE-2026-21696Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being consideredpterodactyl wings · github.com/pterodactyl/wings
- CVE-2025-69199Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstancespterodactyl panel · github.com/pterodactyl/wings
- CVE-2026-23843teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offerssibercii6-crypto teklifolustur_app
- CVE-2026-23842ChatterBot has Denial of Service via Database Connection Pool Exhaustiongunthercox ChatterBot · chatterbot
- CVE-2026-23838Tandoor Recipes module allows SQLite database to be externally accessible with the default settingsNixOS nixpkgs
- CVE-2026-23625OpenProject has stored XSS regression using attachments and script-src selfopf openproject
- CVE-2026-23884Heap-use-after-free in gdi_set_boundsFreeRDP
- CVE-2026-23883Heap-use-after-free in update_pointer_newFreeRDP
- CVE-2026-23534FreeRDP has heap-buffer-overflow in clear_decompress_bands_dataFreeRDP
- CVE-2026-23533FreeRDP has heap-buffer-overflow in clear_decompress_residual_dataFreeRDP
- CVE-2026-23532FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurfaceFreeRDP
- CVE-2026-23531FreeRDP has heap-buffer-overflow in clear_decompressFreeRDP
- CVE-2026-23530FreeRDP has heap-buffer-overflow in planar_decompress_plane_rleFreeRDP
- CVE-2026-22850Koko Analytics vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL importibericode koko-analytics
- CVE-2026-22037@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)fastify-express · @fastify/express
- CVE-2025-11044Vulnerability on Automation Runtime my cause DoS ConditionsB&R Industrial Automation Automation Runtime
- CVE-2026-22031Fastify Middie Middleware Path Bypassfastify middie · @fastify/middie
- CVE-2025-68616WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP RedirectKozea WeasyPrint · weasyprint
- CVE-2025-61684Quicly has assertion failuresh2o quicly
- CVE-2026-1158Totolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflowTotolink LR350
- CVE-2026-1007Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issueDevolutions Server
- CVE-2026-21618Cross-site scripting (XSS) in OAuth Device Authorization screenhexpm
- CVE-2026-1157Totolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflowTotolink LR350
- CVE-2026-1156Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowTotolink LR350
- CVE-2026-1155Totolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflowTotolink LR350
- CVE-2025-29847Apache Linkis: Arbitrary File Read via Double URL Encoding BypassApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2026-1143TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflowTOTOLINK A3700R
- CVE-2026-1140UTT 进取 520W ConfigExceptAli strcpy buffer overflowUTT 进取
- CVE-2026-1139UTT 进取 520W ConfigExceptMSN strcpy buffer overflowUTT 进取
- CVE-2026-1138UTT 进取 520W ConfigExceptQQ strcpy buffer overflowUTT 进取
- CVE-2026-1137UTT 进取 520W formWebAuthGlobalConfig strcpy buffer overflowUTT 进取
- CVE-2026-0943HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerabilityJV HarfBuzz::Shaper
Medium, low and unrated 64
- CVE-2026-1194MineAdmin Swagger information disclosureMineAdmin · mineadmin/mineadmin
- CVE-2025-15466Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Managementwpchill Image Photo Gallery Final Tiles Grid
- CVE-2026-1193MineAdmin View view improper authorizationMineAdmin · mineadmin/mineadmin
- CVE-2026-1192Tosei Online Store Management System ネット店舗管理システム imode_alldata.php command injectionTosei Online Store Management System ネット店舗管理システム
- CVE-2026-1179Yonyou KSOA HTTP GET Parameter user_popedom.jsp sql injectionYonyou KSOA
- CVE-2026-1178Yonyou KSOA HTTP GET Parameter select.jsp sql injectionYonyou KSOA
- CVE-2026-1177Yonyou KSOA HTTP GET Parameter save_folder.jsp sql injectionYonyou KSOA
- CVE-2026-23885AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperAlchemyCMS alchemy_cms · alchemy_cms
- CVE-2026-1176itsourcecode School Management System index.php sql injectionitsourcecode School Management System
- CVE-2026-23886Swift W3C TraceContext has malformed HTTP header that can cause a crashswift-otel swift-w3c-trace-context
- CVE-2026-23877Directory Traversal & Filesystem can be accessed by a non-admin userswingmx swingmusic · swingmusic
- CVE-2026-23875CrawlChat's Discord Bot has a Knowledge Permission vulnerabilitycrawlchat
- CVE-2026-23844Whisper Money has IDOR Vulnerability on sync/balances endpointwhisper-money
- CVE-2026-23849File Browser vulnerable to Username Enumeration via Timing Attack in /api/loginfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-23848MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofingfranklioxygen MyTube
- CVE-2026-1175birkir prime GraphQL Directive graphql information exposurebirkir prime
- CVE-2026-1174birkir prime GraphQL Alias graphql resource consumptionbirkir prime
- CVE-2026-23852SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attributesiyuan-note siyuan
- CVE-2026-23847SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIconsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-1173birkir prime GraphQL Array Based Query Batch graphql denial of servicebirkir prime
- CVE-2025-69198Pterodactyl's improper resource locking allows raced queries to create more resources than allotedpterodactyl panel · pterodactyl/panel
- CVE-2026-1172birkir prime GraphQL Directive graphql denial of servicebirkir prime
- CVE-2026-23845Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check APIaxllent mailpit · github.com/axllent/mailpit
- CVE-2026-1171birkir prime GraphQL Field graphql denial of servicebirkir prime
- CVE-2025-55252HCL AION is affected by a Weak Password Policy vulnerabilityHCL Software AION
- CVE-2025-55250HCL AION is affected by a Technical Error Disclosure vulnerabilityHCL Software AION
- CVE-2026-23878HotCRP vulnerable to exposure of submitted documentskohler hotcrp
- CVE-2025-52661HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability.HCL Software AION
- CVE-2026-1170birkir prime GraphQL API graphql information disclosurebirkir prime
- CVE-2025-55249HCL AION is affected by a Missing Security Response Headers vulnerability.HCL Software AION
- CVE-2026-23833ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API componentesphome
- CVE-2025-52659HCL AION is affected by a Cacheable HTTP Response vulnerabilityHCL Software AION
- CVE-2026-23721OpenProject users with "View Members" permission in any project can view all Group membershipsopf openproject
- CVE-2025-52660HCL AION is affected by an Host Header Injection vulnerabilityHCL Software AION
- CVE-2026-23646OpenProject users can delete other user's session, causing them to be logged outopf openproject
- CVE-2025-55251HCL AION is affected by an Unrestricted File Upload vulnerabilityHCL Software AION
- CVE-2026-1169birkir prime cross-site request forgerybirkir prime
- CVE-2026-23732FreeRDP has heap-buffer-overflow in Glyph_AllocFreeRDP
- CVE-2026-23522Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletionlobehub lobe-chat · @lobehub/chat
- CVE-2026-1161pbrong hrms recruitment.go UpdateRecruitmentById cross site scriptingpbrong hrms
- CVE-2026-1160PHPGurukul Directory Management System Search index.php sql injectionPHPGurukul Directory Management System
- CVE-2026-1159itsourcecode Online Frozen Foods Ordering System order_online.php sql injectionitsourcecode Online Frozen Foods Ordering System
- CVE-2026-1154SourceCodester E-Learning System Lesson index.php cross site scriptingSourceCodester E-Learning System
- CVE-2026-1153technical-laohu mpay cross-site request forgerytechnical-laohu mpay
- CVE-2026-1152technical-laohu mpay QR Code Image unrestricted uploadtechnical-laohu mpay
- CVE-2026-1151technical-laohu mpay User Center cross site scriptingtechnical-laohu mpay
- CVE-2026-1150Totolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injectionTotolink LR350
- CVE-2026-1149Totolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injectionTotolink LR350
- CVE-2026-1148SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgerySourceCodester Patients Waiting Area Queue Management Syste…
- CVE-2026-1147SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scriptingSourceCodester Patients Waiting Area Queue Management Syste…
- CVE-2025-59355Apache Linkis: Password ExposureApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2026-1146SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scriptingSourceCodester Patients Waiting Area Queue Management Syste…
- CVE-2026-1145quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflowquickjs-ng quickjs
- CVE-2026-1144quickjs-ng quickjs Atomics Ops quickjs.c use after freequickjs-ng quickjs
- CVE-2026-1142PHPGurukul News Portal cross-site request forgeryPHPGurukul News Portal
- CVE-2026-1141PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorizationPHPGurukul News Portal
- CVE-2026-1136lcg0124 BootDo ContentController save cross site scriptinglcg0124 BootDo
- CVE-2026-1135itsourcecode Society Management System activity.php cross site scriptingitsourcecode Society Management System
- CVE-2026-1134itsourcecode Society Management System expenses.php cross site scriptingitsourcecode Society Management System
- CVE-2026-1133Yonyou KSOA HTTP GET Parameter folder.jsp sql injectionYonyou KSOA
- CVE-2026-1132Yonyou KSOA HTTP GET Parameter edit_folder.jsp sql injectionYonyou KSOA
- CVE-2026-1131Yonyou KSOA HTTP GET Parameter save_catalog.jsp sql injectionYonyou KSOA
- CVE-2026-1130Yonyou KSOA HTTP GET Parameter worksadd_plan.jsp sql injectionYonyou KSOA
- CVE-2026-1129Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injectionYonyou KSOA