# CVEs published 2026-01-19

113 CVEs were published on January 19, 2026: 10 critical, 39 high. Days are UTC.

- [CVE-2026-1194](https://cve.now/CVE-2026-1194.md): MineAdmin Swagger information disclosure (CVSS 6.9, MineAdmin · mineadmin/mineadmin)
- [CVE-2025-15466](https://cve.now/CVE-2025-15466.md): Image Photo Gallery Final Tiles Grid \<= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management (CVSS 5.4, wpchill Image Photo Gallery Final Tiles Grid)
- [CVE-2026-22219](https://cve.now/CVE-2026-22219.md): Chainlit \< 2.9.4 SQLAlchemy Data Layer SSRF via /project/element (CVSS 8.3, Chainlit)
- [CVE-2026-22218](https://cve.now/CVE-2026-22218.md): Chainlit \< 2.9.4 Arbitrary File Read via /project/element (CVSS 7.1, Chainlit)
- [CVE-2026-1193](https://cve.now/CVE-2026-1193.md): MineAdmin View view improper authorization (CVSS 5.3, MineAdmin · mineadmin/mineadmin)
- [CVE-2026-1192](https://cve.now/CVE-2026-1192.md): Tosei Online Store Management System ネット店舗管理システム imode\_alldata.php command injection (CVSS 6.9, Tosei Online Store Management System ネット店舗管理システム)
- [CVE-2026-1179](https://cve.now/CVE-2026-1179.md): Yonyou KSOA HTTP GET Parameter user\_popedom.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1178](https://cve.now/CVE-2026-1178.md): Yonyou KSOA HTTP GET Parameter select.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1177](https://cve.now/CVE-2026-1177.md): Yonyou KSOA HTTP GET Parameter save\_folder.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-23944](https://cve.now/CVE-2026-23944.md): Arcane allows unauthenticated proxy access to remote environments (CVSS 8.0, getarcaneapp arcane)
- [CVE-2026-23885](https://cve.now/CVE-2026-23885.md): AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper (CVSS 6.4, AlchemyCMS alchemy\_cms · alchemy\_cms)
- [CVE-2026-1176](https://cve.now/CVE-2026-1176.md): itsourcecode School Management System index.php sql injection (CVSS 6.9, itsourcecode School Management System)
- [CVE-2026-23886](https://cve.now/CVE-2026-23886.md): Swift W3C TraceContext has malformed HTTP header that can cause a crash (CVSS 5.3, swift-otel swift-w3c-trace-context)
- [CVE-2026-23880](https://cve.now/CVE-2026-23880.md): OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over (CVSS 7.3, HackUCF OnboardLite)
- [CVE-2026-23877](https://cve.now/CVE-2026-23877.md): Directory Traversal & Filesystem can be accessed by a non-admin user (CVSS 5.3, swingmx swingmusic · swingmusic)
- [CVE-2026-23875](https://cve.now/CVE-2026-23875.md): CrawlChat's Discord Bot has a Knowledge Permission vulnerability (CVSS 5.7, crawlchat)
- [CVE-2026-23844](https://cve.now/CVE-2026-23844.md): Whisper Money has IDOR Vulnerability on sync/balances endpoint (CVSS 4.9, whisper-money)
- [CVE-2026-23849](https://cve.now/CVE-2026-23849.md): File Browser vulnerable to Username Enumeration via Timing Attack in /api/login (CVSS 5.3, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-23848](https://cve.now/CVE-2026-23848.md): MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing (CVSS 6.5, franklioxygen MyTube)
- [CVE-2026-1175](https://cve.now/CVE-2026-1175.md): birkir prime GraphQL Directive graphql information exposure (CVSS 6.9, birkir prime)
- [CVE-2026-23837](https://cve.now/CVE-2026-23837.md): MyTube has an Authorization Bypass vulnerability (CVSS 9.8, franklioxygen MyTube)
- [CVE-2026-1174](https://cve.now/CVE-2026-1174.md): birkir prime GraphQL Alias graphql resource consumption (CVSS 6.9, birkir prime)
- [CVE-2026-23852](https://cve.now/CVE-2026-23852.md): SiYuan vulnerable to Stored XSS / RCE via \`setBlockAttrs\` icon attribute (CVSS 5.8, siyuan-note siyuan)
- [CVE-2026-23851](https://cve.now/CVE-2026-23851.md): SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality (CVSS 8.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-23850](https://cve.now/CVE-2026-23850.md): SiYuan vulnerable to arbitrary file read (CVSS 7.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-23847](https://cve.now/CVE-2026-23847.md): SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon (CVSS 2.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-23846](https://cve.now/CVE-2026-23846.md): Tugtainer vulnerable to Password Exposure via URL Query Parameter (CVSS 8.1, Quenary tugtainer)
- [CVE-2026-1173](https://cve.now/CVE-2026-1173.md): birkir prime GraphQL Array Based Query Batch graphql denial of service (CVSS 6.9, birkir prime)
- [CVE-2026-21696](https://cve.now/CVE-2026-21696.md): Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered (CVSS 8.3, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2025-69199](https://cve.now/CVE-2025-69199.md): Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances (CVSS 8.3, pterodactyl panel · github.com/pterodactyl/wings)
- [CVE-2025-69198](https://cve.now/CVE-2025-69198.md): Pterodactyl's improper resource locking allows raced queries to create more resources than alloted (CVSS 6.0, pterodactyl panel · pterodactyl/panel)
- [CVE-2026-1172](https://cve.now/CVE-2026-1172.md): birkir prime GraphQL Directive graphql denial of service (CVSS 6.9, birkir prime)
- [CVE-2026-23845](https://cve.now/CVE-2026-23845.md): Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API (CVSS 5.8, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-23843](https://cve.now/CVE-2026-23843.md): teklifolustur\_app's IDOR vulnerability allows unauthorized access to other users' offers (CVSS 7.1, sibercii6-crypto teklifolustur\_app)
- [CVE-2026-23842](https://cve.now/CVE-2026-23842.md): ChatterBot has Denial of Service via Database Connection Pool Exhaustion (CVSS 7.5, gunthercox ChatterBot · chatterbot)
- [CVE-2026-23841](https://cve.now/CVE-2026-23841.md): Movary vulnerable to Cross-site Scripting with \`?categoryCreated=\` param (CVSS 9.3, leepeuker movary)
- [CVE-2026-23840](https://cve.now/CVE-2026-23840.md): Movary vulnerable to Cross-site Scripting with \`?categoryDeleted=\` param (CVSS 9.3, leepeuker movary)
- [CVE-2026-1171](https://cve.now/CVE-2026-1171.md): birkir prime GraphQL Field graphql denial of service (CVSS 6.9, birkir prime)
- [CVE-2026-23839](https://cve.now/CVE-2026-23839.md): Movary vulnerable to Cross-site Scripting with \`?categoryUpdated=\` param (CVSS 9.3, leepeuker movary)
- [CVE-2026-23838](https://cve.now/CVE-2026-23838.md): Tandoor Recipes module allows SQLite database to be externally accessible with the default settings (CVSS 8.7, NixOS nixpkgs)
- [CVE-2025-55252](https://cve.now/CVE-2025-55252.md): HCL AION is affected by a Weak Password Policy vulnerability (CVSS 3.1, HCL Software AION)
- [CVE-2025-55250](https://cve.now/CVE-2025-55250.md): HCL AION is affected by a Technical Error Disclosure vulnerability (CVSS 1.8, HCL Software AION)
- [CVE-2026-23878](https://cve.now/CVE-2026-23878.md): HotCRP vulnerable to exposure of submitted documents (CVSS 6.5, kohler hotcrp)
- [CVE-2026-23836](https://cve.now/CVE-2026-23836.md): HotCRP vulnerable to remote code execution through formulas (CVSS 10.0, kohler hotcrp)
- [CVE-2025-52661](https://cve.now/CVE-2025-52661.md): HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. (CVSS 2.4, HCL Software AION)
- [CVE-2026-1170](https://cve.now/CVE-2026-1170.md): birkir prime GraphQL API graphql information disclosure (CVSS 6.9, birkir prime)
- [CVE-2025-55249](https://cve.now/CVE-2025-55249.md): HCL AION is affected by a Missing Security Response Headers vulnerability. (CVSS 3.5, HCL Software AION)
- [CVE-2026-23833](https://cve.now/CVE-2026-23833.md): ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component (CVSS 1.7, esphome)
- [CVE-2025-52659](https://cve.now/CVE-2025-52659.md): HCL AION is affected by a Cacheable HTTP Response vulnerability (CVSS 2.8, HCL Software AION)
- [CVE-2026-23721](https://cve.now/CVE-2026-23721.md): OpenProject users with "View Members" permission in any project can view all Group memberships (CVSS 4.3, opf openproject)
- [CVE-2025-52660](https://cve.now/CVE-2025-52660.md): HCL AION is affected by an Host Header Injection vulnerability (CVSS 2.7, HCL Software AION)
- [CVE-2026-23646](https://cve.now/CVE-2026-23646.md): OpenProject users can delete other user's session, causing them to be logged out (CVSS 6.5, opf openproject)
- [CVE-2026-23625](https://cve.now/CVE-2026-23625.md): OpenProject has stored XSS regression using attachments and script-src self (CVSS 8.7, opf openproject)
- [CVE-2025-55251](https://cve.now/CVE-2025-55251.md): HCL AION is affected by an Unrestricted File Upload vulnerability (CVSS 3.1, HCL Software AION)
- [CVE-2026-1169](https://cve.now/CVE-2026-1169.md): birkir prime cross-site request forgery (CVSS 5.3, birkir prime)
- [CVE-2026-23884](https://cve.now/CVE-2026-23884.md): Heap-use-after-free in gdi\_set\_bounds (CVSS 7.7, FreeRDP)
- [CVE-2026-23883](https://cve.now/CVE-2026-23883.md): Heap-use-after-free in update\_pointer\_new (CVSS 7.7, FreeRDP)
- [CVE-2026-23732](https://cve.now/CVE-2026-23732.md): FreeRDP has heap-buffer-overflow in Glyph\_Alloc (CVSS 5.5, FreeRDP)
- [CVE-2026-23534](https://cve.now/CVE-2026-23534.md): FreeRDP has heap-buffer-overflow in clear\_decompress\_bands\_data (CVSS 7.7, FreeRDP)
- [CVE-2026-23533](https://cve.now/CVE-2026-23533.md): FreeRDP has heap-buffer-overflow in clear\_decompress\_residual\_data (CVSS 7.7, FreeRDP)
- [CVE-2026-23532](https://cve.now/CVE-2026-23532.md): FreeRDP has heap-buffer-overflow in gdi\_SurfaceToSurface (CVSS 7.7, FreeRDP)
- [CVE-2026-23531](https://cve.now/CVE-2026-23531.md): FreeRDP has heap-buffer-overflow in clear\_decompress (CVSS 7.7, FreeRDP)
- [CVE-2026-23530](https://cve.now/CVE-2026-23530.md): FreeRDP has heap-buffer-overflow in planar\_decompress\_plane\_rle (CVSS 7.7, FreeRDP)
- [CVE-2026-23522](https://cve.now/CVE-2026-23522.md): Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion (CVSS 3.7, lobehub lobe-chat · @lobehub/chat)
- [CVE-2026-22850](https://cve.now/CVE-2026-22850.md): Koko Analytics vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import (CVSS 8.4, ibericode koko-analytics)
- [CVE-2026-22037](https://cve.now/CVE-2026-22037.md): @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) (CVSS 8.4, fastify-express · @fastify/express)
- [CVE-2026-1162](https://cve.now/CVE-2026-1162.md): UTT HiPER 810 setSysAdm strcpy buffer overflow (CVSS 9.3, UTT HiPER)
- [CVE-2026-1161](https://cve.now/CVE-2026-1161.md): pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting (CVSS 5.1, pbrong hrms)
- [CVE-2025-11044](https://cve.now/CVE-2025-11044.md): Vulnerability on Automation Runtime my cause DoS Conditions (CVSS 8.9, B&R Industrial Automation Automation Runtime)
- [CVE-2025-11043](https://cve.now/CVE-2025-11043.md): Improper Server Certificate Validation in Automation Studio (CVSS 9.1, B&R Industrial Automation B&R Automation Studio)
- [CVE-2026-1160](https://cve.now/CVE-2026-1160.md): PHPGurukul Directory Management System Search index.php sql injection (CVSS 6.9, PHPGurukul Directory Management System)
- [CVE-2026-22031](https://cve.now/CVE-2026-22031.md): Fastify Middie Middleware Path Bypass (CVSS 8.4, fastify middie · @fastify/middie)
- [CVE-2025-68616](https://cve.now/CVE-2025-68616.md): WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect (CVSS 7.5, Kozea WeasyPrint · weasyprint)
- [CVE-2025-61684](https://cve.now/CVE-2025-61684.md): Quicly has assertion failures (CVSS 7.5, h2o quicly)
- [CVE-2026-1159](https://cve.now/CVE-2026-1159.md): itsourcecode Online Frozen Foods Ordering System order\_online.php sql injection (CVSS 6.9, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2026-1158](https://cve.now/CVE-2026-1158.md): Totolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflow (CVSS 8.7, Totolink LR350)
- [CVE-2026-1007](https://cve.now/CVE-2026-1007.md): Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue (CVSS 7.6, Devolutions Server)
- [CVE-2026-0610](https://cve.now/CVE-2026-0610.md): SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 (CVSS 9.8, Devolutions Server)
- [CVE-2026-21618](https://cve.now/CVE-2026-21618.md): Cross-site scripting (XSS) in OAuth Device Authorization screen (CVSS 8.5, hexpm)
- [CVE-2026-1157](https://cve.now/CVE-2026-1157.md): Totolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflow (CVSS 8.7, Totolink LR350)
- [CVE-2026-1156](https://cve.now/CVE-2026-1156.md): Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflow (CVSS 8.7, Totolink LR350)
- [CVE-2026-1155](https://cve.now/CVE-2026-1155.md): Totolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflow (CVSS 8.7, Totolink LR350)
- [CVE-2026-1154](https://cve.now/CVE-2026-1154.md): SourceCodester E-Learning System Lesson index.php cross site scripting (CVSS 5.3, SourceCodester E-Learning System)
- [CVE-2026-1153](https://cve.now/CVE-2026-1153.md): technical-laohu mpay cross-site request forgery (CVSS 5.3, technical-laohu mpay)
- [CVE-2026-1181](https://cve.now/CVE-2026-1181.md): Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access (CVSS 9.0, Altium)
- [CVE-2026-1152](https://cve.now/CVE-2026-1152.md): technical-laohu mpay QR Code Image unrestricted upload (CVSS 5.1, technical-laohu mpay)
- [CVE-2026-1151](https://cve.now/CVE-2026-1151.md): technical-laohu mpay User Center cross site scripting (CVSS 4.8, technical-laohu mpay)
- [CVE-2026-1150](https://cve.now/CVE-2026-1150.md): Totolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection (CVSS 5.3, Totolink LR350)
- [CVE-2026-1149](https://cve.now/CVE-2026-1149.md): Totolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection (CVSS 5.3, Totolink LR350)
- [CVE-2026-1148](https://cve.now/CVE-2026-1148.md): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery (CVSS 5.3, SourceCodester Patients Waiting Area Queue Management Syste…)
- [CVE-2026-1147](https://cve.now/CVE-2026-1147.md): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api\_patient\_schedule.php cross site scripting (CVSS 5.1, SourceCodester Patients Waiting Area Queue Management Syste…)
- [CVE-2025-59355](https://cve.now/CVE-2025-59355.md): Apache Linkis: Password Exposure (CVSS 6.5, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2025-29847](https://cve.now/CVE-2025-29847.md): Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass (CVSS 7.5, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2026-1146](https://cve.now/CVE-2026-1146.md): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api\_register\_patient.php cross site scripting (CVSS 5.1, SourceCodester Patients Waiting Area Queue Management Syste…)
- [CVE-2026-1145](https://cve.now/CVE-2026-1145.md): quickjs-ng quickjs quickjs.c js\_typed\_array\_constructor\_ta heap-based overflow (CVSS 5.3, quickjs-ng quickjs)
- [CVE-2026-1144](https://cve.now/CVE-2026-1144.md): quickjs-ng quickjs Atomics Ops quickjs.c use after free (CVSS 5.3, quickjs-ng quickjs)
- [CVE-2026-1143](https://cve.now/CVE-2026-1143.md): TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflow (CVSS 8.7, TOTOLINK A3700R)
- [CVE-2026-1142](https://cve.now/CVE-2026-1142.md): PHPGurukul News Portal cross-site request forgery (CVSS 5.3, PHPGurukul News Portal)
- [CVE-2026-1141](https://cve.now/CVE-2026-1141.md): PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization (CVSS 5.3, PHPGurukul News Portal)
- [CVE-2026-1140](https://cve.now/CVE-2026-1140.md): UTT 进取 520W ConfigExceptAli strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-1139](https://cve.now/CVE-2026-1139.md): UTT 进取 520W ConfigExceptMSN strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-1138](https://cve.now/CVE-2026-1138.md): UTT 进取 520W ConfigExceptQQ strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-1137](https://cve.now/CVE-2026-1137.md): UTT 进取 520W formWebAuthGlobalConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2026-1136](https://cve.now/CVE-2026-1136.md): lcg0124 BootDo ContentController save cross site scripting (CVSS 5.1, lcg0124 BootDo)
- [CVE-2026-1135](https://cve.now/CVE-2026-1135.md): itsourcecode Society Management System activity.php cross site scripting (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2026-0943](https://cve.now/CVE-2026-0943.md): HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability (CVSS 7.5, JV HarfBuzz::Shaper)
- [CVE-2026-1134](https://cve.now/CVE-2026-1134.md): itsourcecode Society Management System expenses.php cross site scripting (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2026-1133](https://cve.now/CVE-2026-1133.md): Yonyou KSOA HTTP GET Parameter folder.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1132](https://cve.now/CVE-2026-1132.md): Yonyou KSOA HTTP GET Parameter edit\_folder.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1131](https://cve.now/CVE-2026-1131.md): Yonyou KSOA HTTP GET Parameter save\_catalog.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1130](https://cve.now/CVE-2026-1130.md): Yonyou KSOA HTTP GET Parameter worksadd\_plan.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-1129](https://cve.now/CVE-2026-1129.md): Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-22797](https://cve.now/CVE-2026-22797.md): An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.1 (CVSS 9.9, OpenStack keystonemiddleware)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.