CVEs published January 20, 2026
233 CVEs were published on January 20, 2026: 14 critical, 69 high. 1 is now in CISA KEV.
- Published
- 233
- Critical
- 14
- High
- 69
- Medium
- 139
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 58
Most affected products
- MedDream PACS Premium
- 29
- Oracle VM VirtualBox
- 14
- Google Chrome
- 10
- Oracle MySQL Server
- 10
- Rockwell Automation ArmorStart® LT
- 9
- nodejs node
- 8
- IBM ApplinX
- 6
- Python Software Foundation CPython
- 6
- IBM Sterling Connect:Express Adapter for Sterling B2B Integ…
- 5
- Milner ImageDirector Capture
- 5
Critical 14
- CVE-2026-21969Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal).Oracle Agile Product Lifecycle Management for Process
- CVE-2026-21962Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic ServeOracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
- CVE-2025-53912An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2026-22844Zoom Node Deployments - Command InjectionZoom Communications Zoom Node
- CVE-2025-14533Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Actionhwk-fr Advanced Custom Fields: Extended
- CVE-2026-1221BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded CredentialsBROWAN COMMUNICATIONS PrismX MX100 AP controller
- CVE-2026-0907Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HGoogle Chrome
- CVE-2026-0906Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URGoogle Chrome
- CVE-2026-0905Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to poteGoogle Chrome
- CVE-2026-23947Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationorval-labs orval · @orval/core
- CVE-2025-55423A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to
- CVE-2025-56005An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` paramet
- CVE-2025-64087A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackersfr.opensagres.xdocreport:fr.opensagres.xdocreport.template.…
- CVE-2025-65482An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadinfr.opensagres.xdocreport:fr.opensagres.xdocreport.document
High 69
- CVE-2026-0933OS Command Injection in `wrangler pages deploy`Cloudflare Wrangler · wrangler
- CVE-2026-21990Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21989Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21988Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21987Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21986Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21984Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21983Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21982Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21976Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud).Oracle Business Intelligence Enterprise Edition
- CVE-2026-21973Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Security Management SyOracle FLEXCUBE Investor Servicing
- CVE-2026-21967Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).Oracle Hospitality OPERA
- CVE-2026-21957Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21956Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21955Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21945Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SecuritOracle Java SE · Oracle GraalVM for JDK +1
- CVE-2026-21940Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group).Oracle Agile PLM
- CVE-2026-21939Vulnerability in the SQLcl component of Oracle Database Server.Oracle Database Server
- CVE-2026-21932Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JaOracle Java SE · Oracle GraalVM for JDK +1
- CVE-2026-21926Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).Oracle Siebel CRM Deployment
- CVE-2025-58743Insecure Encryption Algorithms Enable Brute-Force Database Credential Access in Milner ImageDirector CaptureMilner ImageDirector Capture
- CVE-2025-58742Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector CaptureMilner ImageDirector Capture
- CVE-2025-58741Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector CaptureMilner ImageDirector Capture
- CVE-2025-58740Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector CaptureMilner ImageDirector Capture
- CVE-2026-21641HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of ReRevive Adserver
- CVE-2025-55131A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module witnodejs node
- CVE-2025-55130A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativnodejs node
- CVE-2025-59465A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` ernodejs node
- CVE-2025-33230NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supNVIDIA CUDA Toolkit
- CVE-2025-33229NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the samNVIDIA CUDA Toolkit
- CVE-2025-33228NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplyingNVIDIA CUDA Toolkit
- CVE-2025-33233NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection.NVIDIA Merlin Transformers4Rec
- CVE-2025-36418Multiple vulnerabilities found in IBM ApplinX.IBM ApplinX
- CVE-2025-33015Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-14115IBM Sterling Connect:Direct for UNIX Container is affected by vulnerability where hard-coded credentials are embeeded in the product for its internal use.IBM Sterling Connect:Direct for UNIX Container
- CVE-2025-12985License Service: Privilege escalation vulnerabilityIBM Licensing Operator
- CVE-2025-15380NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2025-15347Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Updategetwpfunnels Creator LMS – Online Courses and eLearning Plu…
- CVE-2026-0726Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'posimyththemes Nexter Extension – Security, Performance, Co…
- CVE-2025-9283ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-9282ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-9281ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-9280ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-14027Rockwell Automation Recommends Upgrading From 1756-RM2 XT To 1756-RM3 XTRockwell Automation ControlLogix® Redundancy Enhanced Module
- CVE-2025-9279ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-9278ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-9466ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-11743Rockwell Automation CompactLogix® 5370 Denial of Service VulnerabilityRockwell Automation CompactLogix®
- CVE-2025-9465ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-9464Rockwell Automation ArmorStart® LT - Multiple Denial-of-Service VulnerabilitiesRockwell Automation ArmorStart® LT
- CVE-2025-15281wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memoryThe GNU C Library glibc
- CVE-2025-14377Verve Asset Manager – Plaintext Storage VulnerabilitiesRockwell Automation Verve Asset Manager
- CVE-2025-14376Verve Asset Manager – Plaintext Storage VulnerabilitiesRockwell Automation Verve Asset Manager
- CVE-2026-1222BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Arbitrary File UploadBROWAN COMMUNICATIONS PrismX MX100 AP controller
- CVE-2025-14977Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosuredokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…
- CVE-2026-0908Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2026-0902Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory readGoogle Chrome
- CVE-2026-0900Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruptioGoogle Chrome
- CVE-2026-0899Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruptionGoogle Chrome
- CVE-2026-23876Heap buffer overflow with attacker-controlled data in XBM parserImageMagick
- CVE-2026-23950node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSisaacs node-tar · tar
- CVE-2026-23949jaraco.context Has a Path Traversal Vulnerabilityjaraco.context · jaraco-context
- CVE-2025-56353In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), a memory leak occurs due to the broker's failure to validate or re
- CVE-2025-57155NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after
- CVE-2025-57156NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer
- CVE-2025-63647A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial
- CVE-2025-63648A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attacker
- CVE-2025-66692A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial
- CVE-2025-66902An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpect
Medium, low and unrated 150
- CVE-2026-21985Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21981Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21980Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform).Oracle Life Sciences Central Coding
- CVE-2026-21979Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent).Oracle Planning and Budgeting Cloud Service
- CVE-2026-21978Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing).Oracle FLEXCUBE Universal Banking
- CVE-2026-21977Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: SecurOracle Zero Data Loss Recovery Appliance Software
- CVE-2026-21975Vulnerability in the Java VM component of Oracle Database Server.Oracle Database Server
- CVE-2026-21974Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).Oracle Life Sciences Central Designer
- CVE-2026-21972Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface).Oracle Configurator
- CVE-2026-21971Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing).Oracle PeopleSoft Enterprise SCM Purchasing
- CVE-2026-21970Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).Oracle Life Sciences Central Designer
- CVE-2026-21968Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2026-21966Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).Oracle Hospitality OPERA 5 Property Services
- CVE-2026-21965Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).Oracle MySQL Server
- CVE-2026-21964Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).Oracle MySQL Server
- CVE-2026-21963Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2026-21961Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, EmplOracle PeopleSoft Enterprise HCM Human Resources
- CVE-2026-21960Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils).Oracle Applications DBA
- CVE-2026-21959Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader).Oracle Workflow
- CVE-2026-21952Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).Oracle MySQL Server
- CVE-2026-21951Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-21950Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2026-21949Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2026-21948Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2026-21947Vulnerability in Oracle Java SE (component: JavaFX).Oracle Java SE
- CVE-2026-21946Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2026-21944Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageOracle Agile Product Lifecycle Management for Process
- CVE-2026-21943Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin).Oracle Scripting
- CVE-2026-21942Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems).Oracle Solaris
- CVE-2026-21941Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2026-21938Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-21937Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2026-21936Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2026-21935Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver).Oracle Solaris
- CVE-2026-21934Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-21933Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: NetworkOracle Java SE · Oracle GraalVM for JDK +1
- CVE-2026-21931Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App).Oracle APEX Sample Applications
- CVE-2026-21930Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems).Oracle ZFS Storage Appliance Kit
- CVE-2026-21929Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).Oracle MySQL Server
- CVE-2026-21928Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris
- CVE-2026-21927Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver).Oracle Solaris
- CVE-2026-21925Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI).Oracle Java SE · Oracle GraalVM for JDK +1
- CVE-2026-21924Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General).Oracle Utilities Application Framework
- CVE-2026-21923Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).Oracle Life Sciences Central Designer
- CVE-2026-21922Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent).Oracle Planning and Budgeting Cloud Service
- CVE-2026-0672Header injection in http.cookies.MorselPython Software Foundation CPython
- CVE-2025-15367POP3 command injection in user-controlled commandsPython Software Foundation CPython
- CVE-2025-15366IMAP command injection in user-controlled commandsPython Software Foundation CPython
- CVE-2025-58744Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector CaptureMilner ImageDirector Capture
- CVE-2025-15282Header injection via newlines in data URL mediatypePython Software Foundation CPython
- CVE-2026-0865wsgiref.headers.Headers allows header newline injectionPython Software Foundation CPython
- CVE-2025-11468Folding email comments of unfoldable characters doesn't preserve parenthesisPython Software Foundation CPython
- CVE-2026-21642HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripRevive Adserver
- CVE-2026-21664HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of RevRevive Adserver
- CVE-2026-21663HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver.Revive Adserver
- CVE-2026-21640HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings.Revive Adserver
- CVE-2026-21636A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enablnodejs node
- CVE-2025-59466We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.creanodejs node
- CVE-2025-55132A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process nodejs node
- CVE-2025-59464A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffnodejs node
- CVE-2026-21637A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallbanodejs node
- CVE-2026-0622Open 5GS WebUI uses a hard-coded JWT signing keyNewPlane open5GS
- CVE-2026-1245CVE-2026-1245binary-parser
- CVE-2025-33231NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an unconNVIDIA CUDA Toolkit
- CVE-2025-36419Multiple vulnerabilities found in IBM ApplinX.IBM ApplinX
- CVE-2025-36411Multiple vulnerabilities found in IBM ApplinX.IBM ApplinX
- CVE-2025-36410Multiple vulnerabilities found in IBM ApplinX.IBM ApplinX
- CVE-2025-36409Multiple vulnerabilities found in IBM ApplinX.IBM ApplinX
- CVE-2025-36408Multiple vulnerabilities found in IBM ApplinX.IBM ApplinX
- CVE-2025-36397Security vulnerabilities have been found in IBM Application GatewayIBM Application Gateway
- CVE-2025-36396Security vulnerabilities have been found in IBM Application GatewayIBM Application Gateway
- CVE-2025-36115Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.IBM Sterling Connect:Express Adapter for Sterling B2B Integ…
- CVE-2025-36113Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.IBM Sterling Connect:Express Adapter for Sterling B2B Integ…
- CVE-2025-36066Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.IBM Sterling Connect:Express Adapter for Sterling B2B Integ…
- CVE-2025-36065Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.IBM Sterling Connect:Express Adapter for Sterling B2B Integ…
- CVE-2025-36063Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.IBM Sterling Connect:Express Adapter for Sterling B2B Integ…
- CVE-2025-36058Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025IBM Business Automation Workflow containers
- CVE-2025-36059Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025IBM Business Automation Workflow containers
- CVE-2025-1722Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-1719Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-13925Multiple vulnerabilities in IBM Aspera ConsoleIBM Aspera Console
- CVE-2025-54817A reflected cross-site scripting (xss) vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-53516A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54495A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54157A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54778A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-46270A reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-55071A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54852A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54814A reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54861A reflected cross-site scripting (xss) vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-57881A reflected cross-site scripting (xss) vulnerability exists in the modifyEmail functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58080A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7App functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-53854A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-57787A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-53707A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-54853A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-57786A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-44000A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58095Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58094Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58093Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58092Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58091Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58090Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58089Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58088Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-58087Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2025-36556A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870.MedDream PACS Premium
- CVE-2026-0554NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Resetwpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2026-0608Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Metaspecialk Head Meta Data
- CVE-2025-15043The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Controlstellarwp The Events Calendar
- CVE-2026-0690FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Metaflatboy FlatPM – Ad Manager, AdSense and Custom Code
- CVE-2026-0548Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletionthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-1180Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2025-41081Reflected Cross-Site Scripting (XSS) in IsMyGymZuinq Studio IsMyGym
- CVE-2026-1183HTML injection in multiple Botble productsBotble TransP · Botble Athena +2
- CVE-2025-41025Stored Cross-Site Scripting in Poultry Farm Management SystemPoultry Farm Management System
- CVE-2025-40679HTML injection in Isshue from BdtaskBdtask Isshue
- CVE-2025-14369CVE-2025-14369mackron dr_flac
- CVE-2025-41024Stored Cross-Site Scripting in Poultry Farm Management SystemPoultry Farm Management System
- CVE-2025-40644Reflected Cross-Site Scripting (XSS) in QRGen's RiftzillaRiftzilla QRGen
- CVE-2025-41084Stored Cross-Site Scripting (XSS) in Sesame web applicationSESAME LABS S.L Sesame
- CVE-2025-41768Beckhoff: XSS Vulnerability in TwinCAT 3 HMI ServerBeckhoff Automation TwinCAT.HMI.Server · Beckhoff Automatio…
- CVE-2026-0895Insecure Deserialization in extension "Mailqueue" (mailqueue)TYPO3 Extension "Mailqueue" · cpsit/typo3-mailqueue
- CVE-2025-66523Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL ParametersFoxit Software na1.foxitesign.foxit.com
- CVE-2026-1223BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected CredentialsBROWAN COMMUNICATIONS PrismX MX100 AP controller
- CVE-2025-12573Bookingor <= 1.0.12 - Subscriber+ Category DeletionBookingor
- CVE-2026-1218Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity referenceBjskzy Zhiyou ERP
- CVE-2026-1042WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parametersnorcross WP Hello Bar
- CVE-2026-1045Viet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parametersnhomcaodem Viet contact
- CVE-2025-14348weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosurewedevs weMail: Email Marketing, Email Automation, Newslette…
- CVE-2026-0904Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing viGoogle Chrome
- CVE-2026-0903Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous fGoogle Chrome
- CVE-2026-0901Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing viGoogle Chrome
- CVE-2025-14798LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST APIthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2025-14351Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletionbrainstormforce Custom Fonts – Host Your Fonts Locally
- CVE-2026-1051Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscriptionsatollo Newsletter – Send awesome emails from WordPress
- CVE-2025-14978PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status ModificationPeachPay — Payments & Express Checkout for WooCommerce
- CVE-2026-1203CRMEB JSON Token LoginServices.php remoteRegister improper authenticationCRMEB
- CVE-2026-1202CRMEB LoginController.php appleLogin improper authenticationCRMEB
- CVE-2026-23874ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScriptImageMagick · Magick.NET-Q8-x64 +17
- CVE-2026-22770ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation failsImageMagick · Magick.NET-Q8-x64 +18
- CVE-2026-1197MineAdmin downloadById information disclosureMineAdmin
- CVE-2026-1196MineAdmin getFileInfoById information disclosureMineAdmin · mineadmin/mineadmin
- CVE-2026-1195MineAdmin JWT Token refresh data authenticityMineAdmin · mineadmin/mineadmin
- CVE-2025-66803Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame respons@hotwired/turbo
- CVE-2025-67261Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection.
- CVE-2025-67263Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module.
- CVE-2025-67824The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inj