# CVEs published 2026-01-20

233 CVEs were published on January 20, 2026: 14 critical, 69 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-0933](https://cve.now/CVE-2026-0933.md): OS Command Injection in \`wrangler pages deploy\` (CVSS 7.7, Cloudflare Wrangler · wrangler)
- [CVE-2026-21990](https://cve.now/CVE-2026-21990.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2026-21989](https://cve.now/CVE-2026-21989.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2026-21988](https://cve.now/CVE-2026-21988.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2026-21987](https://cve.now/CVE-2026-21987.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2026-21986](https://cve.now/CVE-2026-21986.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.1, Oracle VM VirtualBox)
- [CVE-2026-21985](https://cve.now/CVE-2026-21985.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-21984](https://cve.now/CVE-2026-21984.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-21983](https://cve.now/CVE-2026-21983.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-21982](https://cve.now/CVE-2026-21982.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-21981](https://cve.now/CVE-2026-21981.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.6, Oracle VM VirtualBox)
- [CVE-2026-21980](https://cve.now/CVE-2026-21980.md): Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform). (CVSS 6.5, Oracle Life Sciences Central Coding)
- [CVE-2026-21979](https://cve.now/CVE-2026-21979.md): Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). (CVSS 4.2, Oracle Planning and Budgeting Cloud Service)
- [CVE-2026-21978](https://cve.now/CVE-2026-21978.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing). (CVSS 6.5, Oracle FLEXCUBE Universal Banking)
- [CVE-2026-21977](https://cve.now/CVE-2026-21977.md): Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Secur (CVSS 3.1, Oracle Zero Data Loss Recovery Appliance Software)
- [CVE-2026-21976](https://cve.now/CVE-2026-21976.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud). (CVSS 7.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-21975](https://cve.now/CVE-2026-21975.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 4.5, Oracle Database Server)
- [CVE-2026-21974](https://cve.now/CVE-2026-21974.md): Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). (CVSS 5.3, Oracle Life Sciences Central Designer)
- [CVE-2026-21973](https://cve.now/CVE-2026-21973.md): Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Security Management Sy (CVSS 8.1, Oracle FLEXCUBE Investor Servicing)
- [CVE-2026-21972](https://cve.now/CVE-2026-21972.md): Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). (CVSS 5.3, Oracle Configurator)
- [CVE-2026-21971](https://cve.now/CVE-2026-21971.md): Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). (CVSS 5.4, Oracle PeopleSoft Enterprise SCM Purchasing)
- [CVE-2026-21970](https://cve.now/CVE-2026-21970.md): Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). (CVSS 6.5, Oracle Life Sciences Central Designer)
- [CVE-2026-21969](https://cve.now/CVE-2026-21969.md): Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). (CVSS 9.8, Oracle Agile Product Lifecycle Management for Process)
- [CVE-2026-21968](https://cve.now/CVE-2026-21968.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2026-21967](https://cve.now/CVE-2026-21967.md): Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). (CVSS 8.6, Oracle Hospitality OPERA)
- [CVE-2026-21966](https://cve.now/CVE-2026-21966.md): Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). (CVSS 6.1, Oracle Hospitality OPERA 5 Property Services)
- [CVE-2026-21965](https://cve.now/CVE-2026-21965.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2026-21964](https://cve.now/CVE-2026-21964.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2026-21963](https://cve.now/CVE-2026-21963.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-21962](https://cve.now/CVE-2026-21962.md): Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Serve (CVSS 10.0, KEV, Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in)
- [CVE-2026-21961](https://cve.now/CVE-2026-21961.md): Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Empl (CVSS 6.1, Oracle PeopleSoft Enterprise HCM Human Resources)
- [CVE-2026-21960](https://cve.now/CVE-2026-21960.md): Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). (CVSS 6.5, Oracle Applications DBA)
- [CVE-2026-21959](https://cve.now/CVE-2026-21959.md): Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). (CVSS 4.9, Oracle Workflow)
- [CVE-2026-21957](https://cve.now/CVE-2026-21957.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-21956](https://cve.now/CVE-2026-21956.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2026-21955](https://cve.now/CVE-2026-21955.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2026-21952](https://cve.now/CVE-2026-21952.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2026-21951](https://cve.now/CVE-2026-21951.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). (CVSS 6.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-21950](https://cve.now/CVE-2026-21950.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2026-21949](https://cve.now/CVE-2026-21949.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2026-21948](https://cve.now/CVE-2026-21948.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2026-21947](https://cve.now/CVE-2026-21947.md): Vulnerability in Oracle Java SE (component: JavaFX). (CVSS 3.1, Oracle Java SE)
- [CVE-2026-21946](https://cve.now/CVE-2026-21946.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-21945](https://cve.now/CVE-2026-21945.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit (CVSS 7.5, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2026-21944](https://cve.now/CVE-2026-21944.md): Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage (CVSS 6.5, Oracle Agile Product Lifecycle Management for Process)
- [CVE-2026-21943](https://cve.now/CVE-2026-21943.md): Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). (CVSS 6.1, Oracle Scripting)
- [CVE-2026-21942](https://cve.now/CVE-2026-21942.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). (CVSS 5.0, Oracle Solaris)
- [CVE-2026-21941](https://cve.now/CVE-2026-21941.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2026-21940](https://cve.now/CVE-2026-21940.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). (CVSS 7.5, Oracle Agile PLM)
- [CVE-2026-21939](https://cve.now/CVE-2026-21939.md): Vulnerability in the SQLcl component of Oracle Database Server. (CVSS 7.0, Oracle Database Server)
- [CVE-2026-21938](https://cve.now/CVE-2026-21938.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (CVSS 6.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-21937](https://cve.now/CVE-2026-21937.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2026-21936](https://cve.now/CVE-2026-21936.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2026-21935](https://cve.now/CVE-2026-21935.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). (CVSS 5.8, Oracle Solaris)
- [CVE-2026-21934](https://cve.now/CVE-2026-21934.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). (CVSS 5.4, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-21933](https://cve.now/CVE-2026-21933.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Network (CVSS 6.1, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2026-21932](https://cve.now/CVE-2026-21932.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, Ja (CVSS 7.4, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2026-21931](https://cve.now/CVE-2026-21931.md): Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). (CVSS 5.4, Oracle APEX Sample Applications)
- [CVE-2026-21930](https://cve.now/CVE-2026-21930.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). (CVSS 2.3, Oracle ZFS Storage Appliance Kit)
- [CVE-2026-21929](https://cve.now/CVE-2026-21929.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). (CVSS 5.3, Oracle MySQL Server)
- [CVE-2026-21928](https://cve.now/CVE-2026-21928.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.3, Oracle Solaris)
- [CVE-2026-21927](https://cve.now/CVE-2026-21927.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). (CVSS 5.8, Oracle Solaris)
- [CVE-2026-21926](https://cve.now/CVE-2026-21926.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-21925](https://cve.now/CVE-2026-21925.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). (CVSS 4.8, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2026-21924](https://cve.now/CVE-2026-21924.md): Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General). (CVSS 5.4, Oracle Utilities Application Framework)
- [CVE-2026-21923](https://cve.now/CVE-2026-21923.md): Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). (CVSS 6.5, Oracle Life Sciences Central Designer)
- [CVE-2026-21922](https://cve.now/CVE-2026-21922.md): Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). (CVSS 4.2, Oracle Planning and Budgeting Cloud Service)
- [CVE-2026-0672](https://cve.now/CVE-2026-0672.md): Header injection in http.cookies.Morsel (CVSS 6.0, Python Software Foundation CPython)
- [CVE-2025-15367](https://cve.now/CVE-2025-15367.md): POP3 command injection in user-controlled commands (CVSS 5.9, Python Software Foundation CPython)
- [CVE-2025-15366](https://cve.now/CVE-2025-15366.md): IMAP command injection in user-controlled commands (CVSS 5.9, Python Software Foundation CPython)
- [CVE-2025-58744](https://cve.now/CVE-2025-58744.md): Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture (CVSS 6.9, Milner ImageDirector Capture)
- [CVE-2025-58743](https://cve.now/CVE-2025-58743.md): Insecure Encryption Algorithms Enable Brute-Force Database Credential Access in Milner ImageDirector Capture (CVSS 7.2, Milner ImageDirector Capture)
- [CVE-2025-58742](https://cve.now/CVE-2025-58742.md): Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture (CVSS 8.5, Milner ImageDirector Capture)
- [CVE-2025-58741](https://cve.now/CVE-2025-58741.md): Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture (CVSS 8.5, Milner ImageDirector Capture)
- [CVE-2025-58740](https://cve.now/CVE-2025-58740.md): Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture (CVSS 8.5, Milner ImageDirector Capture)
- [CVE-2025-15282](https://cve.now/CVE-2025-15282.md): Header injection via newlines in data URL mediatype (CVSS 6.0, Python Software Foundation CPython)
- [CVE-2026-0865](https://cve.now/CVE-2026-0865.md): wsgiref.headers.Headers allows header newline injection (CVSS 5.9, Python Software Foundation CPython)
- [CVE-2025-11468](https://cve.now/CVE-2025-11468.md): Folding email comments of unfoldable characters doesn't preserve parenthesis (CVSS 5.7, Python Software Foundation CPython)
- [CVE-2026-21642](https://cve.now/CVE-2026-21642.md): HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the \`banner-acl.php\` and \`channel-acl.php\` scrip (CVSS 6.1, Revive Adserver)
- [CVE-2026-21664](https://cve.now/CVE-2026-21664.md): HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Rev (CVSS 6.1, Revive Adserver)
- [CVE-2026-21663](https://cve.now/CVE-2026-21663.md): HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. (CVSS 6.1, Revive Adserver)
- [CVE-2026-21640](https://cve.now/CVE-2026-21640.md): HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. (CVSS 2.7, Revive Adserver)
- [CVE-2026-21641](https://cve.now/CVE-2026-21641.md): HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the \`tracker-delete.php\` script of Re (CVSS 7.1, Revive Adserver)
- [CVE-2026-21636](https://cve.now/CVE-2026-21636.md): A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when \`--permission\` is enabl (CVSS 5.8, nodejs node)
- [CVE-2025-59466](https://cve.now/CVE-2025-59466.md): We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when \`async\_hooks.crea (CVSS 5.9, nodejs node)
- [CVE-2025-55132](https://cve.now/CVE-2025-55132.md): A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via \`futimes()\` even when the process (CVSS 2.8, nodejs node)
- [CVE-2025-59464](https://cve.now/CVE-2025-59464.md): A memory leak in Node.js’s OpenSSL integration occurs when converting \`X.509\` certificate fields to UTF-8 without freeing the allocated buff (CVSS 6.5, nodejs node)
- [CVE-2025-55131](https://cve.now/CVE-2025-55131.md): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the \`vm\` module wit (CVSS 7.1, nodejs node)
- [CVE-2025-55130](https://cve.now/CVE-2025-55130.md): A flaw in Node.js’s Permissions model allows attackers to bypass \`--allow-fs-read\` and \`--allow-fs-write\` restrictions using crafted relativ (CVSS 7.1, nodejs node)
- [CVE-2026-21637](https://cve.now/CVE-2026-21637.md): A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when \`pskCallback\` or \`ALPNCallba (CVSS 5.9, nodejs node)
- [CVE-2025-59465](https://cve.now/CVE-2025-59465.md): A malformed \`HTTP/2 HEADERS\` frame with oversized, invalid \`HPACK\` data can cause Node.js to crash by triggering an unhandled \`TLSSocket\` er (CVSS 7.5, nodejs node)
- [CVE-2026-0622](https://cve.now/CVE-2026-0622.md): Open 5GS WebUI uses a hard-coded JWT signing key (CVSS 6.5, NewPlane open5GS)
- [CVE-2026-1245](https://cve.now/CVE-2026-1245.md): CVE-2026-1245 (CVSS 6.5, binary-parser)
- [CVE-2025-33231](https://cve.now/CVE-2025-33231.md): NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncon (CVSS 6.7, NVIDIA CUDA Toolkit)
- [CVE-2025-33230](https://cve.now/CVE-2025-33230.md): NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by sup (CVSS 7.3, NVIDIA CUDA Toolkit)
- [CVE-2025-33229](https://cve.now/CVE-2025-33229.md): NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the sam (CVSS 7.3, NVIDIA CUDA Toolkit)
- [CVE-2025-33228](https://cve.now/CVE-2025-33228.md): NVIDIA Nsight Systems contains a vulnerability in the gfx\_hotspot recipe, where an attacker could cause an OS command injection by supplying (CVSS 7.3, NVIDIA CUDA Toolkit)
- [CVE-2025-33233](https://cve.now/CVE-2025-33233.md): NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. (CVSS 7.8, NVIDIA Merlin Transformers4Rec)
- [CVE-2025-36419](https://cve.now/CVE-2025-36419.md): Multiple vulnerabilities found in IBM ApplinX. (CVSS 5.3, IBM ApplinX)
- [CVE-2025-36418](https://cve.now/CVE-2025-36418.md): Multiple vulnerabilities found in IBM ApplinX. (CVSS 7.3, IBM ApplinX)
- [CVE-2025-36411](https://cve.now/CVE-2025-36411.md): Multiple vulnerabilities found in IBM ApplinX. (CVSS 3.5, IBM ApplinX)
- [CVE-2025-36410](https://cve.now/CVE-2025-36410.md): Multiple vulnerabilities found in IBM ApplinX. (CVSS 3.1, IBM ApplinX)
- [CVE-2025-36409](https://cve.now/CVE-2025-36409.md): Multiple vulnerabilities found in IBM ApplinX. (CVSS 5.4, IBM ApplinX)
- [CVE-2025-36408](https://cve.now/CVE-2025-36408.md): Multiple vulnerabilities found in IBM ApplinX. (CVSS 6.4, IBM ApplinX)
- [CVE-2025-36397](https://cve.now/CVE-2025-36397.md): Security vulnerabilities have been found in IBM Application Gateway (CVSS 5.4, IBM Application Gateway)
- [CVE-2025-36396](https://cve.now/CVE-2025-36396.md): Security vulnerabilities have been found in IBM Application Gateway (CVSS 5.4, IBM Application Gateway)
- [CVE-2025-36115](https://cve.now/CVE-2025-36115.md): Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX. (CVSS 6.3, IBM Sterling Connect:Express Adapter for Sterling B2B Integ…)
- [CVE-2025-36113](https://cve.now/CVE-2025-36113.md): Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX. (CVSS 5.4, IBM Sterling Connect:Express Adapter for Sterling B2B Integ…)
- [CVE-2025-36066](https://cve.now/CVE-2025-36066.md): Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX. (CVSS 6.1, IBM Sterling Connect:Express Adapter for Sterling B2B Integ…)
- [CVE-2025-36065](https://cve.now/CVE-2025-36065.md): Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX. (CVSS 6.3, IBM Sterling Connect:Express Adapter for Sterling B2B Integ…)
- [CVE-2025-36063](https://cve.now/CVE-2025-36063.md): Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX. (CVSS 6.3, IBM Sterling Connect:Express Adapter for Sterling B2B Integ…)
- [CVE-2025-36058](https://cve.now/CVE-2025-36058.md): Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025 (CVSS 5.5, IBM Business Automation Workflow containers)
- [CVE-2025-36059](https://cve.now/CVE-2025-36059.md): Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025 (CVSS 4.7, IBM Business Automation Workflow containers)
- [CVE-2025-33015](https://cve.now/CVE-2025-33015.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 8.8, IBM Concert)
- [CVE-2025-1722](https://cve.now/CVE-2025-1722.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.9, IBM Concert)
- [CVE-2025-1719](https://cve.now/CVE-2025-1719.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.9, IBM Concert)
- [CVE-2025-14115](https://cve.now/CVE-2025-14115.md): IBM Sterling Connect:Direct for UNIX Container is affected by vulnerability where hard-coded credentials are embeeded in the product for its internal use. (CVSS 8.4, IBM Sterling Connect:Direct for UNIX Container)
- [CVE-2025-13925](https://cve.now/CVE-2025-13925.md): Multiple vulnerabilities in IBM Aspera Console (CVSS 4.9, IBM Aspera Console)
- [CVE-2025-12985](https://cve.now/CVE-2025-12985.md): License Service: Privilege escalation vulnerability (CVSS 8.4, IBM Licensing Operator)
- [CVE-2025-54817](https://cve.now/CVE-2025-54817.md): A reflected cross-site scripting (xss) vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-53516](https://cve.now/CVE-2025-53516.md): A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54495](https://cve.now/CVE-2025-54495.md): A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54157](https://cve.now/CVE-2025-54157.md): A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54778](https://cve.now/CVE-2025-54778.md): A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-46270](https://cve.now/CVE-2025-46270.md): A reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-55071](https://cve.now/CVE-2025-55071.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54852](https://cve.now/CVE-2025-54852.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54814](https://cve.now/CVE-2025-54814.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54861](https://cve.now/CVE-2025-54861.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-57881](https://cve.now/CVE-2025-57881.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyEmail functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58080](https://cve.now/CVE-2025-58080.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7App functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-53854](https://cve.now/CVE-2025-53854.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-57787](https://cve.now/CVE-2025-57787.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-53707](https://cve.now/CVE-2025-53707.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-54853](https://cve.now/CVE-2025-54853.md): A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-57786](https://cve.now/CVE-2025-57786.md): A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-44000](https://cve.now/CVE-2025-44000.md): A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58095](https://cve.now/CVE-2025-58095.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58094](https://cve.now/CVE-2025-58094.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58093](https://cve.now/CVE-2025-58093.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58092](https://cve.now/CVE-2025-58092.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58091](https://cve.now/CVE-2025-58091.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58090](https://cve.now/CVE-2025-58090.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58089](https://cve.now/CVE-2025-58089.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58088](https://cve.now/CVE-2025-58088.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-58087](https://cve.now/CVE-2025-58087.md): Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-36556](https://cve.now/CVE-2025-36556.md): A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-53912](https://cve.now/CVE-2025-53912.md): An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. (CVSS 9.6, MedDream PACS Premium)
- [CVE-2026-0554](https://cve.now/CVE-2026-0554.md): NotificationX \<= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset (CVSS 4.3, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2025-15380](https://cve.now/CVE-2025-15380.md): NotificationX \<= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview' (CVSS 7.2, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2026-0608](https://cve.now/CVE-2026-0608.md): Head Meta Data \<= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (CVSS 6.4, specialk Head Meta Data)
- [CVE-2025-15347](https://cve.now/CVE-2025-15347.md): Creator LMS – The LMS for Creators, Coaches, and Trainers \<= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update (CVSS 8.8, getwpfunnels Creator LMS – Online Courses and eLearning Plu…)
- [CVE-2025-15043](https://cve.now/CVE-2025-15043.md): The Events Calendar \<= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control (CVSS 5.4, stellarwp The Events Calendar)
- [CVE-2026-0690](https://cve.now/CVE-2026-0690.md): FlatPM – Ad Manager, AdSense and Custom Code \<= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta (CVSS 6.4, flatboy FlatPM – Ad Manager, AdSense and Custom Code)
- [CVE-2026-0548](https://cve.now/CVE-2026-0548.md): Tutor LMS – eLearning and online course solution \<= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion (CVSS 5.4, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-0726](https://cve.now/CVE-2026-0726.md): Nexter Extension – Site Enhancements Toolkit \<= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt\_unserialize\_replace' (CVSS 8.1, posimyththemes Nexter Extension – Security, Performance, Co…)
- [CVE-2025-9283](https://cve.now/CVE-2025-9283.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-9282](https://cve.now/CVE-2025-9282.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-9281](https://cve.now/CVE-2025-9281.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2026-22844](https://cve.now/CVE-2026-22844.md): Zoom Node Deployments - Command Injection (CVSS 9.9, Zoom Communications Zoom Node)
- [CVE-2025-9280](https://cve.now/CVE-2025-9280.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-14027](https://cve.now/CVE-2025-14027.md): Rockwell Automation Recommends Upgrading From 1756-RM2 XT To 1756-RM3 XT (CVSS 8.7, Rockwell Automation ControlLogix® Redundancy Enhanced Module)
- [CVE-2025-9279](https://cve.now/CVE-2025-9279.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-9278](https://cve.now/CVE-2025-9278.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-9466](https://cve.now/CVE-2025-9466.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-11743](https://cve.now/CVE-2025-11743.md): Rockwell Automation CompactLogix® 5370 Denial of Service Vulnerability (CVSS 7.1, Rockwell Automation CompactLogix®)
- [CVE-2025-9465](https://cve.now/CVE-2025-9465.md): ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-9464](https://cve.now/CVE-2025-9464.md): Rockwell Automation ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities (CVSS 8.7, Rockwell Automation ArmorStart® LT)
- [CVE-2025-15281](https://cve.now/CVE-2025-15281.md): wordexp with WRDE\_REUSE and WRDE\_APPEND may return uninitialized memory (CVSS 7.5, The GNU C Library glibc)
- [CVE-2025-14377](https://cve.now/CVE-2025-14377.md): Verve Asset Manager – Plaintext Storage Vulnerabilities (CVSS 8.8, Rockwell Automation Verve Asset Manager)
- [CVE-2025-14376](https://cve.now/CVE-2025-14376.md): Verve Asset Manager – Plaintext Storage Vulnerabilities (CVSS 8.6, Rockwell Automation Verve Asset Manager)
- [CVE-2026-1180](https://cve.now/CVE-2026-1180.md): Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks\_uri (CVSS 5.8, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2025-41081](https://cve.now/CVE-2025-41081.md): Reflected Cross-Site Scripting (XSS) in IsMyGym (CVSS 5.1, Zuinq Studio IsMyGym)
- [CVE-2026-1183](https://cve.now/CVE-2026-1183.md): HTML injection in multiple Botble products (CVSS 5.1, Botble TransP · Botble Athena +2)
- [CVE-2025-41025](https://cve.now/CVE-2025-41025.md): Stored Cross-Site Scripting in Poultry Farm Management System (CVSS 5.1, Poultry Farm Management System)
- [CVE-2025-40679](https://cve.now/CVE-2025-40679.md): HTML injection in Isshue from Bdtask (CVSS 5.1, Bdtask Isshue)
- [CVE-2025-14369](https://cve.now/CVE-2025-14369.md): CVE-2025-14369 (CVSS 5.5, mackron dr\_flac)
- [CVE-2025-41024](https://cve.now/CVE-2025-41024.md): Stored Cross-Site Scripting in Poultry Farm Management System (CVSS 5.1, Poultry Farm Management System)
- [CVE-2025-40644](https://cve.now/CVE-2025-40644.md): Reflected Cross-Site Scripting (XSS) in QRGen's Riftzilla (CVSS 5.1, Riftzilla QRGen)
- [CVE-2025-14533](https://cve.now/CVE-2025-14533.md): Advanced Custom Fields: Extended \<= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action (CVSS 9.8, hwk-fr Advanced Custom Fields: Extended)
- [CVE-2025-41084](https://cve.now/CVE-2025-41084.md): Stored Cross-Site Scripting (XSS) in Sesame web application (CVSS 5.1, SESAME LABS S.L Sesame)
- [CVE-2025-41768](https://cve.now/CVE-2025-41768.md): Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server (CVSS 5.5, Beckhoff Automation TwinCAT.HMI.Server · Beckhoff Automatio…)
- [CVE-2026-0895](https://cve.now/CVE-2026-0895.md): Insecure Deserialization in extension "Mailqueue" (mailqueue) (CVSS 5.2, TYPO3 Extension "Mailqueue" · cpsit/typo3-mailqueue)
- [CVE-2025-66523](https://cve.now/CVE-2025-66523.md): Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters (CVSS 6.1, Foxit Software na1.foxitesign.foxit.com)
- [CVE-2026-1223](https://cve.now/CVE-2026-1223.md): BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials (CVSS 6.9, BROWAN COMMUNICATIONS PrismX MX100 AP controller)
- [CVE-2026-1222](https://cve.now/CVE-2026-1222.md): BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Arbitrary File Upload (CVSS 8.6, BROWAN COMMUNICATIONS PrismX MX100 AP controller)
- [CVE-2026-1221](https://cve.now/CVE-2026-1221.md): BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials (CVSS 9.3, BROWAN COMMUNICATIONS PrismX MX100 AP controller)
- [CVE-2025-12573](https://cve.now/CVE-2025-12573.md): Bookingor \<= 1.0.12 - Subscriber+ Category Deletion (CVSS 6.5, Bookingor)
- [CVE-2026-1218](https://cve.now/CVE-2026-1218.md): Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference (CVSS 5.3, Bjskzy Zhiyou ERP)
- [CVE-2026-1042](https://cve.now/CVE-2026-1042.md): WP Hello Bar \<= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit\_one' and 'digit\_two' Parameters (CVSS 4.4, norcross WP Hello Bar)
- [CVE-2026-1045](https://cve.now/CVE-2026-1045.md): Viet contact \<= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters (CVSS 4.4, nhomcaodem Viet contact)
- [CVE-2025-14348](https://cve.now/CVE-2025-14348.md): weMail \<= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure (CVSS 5.3, wedevs weMail: Email Marketing, Email Automation, Newslette…)
- [CVE-2025-14977](https://cve.now/CVE-2025-14977.md): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy \<= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure (CVSS 8.1, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-0908](https://cve.now/CVE-2026-0908.md): Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-0907](https://cve.now/CVE-2026-0907.md): Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted H (CVSS 9.8, Google Chrome)
- [CVE-2026-0906](https://cve.now/CVE-2026-0906.md): Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (UR (CVSS 9.8, Google Chrome)
- [CVE-2026-0905](https://cve.now/CVE-2026-0905.md): Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to pote (CVSS 9.8, Google Chrome)
- [CVE-2026-0904](https://cve.now/CVE-2026-0904.md): Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing vi (CVSS 5.4, Google Chrome)
- [CVE-2026-0903](https://cve.now/CVE-2026-0903.md): Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous f (CVSS 5.4, Google Chrome)
- [CVE-2026-0902](https://cve.now/CVE-2026-0902.md): Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read (CVSS 8.8, Google Chrome)
- [CVE-2026-0901](https://cve.now/CVE-2026-0901.md): Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing vi (CVSS 5.4, Google Chrome)
- [CVE-2026-0900](https://cve.now/CVE-2026-0900.md): Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruptio (CVSS 8.8, Google Chrome)
- [CVE-2026-0899](https://cve.now/CVE-2026-0899.md): Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption (CVSS 8.8, Google Chrome)
- [CVE-2025-14798](https://cve.now/CVE-2025-14798.md): LearnPress – WordPress LMS Plugin \<= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2025-14351](https://cve.now/CVE-2025-14351.md): Custom Fonts – Host Your Fonts Locally \<= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion (CVSS 5.3, brainstormforce Custom Fonts – Host Your Fonts Locally)
- [CVE-2026-1051](https://cve.now/CVE-2026-1051.md): Newsletter – Send awesome emails from WordPress \<= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription (CVSS 4.3, satollo Newsletter – Send awesome emails from WordPress)
- [CVE-2025-14978](https://cve.now/CVE-2025-14978.md): PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) \<= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification (CVSS 5.3, PeachPay — Payments & Express Checkout for WooCommerce)
- [CVE-2026-1203](https://cve.now/CVE-2026-1203.md): CRMEB JSON Token LoginServices.php remoteRegister improper authentication (CVSS 6.3, CRMEB)
- [CVE-2026-1202](https://cve.now/CVE-2026-1202.md): CRMEB LoginController.php appleLogin improper authentication (CVSS 6.9, CRMEB)
- [CVE-2026-23876](https://cve.now/CVE-2026-23876.md): Heap buffer overflow with attacker-controlled data in XBM parser (CVSS 8.1, ImageMagick)
- [CVE-2026-23874](https://cve.now/CVE-2026-23874.md): ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript (CVSS 5.5, ImageMagick · Magick.NET-Q8-x64 +17)
- [CVE-2026-22770](https://cve.now/CVE-2026-22770.md): ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails (CVSS 6.5, ImageMagick · Magick.NET-Q8-x64 +18)
- [CVE-2026-23950](https://cve.now/CVE-2026-23950.md): node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS (CVSS 8.8, isaacs node-tar · tar)
- [CVE-2026-23949](https://cve.now/CVE-2026-23949.md): jaraco.context Has a Path Traversal Vulnerability (CVSS 8.6, jaraco.context · jaraco-context)
- [CVE-2026-1197](https://cve.now/CVE-2026-1197.md): MineAdmin downloadById information disclosure (CVSS 2.3, MineAdmin)
- [CVE-2026-1196](https://cve.now/CVE-2026-1196.md): MineAdmin getFileInfoById information disclosure (CVSS 2.3, MineAdmin · mineadmin/mineadmin)
- [CVE-2026-23947](https://cve.now/CVE-2026-23947.md): Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation (CVSS 9.3, orval-labs orval · @orval/core)
- [CVE-2026-1195](https://cve.now/CVE-2026-1195.md): MineAdmin JWT Token refresh data authenticity (CVSS 2.3, MineAdmin · mineadmin/mineadmin)
- [CVE-2025-55423](https://cve.now/CVE-2025-55423.md): A command injection vulnerability exists in the upnp\_relay() function in multiple ipTIME router models because the controlURL value used to (CVSS 9.8)
- [CVE-2025-56005](https://cve.now/CVE-2025-56005.md): An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the \`picklefile\` paramet (CVSS 9.8)
- [CVE-2025-56353](https://cve.now/CVE-2025-56353.md): In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), a memory leak occurs due to the broker's failure to validate or re (CVSS 7.5)
- [CVE-2025-57155](https://cve.now/CVE-2025-57155.md): NULL pointer dereference in the daap\_reply\_groups function in src/httpd\_daap.c in owntone-server through commit 5e6f19a (newer commit after (CVSS 7.5)
- [CVE-2025-57156](https://cve.now/CVE-2025-57156.md): NULL pointer dereference in the dacp\_reply\_playqueueedit\_clear function in src/httpd\_dacp.c in owntone-server through commit 6d604a1 (newer (CVSS 7.5)
- [CVE-2025-63647](https://cve.now/CVE-2025-63647.md): A NULL pointer dereference in the parse\_meta function (src/httpd\_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial (CVSS 7.5)
- [CVE-2025-63648](https://cve.now/CVE-2025-63648.md): A NULL pointer dereference in the dacp\_reply\_playqueueedit\_move function (src/httpd\_dacp.c) of owntone-server commit b7e385f allows attacker (CVSS 7.5)
- [CVE-2025-64087](https://cve.now/CVE-2025-64087.md): A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers (CVSS 9.8, fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.…)
- [CVE-2025-65482](https://cve.now/CVE-2025-65482.md): An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadin (CVSS 9.8, fr.opensagres.xdocreport:fr.opensagres.xdocreport.document)
- [CVE-2025-66692](https://cve.now/CVE-2025-66692.md): A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial (CVSS 7.5)
- [CVE-2025-66803](https://cve.now/CVE-2025-66803.md): Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame respons (CVSS 4.8, @hotwired/turbo)
- [CVE-2025-66902](https://cve.now/CVE-2025-66902.md): An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpect (CVSS 7.5)
- [CVE-2025-67261](https://cve.now/CVE-2025-67261.md): Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. (CVSS 6.5)
- [CVE-2025-67263](https://cve.now/CVE-2025-67263.md): Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. (CVSS 6.1)
- [CVE-2025-67824](https://cve.now/CVE-2025-67824.md): The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inj (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.