# CVEs published 2026-01-26

118 CVEs were published on January 26, 2026: 11 critical, 42 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-1449](https://cve.now/CVE-2026-1449.md): Hisense TransTech Smart Bus Management System TireMng.aspx Page\_Load sql injection (CVSS 6.9, Hisense TransTech Smart Bus Management System)
- [CVE-2026-1448](https://cve.now/CVE-2026-1448.md): D-Link DIR-615 Web Management wiz\_policy\_3\_machine.php os command injection (CVSS 8.6, D-Link DIR-615)
- [CVE-2026-24478](https://cve.now/CVE-2026-24478.md): AnythingLLM vulnerable to Path Traversal (CVSS 7.2, Mintplex-Labs anything-llm)
- [CVE-2026-24477](https://cve.now/CVE-2026-24477.md): AnythingLLM has key leak in \`systemSettings.js\` (CVSS 8.7, Mintplex-Labs anything-llm)
- [CVE-2025-30248](https://cve.now/CVE-2025-30248.md): DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary (CVSS 8.9, Western Digital WD Discovery)
- [CVE-2026-24476](https://cve.now/CVE-2026-24476.md): Shaarli vulnerable to stored XSS via Suggested Tags (CVSS 5.3, Shaarli)
- [CVE-2026-24470](https://cve.now/CVE-2026-24470.md): Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName (CVSS 8.1, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-24408](https://cve.now/CVE-2026-24408.md): sigstore has CSRF possibility in OIDC authentication during signing (CVSS 0.0, sigstore-python · sigstore)
- [CVE-2026-24400](https://cve.now/CVE-2026-24400.md): AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion (CVSS 8.2, assertj · org.assertj:assertj-core)
- [CVE-2026-24123](https://cve.now/CVE-2026-24123.md): BentoML has a Path Traversal via Bentofile Configuration (CVSS 7.4, BentoML)
- [CVE-2026-24003](https://cve.now/CVE-2026-24003.md): EvseV2G has sequence state validation bypass (CVSS 4.3, everest-core)
- [CVE-2026-24131](https://cve.now/CVE-2026-24131.md): pnpm has Path Traversal via arbitrary file permission modification (CVSS 6.7, pnpm)
- [CVE-2026-1445](https://cve.now/CVE-2026-1445.md): iJason-Liu Books\_Manager upload\_bookCover.php unrestricted upload (CVSS 5.1, iJason-Liu Books\_Manager)
- [CVE-2026-24056](https://cve.now/CVE-2026-24056.md): pnpm has symlink traversal in file:/git dependencies (CVSS 6.7, pnpm)
- [CVE-2026-23890](https://cve.now/CVE-2026-23890.md): pnpm scoped bin name Path Traversal allows arbitrary file creation outside node\_modules/.bin (CVSS 6.5, pnpm)
- [CVE-2026-23889](https://cve.now/CVE-2026-23889.md): pnpm has Windows-specific tarball Path Traversal (CVSS 6.5, pnpm)
- [CVE-2025-59472](https://cve.now/CVE-2025-59472.md): A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. (CVSS 5.9, vercel next · next)
- [CVE-2025-59471](https://cve.now/CVE-2025-59471.md): A denial of service vulnerability exists in self-hosted Next.js applications that have \`remotePatterns\` configured for the Image Optimizer. (CVSS 5.9, vercel next · next)
- [CVE-2025-59473](https://cve.now/CVE-2025-59473.md): SQL Injection vulnerability in the Structure for Admin authenticated user (CVSS 6.0, ExpressionEngine)
- [CVE-2026-23888](https://cve.now/CVE-2026-23888.md): pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) (CVSS 6.5, pnpm)
- [CVE-2026-1444](https://cve.now/CVE-2026-1444.md): iJason-Liu Books\_Manager add\_book\_check.php cross site scripting (CVSS 4.8, iJason-Liu Books\_Manager)
- [CVE-2026-22709](https://cve.now/CVE-2026-22709.md): vm2 has a Sandbox Escape (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-22696](https://cve.now/CVE-2026-22696.md): dcap-qvl has Missing Verification for QE Identity (CVSS 9.3, Phala-Network dcap-qvl · dcap-qvl +3)
- [CVE-2026-1443](https://cve.now/CVE-2026-1443.md): code-projects Online Music Site AdminDeleteUser.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2025-9820](https://cve.now/CVE-2025-9820.md): Gnutls: stack-based buffer overflow in gnutls\_pkcs11\_token\_init() function (CVSS 4.0, gnutls · Red Hat Enterprise Linux +8)
- [CVE-2025-9615](https://cve.now/CVE-2025-9615.md): Networkmanager: networkmanager file access (CVSS 3.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-1190](https://cve.now/CVE-2026-1190.md): Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata (CVSS 3.1, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-0810](https://cve.now/CVE-2026-0810.md): Gix-date: gix-date: undefined behavior due to invalid string generation (CVSS 7.1, GitoxideLabs gitoxide · Logging Subsystem for Red Hat Op… +2)
- [CVE-2025-14525](https://cve.now/CVE-2025-14525.md): Kubevirt: kubevirt: vm administration denial of service via guest agent (CVSS 6.4, Red Hat OpenShift Virtualization · kubevirt.io/kubevirt)
- [CVE-2025-14969](https://cve.now/CVE-2025-14969.md): Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect (CVSS 4.3, Red Hat build of Quarkus 3.27.2.redhat · Red Hat JBoss E… +2)
- [CVE-2025-14459](https://cve.now/CVE-2025-14459.md): Virt-cdi-controller: unauthorized pvc cloning via dataimportcron (CVSS 8.5, Red Hat RHEL-9-CNV-4.19 · Red Hat OpenShift Virtualization)
- [CVE-2025-11687](https://cve.now/CVE-2025-11687.md): Gi-docgen: reflected dom xss in gi-docgen (CVSS 6.1, gi-docgen)
- [CVE-2025-11065](https://cve.now/CVE-2025-11065.md): Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure (CVSS 5.3, github.com/go-viper/mapstructure/v2 · Red Hat OpenShift… +14)
- [CVE-2025-9522](https://cve.now/CVE-2025-9522.md): Blind Server-Side Request Forgery (SSRF) in Omada Controller (CVSS 5.1, TP-Link Systems Omada Controller)
- [CVE-2025-9521](https://cve.now/CVE-2025-9521.md): Password Confirmation Bypass in Omada Controller (CVSS 2.1, TP-Link Systems Omada Controller)
- [CVE-2025-9520](https://cve.now/CVE-2025-9520.md): IDOR Leading to Owner Account Hijacking in Omada Controller (CVSS 8.3, TP-Link Systems Omada Controller)
- [CVE-2026-23864](https://cve.now/CVE-2026-23864.md): Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reac (CVSS 7.5, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-14756](https://cve.now/CVE-2025-14756.md): Authenticated Command Injection Vulnerability in Archer MR600 (CVSS 8.5, TP-Link Systems Archer MR600)
- [CVE-2025-71178](https://cve.now/CVE-2025-71178.md): Crucial Storage Executive \< 11.08.082025.00 Installer DLL Preloading LPE (CVSS 7.1, Micron Technology Crucial Storage Executive)
- [CVE-2026-0925](https://cve.now/CVE-2026-0925.md): Tanium addressed an improper input validation vulnerability in Discover. (CVSS 2.7, Tanium Discover)
- [CVE-2026-24435](https://cve.now/CVE-2026-24435.md): Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access (CVSS 7.1, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24439](https://cve.now/CVE-2026-24439.md): Tenda W30E V2 Lacks X-Content-Type-Options Header (CVSS 2.1, Shenzhen Tenda Technology Co. W30E)
- [CVE-2025-57784](https://cve.now/CVE-2025-57784.md): Tomahawk authentication timing attack due to usage of 'strcmp' (CVSS 4.0, Hiawatha Web server)
- [CVE-2026-24432](https://cve.now/CVE-2026-24432.md): Tenda W30E V2 Missing CSRF Protections for Administrative Actions (CVSS 5.1, Shenzhen Tenda Technology Co. W30E)
- [CVE-2025-57785](https://cve.now/CVE-2025-57785.md): Double free in XSLT in 'show\_index' (CVSS 6.5, Hiawatha Web server)
- [CVE-2025-57783](https://cve.now/CVE-2025-57783.md): Improper header parsing may lead to request smuggling (CVSS 5.3, Hiawatha Web server)
- [CVE-2020-36960](https://cve.now/CVE-2020-36960.md): Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting (CVSS 5.1, Formalms Forma LMS)
- [CVE-2020-36959](https://cve.now/CVE-2020-36959.md): IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path (CVSS 8.5, IDT PC Audio)
- [CVE-2020-36958](https://cve.now/CVE-2020-36958.md): Kite 1.2020.1119.0 - 'KiteService' Unquoted Service Path (CVSS 8.5, Kite)
- [CVE-2020-36957](https://cve.now/CVE-2020-36957.md): PDF Complete 3.5.310.2002 - 'pdfsvc.exe' Unquoted Service Path (CVSS 8.5, Pdf-Complete PDF Complete)
- [CVE-2020-36956](https://cve.now/CVE-2020-36956.md): Openfire 4.6.0 - 'path' Stored XSS (CVSS 5.1, igniterealtime Openfire)
- [CVE-2020-36955](https://cve.now/CVE-2020-36955.md): Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting (CVSS 5.1, Getgrav Grav CMS Admin Plugin)
- [CVE-2020-36954](https://cve.now/CVE-2020-36954.md): Xeroneit Library Management System 3.1 - "Add Book Category " Stored XSS (CVSS 5.1, Xeroneit Library Management System)
- [CVE-2020-36953](https://cve.now/CVE-2020-36953.md): MiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service Path (CVSS 8.5, MiniTool ShadowMaker)
- [CVE-2026-24433](https://cve.now/CVE-2026-24433.md): Tenda W30E V2 Stored XSS via Username Field (CVSS 5.1, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24431](https://cve.now/CVE-2026-24431.md): Tenda W30E V2 Web UI Reveals Passwords in Cleartext (CVSS 7.1, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24437](https://cve.now/CVE-2026-24437.md): Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages (CVSS 4.8, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24436](https://cve.now/CVE-2026-24436.md): Tenda W30E V2 Lacks Rate Limiting on Authentication (CVSS 9.2, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24428](https://cve.now/CVE-2026-24428.md): Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change (CVSS 8.7, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24430](https://cve.now/CVE-2026-24430.md): Tenda W30E V2 HTTP Responses Expose Plaintext Credentials (CVSS 8.2, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24429](https://cve.now/CVE-2026-24429.md): Tenda W30E V2 Hardcoded Default Password for Built-in Account (CVSS 9.3, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-24440](https://cve.now/CVE-2026-24440.md): Tenda W30E V2 Allows Password Changes Without Verifying Current Password (CVSS 8.7, Shenzhen Tenda Technology Co. W30E)
- [CVE-2026-1224](https://cve.now/CVE-2026-1224.md): Tanium addressed an uncontrolled resource consumption vulnerability in Discover. (CVSS 4.9, Tanium Discover)
- [CVE-2026-1446](https://cve.now/CVE-2026-1446.md): XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier (CVSS 5.0, Esri ArcGIS Pro)
- [CVE-2026-21509](https://cve.now/CVE-2026-21509.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 7.8, KEV, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2020-36952](https://cve.now/CVE-2020-36952.md): IObit Uninstaller 10 Pro - Unquoted Service Path (CVSS 8.5, IObit Uninstaller)
- [CVE-2026-1284](https://cve.now/CVE-2026-1284.md): Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2026-1283](https://cve.now/CVE-2026-1283.md): Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2016-15057](https://cve.now/CVE-2016-15057.md): Apache Continuum: Command injection leading to RCE (CVSS 9.9, Apache Software Foundation Apache Continuum · org.apache.co…)
- [CVE-2025-59109](https://cve.now/CVE-2025-59109.md): UART Leaking Sensitive Data in dormakaba registration unit 9002 (CVSS 5.1, dormakaba registration unit)
- [CVE-2025-59108](https://cve.now/CVE-2025-59108.md): Weak Default Passwords in dormakaba access manager (CVSS 9.2, dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…)
- [CVE-2025-59107](https://cve.now/CVE-2025-59107.md): Static Firmware Encryption Password in dormakaba access manager (CVSS 8.5, dormakaba Access Manager 92xx-k5)
- [CVE-2025-59106](https://cve.now/CVE-2025-59106.md): Web Server Running with Root Privileges in dormakaba access manager (CVSS 8.8, dormakaba Access Manager 92xx-k7)
- [CVE-2025-59105](https://cve.now/CVE-2025-59105.md): Unencrypted Flash Storage in dormakaba access manager (CVSS 7.0, dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…)
- [CVE-2025-59104](https://cve.now/CVE-2025-59104.md): Unlocked Bootloader in dormakaba access manager (CVSS 7.0, dormakaba Access Manager 92xx-k7)
- [CVE-2025-59103](https://cve.now/CVE-2025-59103.md): Weak Default Passwords for SSH Access in dormakaba access manager (CVSS 9.2, dormakaba Access Manager 92xx-k5)
- [CVE-2025-59102](https://cve.now/CVE-2025-59102.md): Secrets Stored in Plaintext in Database in dormakaba access manager (CVSS 6.9, dormakaba Access Manager 92xx-k5)
- [CVE-2025-59101](https://cve.now/CVE-2025-59101.md): Insufficient Session Management in dormakaba access manager (CVSS 7.7, dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…)
- [CVE-2025-59100](https://cve.now/CVE-2025-59100.md): Unauthenticated Access to the SQLite Database in dormakaba access manager (CVSS 5.9, dormakaba Access Manager 92xx-k5)
- [CVE-2025-59099](https://cve.now/CVE-2025-59099.md): Unauthenticated Path Traversal in dormakaba access manager (CVSS 8.8, dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…)
- [CVE-2025-59098](https://cve.now/CVE-2025-59098.md): Trace Functionality Leaking Sensitive Data in dormakaba access manager (CVSS 8.7, dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…)
- [CVE-2025-59097](https://cve.now/CVE-2025-59097.md): Unauthenticated SOAP API in dormakaba access manager (CVSS 9.3, dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…)
- [CVE-2025-59096](https://cve.now/CVE-2025-59096.md): Weak Default Password in dormakaba Kaba exos 9300 (CVSS 4.6, dormakaba Kaba exos)
- [CVE-2025-59095](https://cve.now/CVE-2025-59095.md): Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300 (CVSS 6.8, dormakaba Kaba exos)
- [CVE-2025-59094](https://cve.now/CVE-2025-59094.md): Local Privilege Escalation in dormakaba Kaba exos 9300 System management (CVSS 8.4, dormakaba Kaba exos)
- [CVE-2025-59093](https://cve.now/CVE-2025-59093.md): Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300 (CVSS 8.5, dormakaba Kaba exos)
- [CVE-2025-59092](https://cve.now/CVE-2025-59092.md): Unauthenticated RPC Service in dormakaba Kaba exos 9300 (CVSS 8.7, dormakaba Kaba exos)
- [CVE-2025-59091](https://cve.now/CVE-2025-59091.md): Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300 (CVSS 9.3, dormakaba Kaba exos)
- [CVE-2025-59090](https://cve.now/CVE-2025-59090.md): Unauthenticated SOAP API in dormakaba Kaba exos 9300 (CVSS 9.3, dormakaba Kaba exos)
- [CVE-2025-27821](https://cve.now/CVE-2025-27821.md): HDFS native client: Out of bounds write in URI parser of native HDFS client (CVSS 7.3, Apache Software Foundation HDFS native client · org.apache.…)
- [CVE-2025-41083](https://cve.now/CVE-2025-41083.md): Improper Neutralization in Altitude Communication Server (CVSS 5.1, Altitude Communication Server)
- [CVE-2026-24656](https://cve.now/CVE-2026-24656.md): Apache Karaf: Decanter log-socket collector has deserialization vulnerability (CVSS 3.7, Apache Software Foundation Apache Karaf · org.apache.karaf.…)
- [CVE-2025-41082](https://cve.now/CVE-2025-41082.md): HTTP Request/Response Smuggling in Altitude Communication Server (CVSS 6.9, Altitude Communication Server)
- [CVE-2026-1429](https://cve.now/CVE-2026-1429.md): WellChoose｜Single Sign-On Portal System - Reflected Cross-site Scripting (CVSS 4.8, WellChoose Single Sign-On Portal System)
- [CVE-2026-1428](https://cve.now/CVE-2026-1428.md): WellChoose｜Single Sign-On Portal System - OS Command Injection (CVSS 8.7, WellChoose Single Sign-On Portal System)
- [CVE-2026-1427](https://cve.now/CVE-2026-1427.md): WellChoose｜Single Sign-On Portal System - OS Command Injection (CVSS 8.7, WellChoose Single Sign-On Portal System)
- [CVE-2026-1425](https://cve.now/CVE-2026-1425.md): pymumu SmartDNS SVBC Record dns.c \_dns\_decode\_SVCB\_HTTPS stack-based overflow (CVSS 6.3, pymumu SmartDNS)
- [CVE-2026-1424](https://cve.now/CVE-2026-1424.md): PHPGurukul News Portal Profile Pic unrestricted upload (CVSS 5.1, PHPGurukul News Portal)
- [CVE-2026-1423](https://cve.now/CVE-2026-1423.md): code-projects Online Examination System admin\_pic.php unrestricted upload (CVSS 5.3, code-projects Online Examination System)
- [CVE-2026-1422](https://cve.now/CVE-2026-1422.md): code-projects Online Examination System Login Page index.php sql injection (CVSS 6.9, code-projects Online Examination System)
- [CVE-2025-14973](https://cve.now/CVE-2025-14973.md): Recipe Card Blocks \< 3.4.13 - Contributor+ SQLi (CVSS 6.8, Recipe Card Blocks Lite)
- [CVE-2025-14316](https://cve.now/CVE-2025-14316.md): AhaChat Messenger Marketing \<= 1.1 - Reflected XSS (CVSS 7.1, AhaChat Messenger Marketing)
- [CVE-2026-1421](https://cve.now/CVE-2026-1421.md): code-projects Online Examination System Add Pages cross site scripting (CVSS 5.1, code-projects Online Examination System)
- [CVE-2026-1420](https://cve.now/CVE-2026-1420.md): Tenda AC23 WifiExtraSet buffer overflow (CVSS 8.7, Tenda AC23)
- [CVE-2026-1419](https://cve.now/CVE-2026-1419.md): D-Link DCS700l Web Form setDayNightMode command injection (CVSS 5.1, D-Link DCS700l)
- [CVE-2026-1418](https://cve.now/CVE-2026-1418.md): GPAC SRT Subtitle Import text\_to\_bifs.c gf\_text\_import\_srt\_bifs out-of-bounds write (CVSS 4.8, GPAC)
- [CVE-2026-1417](https://cve.now/CVE-2026-1417.md): GPAC filedump.c dump\_isom\_rtp null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-1416](https://cve.now/CVE-2026-1416.md): GPAC filedump.c DumpMovieInfo null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-1415](https://cve.now/CVE-2026-1415.md): GPAC media\_export.c gf\_media\_export\_webvtt\_metadata null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-1414](https://cve.now/CVE-2026-1414.md): Sangfor Operation and Maintenance Security Management System HTTP POST Request get\_Information getInformation command injection (CVSS 5.3, Sangfor Operation and Maintenance Security Management System)
- [CVE-2026-1413](https://cve.now/CVE-2026-1413.md): Sangfor Operation and Maintenance Security Management System HTTP POST Request port\_validate portValidate command injection (CVSS 5.3, Sangfor Operation and Maintenance Security Management System)
- [CVE-2026-1412](https://cve.now/CVE-2026-1412.md): Sangfor Operation and Maintenance Security Management System HTTP POST Request get\_clip\_img command injection (CVSS 6.9, Sangfor Operation and Maintenance Security Management System)
- [CVE-2026-1411](https://cve.now/CVE-2026-1411.md): Beetel 777VR1 UART access control (CVSS 5.4, Beetel 777VR1)
- [CVE-2026-1410](https://cve.now/CVE-2026-1410.md): Beetel 777VR1 UART missing authentication (CVSS 5.4, Beetel 777VR1)
- [CVE-2025-50537](https://cve.now/CVE-2025-50537.md): Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js (CVSS 5.5)
- [CVE-2025-67274](https://cve.now/CVE-2025-67274.md): An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service (CVSS 7.5)
- [CVE-2025-70368](https://cve.now/CVE-2025-70368.md): Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. (CVSS 5.4)
- [CVE-2025-70982](https://cve.now/CVE-2025-70982.md): Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import s (CVSS 9.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.