# CVEs published 2026-01-30

121 CVEs were published on January 30, 2026: 13 critical, 48 high. Days are UTC.

- [CVE-2026-25156](https://cve.now/CVE-2026-25156.md): HotCRP vulnerable to stored XSS via comment attachments (CVSS 7.3, kohler hotcrp)
- [CVE-2020-37057](https://cve.now/CVE-2020-37057.md): Online-Exam-System 2015 - 'fid' SQL Injection (CVSS 8.8, sunnygkp10 Online-Exam-System)
- [CVE-2020-37056](https://cve.now/CVE-2020-37056.md): Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass (CVSS 6.9, Crystal Shard http-protection)
- [CVE-2020-37054](https://cve.now/CVE-2020-37054.md): Navigate CMS 2.8.7 - Cross-Site Request Forgery (CVSS 5.1, Naviwebs S.C. Navigate CMS)
- [CVE-2020-37053](https://cve.now/CVE-2020-37053.md): Navigate CMS 2.8.7 - ''sidx' SQL Injection (CVSS 7.1, Naviwebs S.C. Navigate CMS)
- [CVE-2020-37052](https://cve.now/CVE-2020-37052.md): AirControl 1.4.2 - PreAuth Remote Code Execution (CVSS 9.3, Ubiquiti AirControl)
- [CVE-2020-37051](https://cve.now/CVE-2020-37051.md): Online-Exam-System 2015 - 'feedback' SQL Injection (CVSS 8.8, sunnygkp10 Online-Exam-System)
- [CVE-2020-37050](https://cve.now/CVE-2020-37050.md): Quick Player 1.3 - '.m3l' Buffer Overflow (CVSS 8.4, M.J.M Soft Quick Player)
- [CVE-2020-37049](https://cve.now/CVE-2020-37049.md): Frigate 3.36.0.9 - 'Command Line' Local Buffer Overflow (CVSS 8.4, WinFrigate Frigate 3 Professional)
- [CVE-2020-37046](https://cve.now/CVE-2020-37046.md): Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery (CVSS 5.1, Adikiss Sistem Informasi Pengumuman Kelulusan Online)
- [CVE-2020-37044](https://cve.now/CVE-2020-37044.md): OpenCTI 3.3.1 - Cross Site Scripting (CVSS 5.1, Filigran OpenCTI · pycti)
- [CVE-2020-37043](https://cve.now/CVE-2020-37043.md): 10-Strike Bandwidth Monitor 3.9 - Buffer Overflow (CVSS 7.1, 10-Strike Software Bandwidth Monitor)
- [CVE-2020-37042](https://cve.now/CVE-2020-37042.md): Frigate Professional 3.36.0.9 - 'Find Computer' Local Buffer Overflow (CVSS 8.4, WinFrigate Frigate 3 Professional)
- [CVE-2020-37041](https://cve.now/CVE-2020-37041.md): OpenCTI 3.3.1 - Directory Traversal (CVSS 7.1, Filigran OpenCTI · pycti)
- [CVE-2020-37040](https://cve.now/CVE-2020-37040.md): Code Blocks 17.12 - 'File Name' Local Buffer Overflow (CVSS 8.4, Code::Blocks)
- [CVE-2020-37039](https://cve.now/CVE-2020-37039.md): Frigate 2.02 - Denial Of Service (CVSS 4.6, WinFrigate Frigate)
- [CVE-2020-37038](https://cve.now/CVE-2020-37038.md): Code Blocks 20.03 - Denial Of Service (CVSS 4.6, Code::Blocks)
- [CVE-2020-37036](https://cve.now/CVE-2020-37036.md): RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (CVSS 7.1, Mini-stream Software RM Downloader)
- [CVE-2020-37035](https://cve.now/CVE-2020-37035.md): e-learning Php Script 0.1.0 - 'search' SQL Injection (CVSS 8.8, amitkolloldey e-learning PHP Script)
- [CVE-2020-37034](https://cve.now/CVE-2020-37034.md): HelloWeb 2.0 - Arbitrary File Download (CVSS 8.7, HelloWeb)
- [CVE-2020-37033](https://cve.now/CVE-2020-37033.md): Infor Storefront B2B 1.0 - 'usr\_name' SQL Injection (CVSS 8.8, Insite Software Infor Storefront B2B)
- [CVE-2020-37032](https://cve.now/CVE-2020-37032.md): Wing FTP Server 6.3.8 - Remote Code Execution (CVSS 8.6, Wing FTP Server)
- [CVE-2020-37031](https://cve.now/CVE-2020-37031.md): Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (CVSS 8.6, Ashkon Software Simple Startup Manager)
- [CVE-2020-37029](https://cve.now/CVE-2020-37029.md): FTPDummy 4.80 - Local Buffer Overflow (CVSS 8.4, K.soft FTPDummy)
- [CVE-2020-37028](https://cve.now/CVE-2020-37028.md): Socusoft Photo to Video Converter Professional 8.07 - 'Output Folder' Buffer Overflow (CVSS 8.4, SOCUSOFT Photo to Video Converter Professional)
- [CVE-2020-37027](https://cve.now/CVE-2020-37027.md): Sickbeard 0.1 - Remote Command Injection (CVSS 9.3, midgetspy Sickbeard)
- [CVE-2020-37026](https://cve.now/CVE-2020-37026.md): Sickbeard 0.1 - Cross-Site Request Forgery (CVSS 5.1, midgetspy Sickbeard)
- [CVE-2020-37025](https://cve.now/CVE-2020-37025.md): Port Forwarding Wizard 4.8.0 - Buffer Overflow (CVSS 8.4, iForwarder and upRedSun Technologies, LLC. Port Forwarding…)
- [CVE-2020-37024](https://cve.now/CVE-2020-37024.md): Nidesoft DVD Ripper 5.2.18 - Local Buffer Overflow (CVSS 8.4, Nidesoft Studio Nidesoft DVD Ripper)
- [CVE-2020-37023](https://cve.now/CVE-2020-37023.md): Koken CMS 0.22.24 - Arbitrary File Upload (CVSS 8.7, Koken CMS)
- [CVE-2019-25232](https://cve.now/CVE-2019-25232.md): NetPCLinker 1.0.0.0 - Buffer Overflow (CVSS 8.4, NetPCLinker)
- [CVE-2026-25154](https://cve.now/CVE-2026-25154.md): LocalSend has Stored XSS in Web Share Interface via Filename (CVSS 6.1, localsend)
- [CVE-2026-25152](https://cve.now/CVE-2026-25152.md): @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator (CVSS 5.3, backstage · @backstage/plugin-techdocs-node)
- [CVE-2026-1705](https://cve.now/CVE-2026-1705.md): D-Link DSL-6641K Web ad\_virtual\_server\_vdsl cross site scripting (CVSS 4.8, D-Link DSL-6641K)
- [CVE-2026-25153](https://cve.now/CVE-2026-25153.md): @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks (CVSS 7.7, backstage · @backstage/plugin-techdocs-node)
- [CVE-2025-2668](https://cve.now/CVE-2025-2668.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36001](https://cve.now/CVE-2025-36001.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36009](https://cve.now/CVE-2025-36009.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36070](https://cve.now/CVE-2025-36070.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36098](https://cve.now/CVE-2025-36098.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36123](https://cve.now/CVE-2025-36123.md): IBM Db2 Denial of Service (CVSS 6.2, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36184](https://cve.now/CVE-2025-36184.md): IBM Db2 Privilege Escalation (CVSS 7.2, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36353](https://cve.now/CVE-2025-36353.md): IBM Db2 Denial of Service (CVSS 6.2, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36365](https://cve.now/CVE-2025-36365.md): IBM Db2 Privilege Escalation (CVSS 6.8, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36366](https://cve.now/CVE-2025-36366.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36384](https://cve.now/CVE-2025-36384.md): IBM Db2 Privilege Escalation (CVSS 8.4, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36387](https://cve.now/CVE-2025-36387.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36407](https://cve.now/CVE-2025-36407.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36423](https://cve.now/CVE-2025-36423.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36424](https://cve.now/CVE-2025-36424.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36427](https://cve.now/CVE-2025-36427.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36428](https://cve.now/CVE-2025-36428.md): IBM Db2 Denial of Service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36442](https://cve.now/CVE-2025-36442.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2026-1723](https://cve.now/CVE-2026-1723.md): TOTOLINK X6000R Unauthenticated Command Injection Vulnerability (CVSS 9.2, TOTOLINK X6000R)
- [CVE-2026-25141](https://cve.now/CVE-2026-25141.md): Orval has a code injection via unsanitized x-enum-descriptions uing JS comments (CVSS 9.3, orval-labs orval · @orval/core)
- [CVE-2026-25130](https://cve.now/CVE-2026-25130.md): Cybersecurity AI vulnerable to command Injection through argument injection in find\_file Agent tool (CVSS 9.7, aliasrobotics cai · cai-framework)
- [CVE-2026-25129](https://cve.now/CVE-2026-25129.md): PsySH has Local Privilege Escalation via CWD .psysh.php auto-load (CVSS 6.7, bobthecow psysh · psy/psysh)
- [CVE-2025-24293](https://cve.now/CVE-2025-24293.md): # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image (CVSS 9.2, Rails activestorage · activestorage)
- [CVE-2026-23835](https://cve.now/CVE-2026-23835.md): LobeHub Vulnerable to Improper Authorization in Presigned Upload (CVSS 5.7, lobehub lobe-chat · @lobehub/chat)
- [CVE-2025-11175](https://cve.now/CVE-2025-11175.md): DiscussionTools should use better regex (CVSS 8.8, The Wikimedia Foundation Mediawiki - DiscussionTools Extens…)
- [CVE-2025-62349](https://cve.now/CVE-2025-62349.md): Salt Master authentication protocol downgrade may enable minion impersonation (CVSS 6.2, Salt Project Salt · salt)
- [CVE-2025-62348](https://cve.now/CVE-2025-62348.md): Salt junos module uses an unsafe YAML loader which may allow unintended code execution (CVSS 7.8, Salt Project Salt · salt)
- [CVE-2024-9432](https://cve.now/CVE-2024-9432.md): Cleartext Storage of Sensitive Information vulnerability has been discovered in OpenText™ Vertica. (CVSS 6.9, OpenText™ Vertica)
- [CVE-2025-15497](https://cve.now/CVE-2025-15497.md): Insufficient epoch key slot processing in OpenVPN 2.7\_alpha1 through 2.7\_rc5 allows remote authenticated users to trigger an assert resultin (CVSS 3.8, OpenVPN)
- [CVE-2026-1702](https://cve.now/CVE-2026-1702.md): SourceCodester Pet Grooming Management Software User Management user.php improper authorization (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2026-1701](https://cve.now/CVE-2026-1701.md): itsourcecode School Management System index.php sql injection (CVSS 6.9, itsourcecode School Management System)
- [CVE-2026-1700](https://cve.now/CVE-2026-1700.md): projectworlds House Rental and Property Listing sms.php cross site scripting (CVSS 5.1, projectworlds House Rental and Property Listing)
- [CVE-2026-1691](https://cve.now/CVE-2026-1691.md): bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization (CVSS 5.3, bolo-solo)
- [CVE-2026-1690](https://cve.now/CVE-2026-1690.md): Tenda HG10 formSysCmd system command injection (CVSS 5.1, Tenda HG10)
- [CVE-2026-1689](https://cve.now/CVE-2026-1689.md): Tenda HG10 Login formLogin checkUserFromLanOrWan command injection (CVSS 6.9, Tenda HG10)
- [CVE-2020-37060](https://cve.now/CVE-2020-37060.md): Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path (CVSS 8.5, Drive-Software Atomic Alarm Clock x86)
- [CVE-2020-37059](https://cve.now/CVE-2020-37059.md): Popcorn Time 6.2 - 'Update service' Unquoted Service Path (CVSS 8.5, Getpopcorntime Popcorn Time)
- [CVE-2020-37058](https://cve.now/CVE-2020-37058.md): Andrea ST Filters Service 1.0.64.7 - Unquoted service path (CVSS 8.5, Andrea Electronics Andrea ST Filters Service)
- [CVE-2020-37030](https://cve.now/CVE-2020-37030.md): Outline Service 1.3.3 - 'Outline Service ' Unquoted Service Path (CVSS 8.5, Getoutline Outline Service)
- [CVE-2020-37022](https://cve.now/CVE-2020-37022.md): OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting (CVSS 5.1, OpenZ ERP)
- [CVE-2020-37019](https://cve.now/CVE-2020-37019.md): Orchard Core RC1 - Persistent Cross-Site Scripting (CVSS 5.1, Orchardcore Orchard Core)
- [CVE-2020-37014](https://cve.now/CVE-2020-37014.md): Tryton 5.4 - Persistent Cross-Site Scripting (CVSS 5.1, Tryton)
- [CVE-2020-37003](https://cve.now/CVE-2020-37003.md): Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting (CVSS 5.1, Sellacious eCommerce)
- [CVE-2020-36998](https://cve.now/CVE-2020-36998.md): forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting (CVSS 5.1, forma E-Learning Suite)
- [CVE-2020-36996](https://cve.now/CVE-2020-36996.md): PHPFusion 9.03.50 - Persistent Cross-Site Scripting (CVSS 5.1, Php-Fusion PHPFusion)
- [CVE-2020-36966](https://cve.now/CVE-2020-36966.md): Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting (CVSS 5.1, Dolibarr)
- [CVE-2026-1688](https://cve.now/CVE-2026-1688.md): itsourcecode Directory Management System index.php sql injection (CVSS 6.9, itsourcecode Directory Management System)
- [CVE-2026-1687](https://cve.now/CVE-2026-1687.md): Tenda HG10 Boa Webserver formSamba command injection (CVSS 6.9, Tenda HG10)
- [CVE-2025-4686](https://cve.now/CVE-2025-4686.md): Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment (CVSS 8.6, Kodmatic Computer Software Tourism Construction Industry an…)
- [CVE-2026-25128](https://cve.now/CVE-2026-25128.md): fast-xml-parser has RangeError DoS Numeric Entities Bug (CVSS 7.5, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2026-25050](https://cve.now/CVE-2026-25050.md): Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy (CVSS 2.7, vendurehq vendure · @vendure/core)
- [CVE-2026-24855](https://cve.now/CVE-2026-24855.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover (CVSS 7.2, ChurchCRM CRM)
- [CVE-2026-24854](https://cve.now/CVE-2026-24854.md): Church CRM has SQL injection in PaddleNumEditor.php (CVSS 8.8, ChurchCRM CRM)
- [CVE-2025-7964](https://cve.now/CVE-2025-7964.md): Zigbee Router Denial of Service (CVSS 9.2, silabs.com Silicon Labs Zigbee Stack)
- [CVE-2026-1686](https://cve.now/CVE-2026-1686.md): Totolink A3600R app.so setAppEasyWizardConfig buffer overflow (CVSS 8.7, Totolink A3600R)
- [CVE-2026-1685](https://cve.now/CVE-2026-1685.md): D-Link DIR-823X Login sub\_40AC74 excessive authentication (CVSS 6.3, D-Link DIR-823X)
- [CVE-2026-1684](https://cve.now/CVE-2026-1684.md): Free5GC SMF PFCP UDP Endpoint pfcp\_reports.go HandleReports denial of service (CVSS 6.9, Free5GC SMF)
- [CVE-2024-4027](https://cve.now/CVE-2024-4027.md): Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks (CVSS 7.5, Red Hat build of Apicurio Registry · Red Hat build of Qu… +7)
- [CVE-2025-6723](https://cve.now/CVE-2025-6723.md): Untrusted user data can lead to privilege escalation (CVSS 5.8, Progress Software Chef Inspec)
- [CVE-2026-1683](https://cve.now/CVE-2026-1683.md): Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service (CVSS 6.9, Free5GC SMF)
- [CVE-2026-1682](https://cve.now/CVE-2026-1682.md): Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference (CVSS 6.9, Free5GC SMF)
- [CVE-2025-9226](https://cve.now/CVE-2025-9226.md): Stored XSS (CVSS 4.6, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine… +1)
- [CVE-2026-1498](https://cve.now/CVE-2026-1498.md): WatchGuard Firebox LDAP Injection (CVSS 7.0, WatchGuard Fireware OS)
- [CVE-2025-13176](https://cve.now/CVE-2025-13176.md): Local privilege escalation in ESET Inspect Connector for Windows (CVSS 8.4, ESET, spol. s.r.o ESET Inspect Connector)
- [CVE-2025-26385](https://cve.now/CVE-2025-26385.md): Metasys product command injection vulnerability could allow remote SQL execution (CVSS 9.5, Johnson Controls Metasys)
- [CVE-2026-22626](https://cve.now/CVE-2026-22626.md): Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal devi (CVSS 4.9, HIKSEMI HS-AFS-S1H1)
- [CVE-2026-22625](https://cve.now/CVE-2026-22625.md): Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files. (CVSS 4.6, HIKSEMI HS-AFS-S1H1)
- [CVE-2026-22624](https://cve.now/CVE-2026-22624.md): Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without pro (CVSS 4.3, HIKSEMI HS-AFS-S1H1)
- [CVE-2026-22623](https://cve.now/CVE-2026-22623.md): Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary c (CVSS 7.2, HIKSEMI HS-AFS-S1H1)
- [CVE-2026-0709](https://cve.now/CVE-2026-0709.md): Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. (CVSS 7.2, Hikvision DS-3WAP521-SI · Hikvision DS-3WAP522-SI +4)
- [CVE-2026-1699](https://cve.now/CVE-2026-1699.md): In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull\_request\_target trigger while ch (CVSS 10.0, Eclipse Foundation Eclipse Theia - Website)
- [CVE-2026-21418](https://cve.now/CVE-2026-21418.md): Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injecti (CVSS 7.8, Dell Unity)
- [CVE-2025-1395](https://cve.now/CVE-2025-1395.md): Sensitive Data Exposure in CoDeriApp's HeyGarson (CVSS 8.2, Codriapp Innovation and Software Technologies HeyGarson)
- [CVE-2026-22277](https://cve.now/CVE-2026-22277.md): Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject (CVSS 7.8, Dell UnityVSA)
- [CVE-2026-25211](https://cve.now/CVE-2026-25211.md): Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. (CVSS 3.2, llamastack Llama Stack · llama-stack)
- [CVE-2026-25210](https://cve.now/CVE-2026-25210.md): In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow ch (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-0805](https://cve.now/CVE-2026-0805.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller (CVSS 8.2, Arcadia Technology Crafty Controller)
- [CVE-2026-0963](https://cve.now/CVE-2026-0963.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller (CVSS 9.9, Arcadia Technology Crafty Controller)
- [CVE-2026-1680](https://cve.now/CVE-2026-1680.md): Local Privilege Escalation in Local Admin Service (CVSS 7.1, Edgemo (Danoffice IT) Local Admin Service)
- [CVE-2025-12899](https://cve.now/CVE-2025-12899.md): net: icmp: Out of bound memory read (CVSS 6.5, zephyrproject-rtos Zephyr)
- [CVE-2026-24714](https://cve.now/CVE-2026-24714.md): Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box (CVSS 7.5, NETGEAR products)
- [CVE-2026-24729](https://cve.now/CVE-2026-24729.md): Interinfo DreamMaker - Unrestricted Upload of File with Dangerous Type (CVSS 10.0, Internet Information Co. DreamMaker)
- [CVE-2026-24728](https://cve.now/CVE-2026-24728.md): Interinfo DreamMaker - Missing Authentication for Critical Function (CVSS 9.3, Internet Information Co. DreamMaker)
- [CVE-2025-15322](https://cve.now/CVE-2025-15322.md): Tanium addressed an improper access controls vulnerability in Tanium Server. (CVSS 4.3, Tanium Server)
- [CVE-2025-51958](https://cve.now/CVE-2025-51958.md): aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugin (CVSS 9.8)
- [CVE-2025-69662](https://cve.now/CVE-2025-69662.md): SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to\_postgis()\` function be (CVSS 8.6, geopandas)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.