Skip to content
OpenAdvisories

Archive

2 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /2 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-64121

    Nuvation Energy Multi-Stack Controller Authentication Bypass

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • Critical 9.4
    CVE-2025-64120

    Nuvation Energy Multi-Stack Controller OS Command Injection

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • Critical 9.3
    CVE-2025-64119

    Nuvation Energy BMS Client-side Authentication

    A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.

    Nuvation Energy Battery Management System
  • Critical 9.2
    CVE-2026-21440 Public exploit

    AdonisJS Path Traversal in Multipart File Handling

    AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through ve…

    adonisjs core @adonisjs/bodyparser npm
  • Critical 9.8
    CVE-2025-14998 Public exploit Scanner template

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

    The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

    WPMU DEV Branda – White Label & Branding, Free Login Page Customizer Web / CMS
  • Critical 9.8
    CVE-2025-67268

    gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c fil…

    gpsd gpsd Debian Ubuntu
  • Critical 9.8
    CVE-2025-65125

    SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive informa…