Skip to content
OpenAdvisories

Archive

7 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /7 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-21858 Public exploit Scanner template EPSS 78%

    n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

    n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an u…

    n8n-io n8n n8n npm
  • High 8.3
    CVE-2026-21857 Public exploit

    Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

    REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not val…

    redaxo redaxo redaxo/source Packagist
  • High 8.8
    CVE-2025-68705 Public exploit

    RustFS Path Traversal Vulnerability

    RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.

    rustfs rustfs rustfs crates.io
  • Medium 6.8
    CVE-2026-22187 Public exploit

    Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

    Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated wit…

    Open Microscopy Environment Bio-Formats ome:pom-bio-formats Maven
  • High 8.1
    CVE-2025-69080 Public exploit

    WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.

    JanStudio Gecko
  • Medium 4.3
    CVE-2025-12030 Public exploit

    ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification

    The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the c…

    airesvsg ACF to REST API Web / CMS
  • Medium 5.3
    CVE-2025-15474 Public exploit

    AuntyFey Smart Combination Lock BLE Connection Flood DoS

    AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connect…

    AuntyFey AuntyFey Smart Combination Lock
  • Medium 6.8
    CVE-2025-66837 Public exploit

    A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafte…

  • Medium 6.5
    CVE-2025-66838 Public exploit

    In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, …