Skip to content
OpenAdvisories

Archive

7 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /7 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-22187 Public exploit

    Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

    Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated wit…

    Open Microscopy Environment Bio-Formats ome:pom-bio-formats Maven
  • Medium 4.3
    CVE-2025-12030 Public exploit

    ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification

    The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the c…

    airesvsg ACF to REST API Web / CMS
  • Medium 5.3
    CVE-2025-15474 Public exploit

    AuntyFey Smart Combination Lock BLE Connection Flood DoS

    AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connect…

    AuntyFey AuntyFey Smart Combination Lock
  • Medium 6.8
    CVE-2025-66837 Public exploit

    A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafte…

  • Medium 6.5
    CVE-2025-66838 Public exploit

    In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, …