Skip to content
OpenAdvisories

Archive

8 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /8 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

27 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-22234

    OPEXUS eCasePortal unauthenticated IDOR

    OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.

    OPEXUS eCase Portal
  • Critical 9.0
    CVE-2025-59468

    This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending…

    Veeam Backup and Recovery
  • Critical 9.0
    CVE-2025-59469

    This vulnerability allows a Backup or Tape Operator to write files as root.

    Veeam Backup and Recovery
  • Critical 9.0
    CVE-2025-59470 Public exploit

    This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a ma…

    Veeam Backup and Recovery
  • Critical 9.2
    CVE-2026-22034

    Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package

    Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and config…

    jvoisin snuffleupagus snuffleupagus Debian
  • Critical 9.4
    CVE-2026-21891 Scanner template

    ZimaOS has Authentication Bypass via System-Level Username

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password w…

    IceWhale Tech ZimaOS
  • Critical 9.3
    CVE-2026-21876 Public exploit EPSS 17%

    OWASP CRS has multipart bypass using multiple content-type parts

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …

    coreruleset coreruleset modsecurity-crs modsecurity-crs Debian Ubuntu
  • Critical 9.8
    CVE-2025-69258

    A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an att…

    Trend Micro Trend Micro Apex Central
  • Critical 9.8
    CVE-2025-62877

    Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer

    Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password  if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is …

    SUSE Harvester github.com/harvester/harvester-installer Go
  • Critical 9.3
    CVE-2025-67928

    WordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6.

    Themesuite Automotive Listings
  • Critical 9.9
    CVE-2025-67924

    WordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpkit: from n/a through <= 2.0.

    Zozothemes Corpkit
  • Critical 9.1
    CVE-2025-67910

    WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.

    contentstudio Contentstudio
  • Critical 9.8
    CVE-2025-67911

    WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.

    Tribulant Software Newsletters
  • Critical 9.3
    CVE-2025-23993

    WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3.

    RiceTheme Felan Framework
  • Critical 9.8
    CVE-2025-23504

    WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.

    RiceTheme Felan Framework
  • Critical 9.8
    CVE-2019-25296

    WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete

    The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for una…

    loopus WP Cost Estimation & Payment Forms Builder Web / CMS
  • Critical 9.1
    CVE-2026-21881

    Kanboard is Vulnerable to Reverse Proxy Authentication Bypass

    Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without …

    kanboard kanboard
  • Critical 10.0
    CVE-2026-21877 Public exploit Scanner template

    n8n is vulnerable to Remote Code Execution via Arbitrary File Write

    n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instan…

    n8n-io n8n n8n npm
  • Critical 9.4
    CVE-2025-66916

    The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expressio…

  • Critical 9.8
    CVE-2025-66913

    JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The …

  • Critical 9.8
    CVE-2025-67325 Public exploit

    Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticate…

  • Critical 9.8
    CVE-2025-61548

    SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endp…

  • Critical 9.1
    CVE-2025-61546

    There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro …

  • Critical 9.8
    CVE-2025-61246 Public exploit

    indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId para…

  • Critical 9.4
    CVE-2025-68717

    KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is …

  • Critical 9.1
    CVE-2025-68715

    An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/gofo…

  • Critical 9.1
    CVE-2025-56425

    An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnect…