Skip to content
OpenAdvisories

Archive

10 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /10 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-22688

    WeKnora has Command Injection in MCP stdio test

    WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings…

    Tencent WeKnora github.com/Tencent/WeKnora Go
  • Critical 10.0
    CVE-2025-65091

    XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

    XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starti…

    xwiki-contrib macro-fullcalendar org.xwiki.contrib:macro-fullcalendar-pom Maven
  • Critical 9.1
    CVE-2025-61686 Public exploit EPSS 17%

    React Router has Path Traversal in File Session Storage

    React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/no…

    remix-run react-router @remix-run/node @react-router/node npm
  • Critical 9.1
    CVE-2026-22600

    OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

    OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a P…

    opf openproject