Skip to content
OpenAdvisories

Archive

12 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /12 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-22813

    Malicious website can execute commands on the local system through XSS in the OpenCode web UI

    OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. Th…

    anomalyco opencode opencode-ai npm
  • Critical 9.3
    CVE-2026-22799

    emlog Arbitrary File Upload Vulnerability

    Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authe…

    emlog emlog
  • Critical 9.7
    CVE-2026-22794 Public exploit

    Account Takeover Vulnerability in Appsmith

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email ver…

    appsmithorg appsmith
  • Critical 9.3
    CVE-2025-12420 Public exploit EPSS 53%

    Unauthenticated Privilege Escalation in ServiceNow AI Platform

    A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability b…

    ServiceNow Virtual Agent API Now Assist AI Agents
  • Critical 9.3
    CVE-2026-22785 Public exploit

    orval MCP client is vulnerable to a code injection attack.

    orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without …

    orval-labs orval @orval/mcp npm
  • Critical 9.6
    CVE-2026-22783

    Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management

    Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined …

    dfir-iris iris-web
  • Critical 10.0
    CVE-2026-22781

    TinyWeb CGI Command Injection

    TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI execu…

    maximmasiutin TinyWeb
  • Critical 9.1
    CVE-2026-22252

    LibreChat MCP Stdio Remote Command Execution

    LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single …

    danny-avila LibreChat
  • Critical 9.3
    CVE-2025-41006

    Multiple vulnerabilities in Imaster products Open configuration options

    Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’.

    Imaster MEMS Events CRM
  • Critical 10.0
    CVE-2025-52694 Public exploit Scanner template EPSS 40%

    Execution of arbitrary SQL commands

    Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, an…

    Advantech IoTSuite and IoT Edge Products Browsers
  • Critical 9.8
    CVE-2025-66802 Public exploit

    Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receiv…

  • Critical 9.8
    CVE-2025-67147

    Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', …

  • Critical 9.4
    CVE-2025-67146 Public exploit

    Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1…

  • Critical 9.8
    CVE-2025-29329

    Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote…

  • Critical 10.0
    CVE-2025-63314 Public exploit

    A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to …

  • Critical 9.8
    CVE-2025-46070

    An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe compo…

  • Critical 9.9
    CVE-2025-46066

    An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges

  • Critical 9.1
    CVE-2025-51567

    A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote …

  • Critical 9.8
    CVE-2025-65552

    D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication cha…