Skip to content
OpenAdvisories

Archive

15 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /15 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.0
    CVE-2026-1010 Public exploit

    Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation

    A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an adm…

    Altium Altium Enterprise Server
  • High 7.5
    CVE-2026-0915 Public exploit

    getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler

    Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS r…

    The GNU C Library glibc glibc eglibc Debian Ubuntu Azure Linux Wolfi
  • Critical 9.1
    CVE-2026-23520 Public exploit

    Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE

    Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-updat…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go
  • High 7.1
    CVE-2025-36911 Public exploit

    In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adja…

    Google Android Android
  • High 7.5
    CVE-2025-66417 Public exploit

    GLPI has an unauthenticated SQL injection through the inventory endpoint

    GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.

    GLPI glpi glpi Ubuntu
  • High 7.5
    CVE-2025-64516 Public exploit

    GLPI incorrectly authorizes access to documents

    GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anony…

    GLPI glpi glpi Ubuntu
  • High 7.1
    CVE-2026-0897 Public exploit

    Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

    Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python int…

    Google Keras kubeflow-pipelines-visualization-server keras Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.3
    CVE-2025-67246 Public exploit

    A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control…