Skip to content
OpenAdvisories

Archive

16 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /16 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-23800

    WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0.

  • Critical 9.8
    CVE-2026-23744 Public exploit Scanner template EPSS 68%

    REC in MCPJam inspector due to HTTP Endpoint exposes

    MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP …

    MCPJam inspector @mcpjam/inspector npm
  • Critical 9.3
    CVE-2012-10064

    Omni Secure Files < 0.1.14 Unauthenticated Arbitrary File Upload

    Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without en…

    Omnilogic Omni Secure Files
  • Critical 9.1
    CVE-2026-23722

    WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.

    WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly san…

    LabRedesCefetRJ WeGIA
  • Critical 9.7
    CVE-2026-23523

    Dive allows One-click Remote Code Execution through Deep Links for MCP Install

    Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitra…

    OpenAgentPlatform Dive
  • Critical 9.4
    CVE-2026-21624

    Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla

    Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.

    Stackideas.com EasyDiscuss extension for Joomla Web / CMS
  • Critical 9.4
    CVE-2026-21623

    Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla

    Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.

    Stackideas.com EasyDiscuss extension for Joomla Web / CMS
  • Critical 9.8
    CVE-2025-60021 Public exploit Scanner template EPSS 55%

    Apache bRPC: Remote command injection vulnerability in heap builtin service

    Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the…

    Apache Software Foundation Apache bRPC
  • Critical 9.8
    CVE-2025-62581

    DIAView - Authentication Bypass Vulnerability

    Delta Electronics DIAView has multiple vulnerabilities.

    Delta Electronics DIAView ICS / OT
  • Critical 10.0
    CVE-2025-61937

    AVEVA Process Optimization Code Injection

    The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the  model application server.

    AVEVA Process Optimization