Skip to content
OpenAdvisories

Archive

16 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /16 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.2
    CVE-2026-23745 Public exploit

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • Critical 9.8
    CVE-2026-23744 Public exploit Scanner template EPSS 68%

    REC in MCPJam inspector due to HTTP Endpoint exposes

    MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP …

    MCPJam inspector @mcpjam/inspector npm
  • High 7.2
    CVE-2026-23723 Public exploit

    WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

    WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposu…

    LabRedesCefetRJ WeGIA
  • Medium 4.6
    CVE-2025-29943 Public exploit

    Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU…

    AMD AMD EPYC™ 9005 Series Processors AMD EPYC™ Embedded 9005 Series Processors AMD EPYC™ 9004 Series Processors Debian Ubuntu
  • Critical 9.8
    CVE-2025-60021 Public exploit Scanner template EPSS 26%

    Apache bRPC: Remote command injection vulnerability in heap builtin service

    Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the…

    Apache Software Foundation Apache bRPC
  • Medium 5.5
    CVE-2025-69581 Public exploit

    An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user …

  • High 7.8
    CVE-2025-68921 Public exploit

    SteelSeries Nahimic 3 1.10.7 allows Directory traversal.