Skip to content
OpenAdvisories

Archive

18 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /18 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.7
    CVE-2026-23644

    esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages

    esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not preven…

    esm-dev esm.sh github.com/esm-dev/esm.sh Go
  • High 7.3
    CVE-2026-1125 EPSS 16%

    D-Link DIR-823X set_wifidog_settings sub_412E7C command injection

    A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed …

    D-Link DIR-823X Network devices
  • High 8.5
    CVE-2026-0863

    Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.

    Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an a…

  • High 7.3
    CVE-2026-1124

    Yonyou KSOA HTTP GET Parameter work_report.jsp sql injection

    A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql …

    Yonyou KSOA
  • High 7.3
    CVE-2026-1123

    Yonyou KSOA HTTP GET Parameter work_mod.jsp sql injection

    A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotel…

    Yonyou KSOA
  • High 7.3
    CVE-2026-1122 Public exploit

    Yonyou KSOA HTTP GET Parameter work_info.jsp sql injection

    A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remote…

    Yonyou KSOA
  • High 7.3
    CVE-2026-1121

    Yonyou KSOA HTTP GET Parameter del_workplan.jsp sql injection

    A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remote…

    Yonyou KSOA
  • High 7.3
    CVE-2026-1120

    Yonyou KSOA HTTP GET Parameter del_work.jsp sql injection

    A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initi…

    Yonyou KSOA
  • High 7.3
    CVE-2026-1119

    itsourcecode Society Management System delete_activity.php sql injection

    A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Executing a manipulation of the argument activity_id can lead to sql injection. It is possible to launch t…

    itsourcecode Society Management System