Skip to content
OpenAdvisories

Archive

19 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /19 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-23837

    MyTube has an Authorization Bypass vulnerability

    MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By s…

    franklioxygen MyTube
  • Critical 9.3
    CVE-2026-23841

    Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param

    Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryCreated=`. Version 0.…

    leepeuker movary
  • Critical 9.3
    CVE-2026-23840

    Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param

    Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryDeleted=`. Version 0.…

    leepeuker movary
  • Critical 9.3
    CVE-2026-23839

    Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param

    Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.…

    leepeuker movary
  • Critical 10.0
    CVE-2026-23836

    HotCRP vulnerable to remote code execution through formulas

    HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release ver…

    kohler hotcrp
  • Critical 9.8
    CVE-2026-1162

    UTT HiPER 810 setSysAdm strcpy buffer overflow

    A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argument passwd1 causes buffer overflow. Remote exploitation of the attack is possible. The exploit has be…

    UTT HiPER 810
  • Critical 9.8
    CVE-2026-0610

    SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 thr…

    Devolutions Server
  • Critical 9.0
    CVE-2026-1181

    Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

    Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScr…

    Altium Altium 365
  • Critical 9.9
    CVE-2026-22797

    An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, a…

    OpenStack keystonemiddleware python-keystonemiddleware python-keystonemiddleware Debian Ubuntu