Skip to content
OpenAdvisories

Archive

20 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /20 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-21969

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: S…

    Oracle Oracle Agile Product Lifecycle Management for Process
  • Critical 10.0
    CVE-2026-21962 Exploited Public exploit EPSS 73%

    Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (comp…

    Oracle Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
    KEV Aug 24, 2026
  • Critical 9.6
    CVE-2025-53912

    An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A …

    MedDream MedDream PACS Premium
  • Critical 9.9
    CVE-2026-22844 EPSS 13%

    Zoom Node Deployments - Command Injection

    A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.

    Zoom Communications Zoom Node
  • Critical 9.8
    CVE-2025-14533

    Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action

    The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it po…

    hwk-fr Advanced Custom Fields: Extended Web / CMS
  • Critical 9.8
    CVE-2026-1221

    BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials

    PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to the database using hardcoded database credentials stored in the firmware.

    BROWAN COMMUNICATIONS PrismX MX100 AP controller
  • Critical 9.8
    CVE-2026-0907

    Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spo…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Critical 9.8
    CVE-2026-0906

    Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the content…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Critical 9.8
    CVE-2026-0905

    Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a net…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
  • Critical 9.3
    CVE-2026-23947 Public exploit

    Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

    Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in natu…

    orval-labs orval @orval/core npm
  • Critical 9.8
    CVE-2025-55423 Public exploit

    A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the cont…

  • Critical 9.8
    CVE-2025-64087 Public exploit

    XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

    A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

    fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker Maven
  • Critical 9.8
    CVE-2025-65482 Public exploit

    XDocReport affected by an XML External Entity (XXE) vulnerability

    An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

    fr.opensagres.xdocreport:fr.opensagres.xdocreport.document Maven
  • Critical 9.8
    CVE-2025-56005 Public exploit EPSS 19%

    An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the…

    ply ply Debian Ubuntu