Skip to content
OpenAdvisories

Archive

21 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /21 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-24046 Public exploit

    Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

    Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…

    backstage backstage @backstage/plugin-scaffolder-backend @backstage/backend-defaults npm
  • High 8.5
    CVE-2026-23499 Public exploit

    Saleor vulnerable to stored XSS via Unrestricted File Upload

    Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or Apps to upload arbitrary files, including malicious HTML and SVG files containing Javascript. Dependi…

    saleor saleor
  • High 7.2
    CVE-2026-22849 Public exploit

    Saleor lacks proper HTML sanitization in rich text fields

    Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perfor…

    saleor saleor
  • High 8.8
    CVE-2026-22807 Public exploit

    vLLM affected by RCE via auto_map dynamic module loading during model initialization

    vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attack…

    vLLM vLLM vllm PyPI
  • High 8.4
    CVE-2025-68137 Public exploit

    EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop

    EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is…

    EVerest everest-core
  • High 7.2
    CVE-2026-0834 Public exploit

    Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13

    Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the ad…

    TP-Link Systems Archer C20 v5 TL-WR841N v13 Archer C20 v6.0, Archer AX53 v1.0 Network devices
  • High 8.2
    CVE-2026-20045 Exploited Public exploit

    Cisco Unified Communications Products Remote Code Execution Vulnerability

    A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connectio…

    Cisco Cisco Unified Communications Manager Cisco Unity Connection Cisco Unified Communications Manager IM and Presence Service Network devices
    KEV Jan 21, 2026
  • High 7.1
    CVE-2026-22444 Public exploit

    Apache Solr: Insufficient file-access checking in standalone core-creation requests

    The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security se…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Ubuntu Maven