Skip to content
OpenAdvisories

Archive

22 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /22 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-24306 Public exploit

    Azure Front Door Elevation of Privilege Vulnerability

    Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Front Door
  • High 8.5
    CVE-2025-68999 Public exploit

    WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through <= …

    HappyMonster Happy Addons for Elementor
  • Critical 10.0
    CVE-2025-68001 Public exploit

    WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through <= 2.1.0.

    garidium g-FFL Checkout
  • High 7.1
    CVE-2025-67923 Public exploit

    WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.

    Crocoblock JetEngine
  • High 8.1
    CVE-2026-24009 Public exploit

    Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage

    Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting…

    docling-project docling-core docling-core PyPI
  • Critical 9.3
    CVE-2026-23760 Exploited · Ransomware Public exploit Scanner template EPSS 96%

    SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

    SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resett…

    SmarterTools SmarterMail
    KEV Jan 26, 2026
  • Medium 4.3
    CVE-2026-24332 Public exploit

    Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actua…

    Discord WebSocket API service
  • Critical 9.8
    CVE-2026-0920 Public exploit

    LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter

    The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register wi…

    choijun LA-Studio Element Kit for Elementor Web / CMS
  • High 7.1
    CVE-2026-24049 Public exploit

    wheel Allows Arbitrary File Permission Modification via Path Traversal

    wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…

    pypa wheel open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 6.3
    CVE-2026-24055 Public exploit

    Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

    Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId i…

    langfuse langfuse
  • High 7.5
    CVE-2025-67221 Public exploit

    orjson does not limit recursion for deeply nested JSON documents

    The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

    kserve-storage-controller datadog-agent-7.72-core-integrations datadog-agent-7.73-core-integrations py3.13-ambassador Wolfi PyPI
  • High 7.4
    CVE-2025-69821 Public exploit

    An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service…

  • Medium 6.5
    CVE-2025-69612 Public exploit

    A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software…

  • High 7.4
    CVE-2025-69822 Public exploit

    An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive informat…

  • Medium 6.5
    CVE-2025-70899 Public exploit

    PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative for…