Skip to content
OpenAdvisories

Archive

23 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /23 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.7
    CVE-2026-24136 Public exploit

    Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

    Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in …

    saleor saleor
  • Critical 9.3
    CVE-2026-24423 Exploited · Ransomware Public exploit Scanner template EPSS 88%

    SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. …

    SmarterTools SmarterMail
    KEV Feb 5, 2026
  • High 8.4
    CVE-2021-47881 Public exploit

    dataSIMS Avionics ARINC 664-1 - Local Buffer Overflow

    dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to overwrite memory by manipulating the milstd1553result.txt file. Attackers can craft a malicious file with carefully constructed payload and ali…

    Data Device dataSIMS Avionics ARINC
  • High 8.2
    CVE-2026-0994 Public exploit

    Denial of Service in Python Protobuf

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

    Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  • High 8.3
    CVE-2026-0603 Public exploit

    Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

    A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. T…

    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat OpenShift AI (RHOAI) Red Hat Data Grid 8 Maven
  • High 7.3
    CVE-2026-0776 Public exploit

    Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

    Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-pr…

    Discord Client
  • Critical 9.8
    CVE-2026-0770 Exploited Public exploit Scanner template EPSS 63%

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to e…

    Langflow Langflow langflow PyPI
    KEV Jul 21, 2026
  • Critical 9.8
    CVE-2026-0769 Public exploit EPSS 41%

    Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

    Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. T…

    Langflow Langflow
  • Critical 9.8
    CVE-2026-0768 Public exploit Scanner template EPSS 28%

    Langflow code Code Injection Remote Code Execution Vulnerability

    Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exist…

    Langflow Langflow