Skip to content
OpenAdvisories

Archive

26 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /26 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 6.8
    CVE-2025-14973

    Recipe Card Blocks < 3.4.13 - Contributor+ SQLi

    The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.

    Web / CMS
  • Medium 4.7
    CVE-2026-1419 EPSS 17%

    D-Link DCS700l Web Form setDayNightMode command injection

    A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may…

    D-Link DCS700l Network devices
  • Medium 5.3
    CVE-2026-1418

    GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write

    A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack nee…

    gpac gpac Debian Ubuntu
  • Medium 6.3
    CVE-2026-1414

    Sangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection

    A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation o…

    Sangfor Operation and Maintenance Security Management System
  • Medium 6.3
    CVE-2026-1413

    Sangfor Operation and Maintenance Security Management System HTTP POST Request port_validate portValidate command injection

    A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performing a manipulation of…

    Sangfor Operation and Maintenance Security Management System
  • Medium 6.1
    CVE-2026-1411

    Beetel 777VR1 UART access control

    A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The…

    Beetel 777VR1
  • Medium 6.4
    CVE-2026-1410

    Beetel 777VR1 UART missing authentication

    A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation results in missing authentication. An attack on the physical device is feasible. This attack is charact…

    Beetel 777VR1
  • Medium 5.5
    CVE-2025-50537

    Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/sh…

    prism vitess-23 eslint Ubuntu Wolfi
  • Medium 5.4
    CVE-2025-70368 Public exploit

    Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An at…