Skip to content
OpenAdvisories

Archive

28 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /28 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-24897 Public exploit

    Authenticated Remote Code Execution via Arbitrary File Upload

    Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By spec…

    ErugoOSS Erugo
  • High 8.7
    CVE-2026-22243 Public exploit

    EGroupware has SQL Injection in Nextmatch Filter Processing

    EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenti…

    EGroupware egroupware egroupware/egroupware Packagist
  • Critical 9.8
    CVE-2026-1056 Public exploit EPSS 13%

    Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal

    The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attac…

    inc2734 Snow Monkey Forms Web / CMS
  • Critical 9.8
    CVE-2025-40554 Public exploit Scanner template EPSS 61%

    SolarWinds Web Help Desk Authentication Bypass Vulnerability

    SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

    SolarWinds Web Help Desk
  • Critical 9.8
    CVE-2025-40552 Public exploit Scanner template EPSS 52%

    SolarWinds Web Help Desk Authentication Bypass Vulnerability

    SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.

    SolarWinds Web Help Desk
  • Critical 9.8
    CVE-2025-40551 Exploited Public exploit Scanner template EPSS 84%

    SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

    SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

    SolarWinds Web Help Desk
    KEV Feb 3, 2026
  • High 8.1
    CVE-2025-40536 Exploited Public exploit Scanner template EPSS 74%

    SolarWinds Web Help Desk Security Control Bypass Vulnerability

    SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

    SolarWinds Web Help Desk
    KEV Feb 12, 2026
  • Critical 9.9
    CVE-2026-24841 Public exploit

    Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint

    Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are direct…

    Dokploy dokploy
  • Medium 4.8
    CVE-2025-70336 Public exploit

    A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote att…