Skip to content
OpenAdvisories

Archive

29 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /29 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-25126 Public exploit

    PolarLearn's unvalidated vote direction allows vote count manipulation

    PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation. TypeScript types are not enforced at runtime, so an at…

    polarnl PolarLearn
  • Critical 9.4
    CVE-2026-25047 Public exploit

    deepHas vulnerable to Prototype Pollution via constructor.prototype

    deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was f…

    sharpred deepHas deephas npm
  • Critical 9.8
    CVE-2026-1340 Exploited Public exploit Scanner template EPSS 99%

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    ivanti Endpoint Manager Mobile Network devices
    KEV Apr 8, 2026
  • Critical 9.8
    CVE-2026-1281 Exploited Public exploit Scanner template EPSS 99%

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    ivanti Endpoint Manager Mobile Network devices
    KEV Jan 29, 2026
  • High 8.5
    CVE-2026-1457 Public exploit

    Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385

    An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with ele…

    TP-Link Systems VIGI C485 V1 Network devices
  • High 7.3
    CVE-2025-15545 Public exploit

    Insufficient Backup File Upload Input Validation on TP-Link Archer RE605X

    The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Suc…

    TP-Link Systems Archer RE605X Network devices
  • High 7.8
    CVE-2025-69604 Public exploit

    An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to i…

  • High 8.8
    CVE-2025-69516 Public exploit

    A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactic…