Skip to content
OpenAdvisories

Archive

30 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /30 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-36001 Public exploit

    IBM Db2 Denial of Service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Critical 9.7
    CVE-2026-25130 Public exploit

    Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool

    Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell c…

    aliasrobotics cai cai-framework PyPI
  • Critical 9.2
    CVE-2025-24293 Public exploit

    Active Storage allowed transformation methods that were potentially unsafe

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumven…

    rails activestorage rails rails Debian Ubuntu RubyGems
  • High 8.6
    CVE-2025-4686 Public exploit

    Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection. This issue affects Online Exam a…

    Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment
  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm
  • High 8.8
    CVE-2026-24854 Public exploit

    Church CRM has SQL injection in PaddleNumEditor.php

    ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection …

    ChurchCRM CRM
  • High 7.2
    CVE-2026-0709 Public exploit

    Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input valid…

    Hikvision DS-3WAP522-SI DS-3WAP622E-SI DS-3WAP622G-SI
  • Critical 10.0
    CVE-2026-1699 Public exploit

    In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_ta…

    Eclipse Foundation Eclipse Theia - Website
  • Low 3.2
    CVE-2026-25211 Public exploit

    Llama Stack exposes secret in initialization log

    Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

    llamastack Llama Stack llama-stack PyPI