Archive
January 2026
Vulnerabilities first published in this month (UTC), newest first.
212 results · Clear filters · Feed
-
Critical 9.8CVE-2025-66802 Public exploit
Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receiv…
-
Critical 9.4CVE-2025-67146 Public exploit
Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1…
-
Critical 10.0CVE-2025-63314 Public exploit
A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to …
-
High 8.1
Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
-
Medium 6.3CVE-2026-0842 Public exploit
Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication
A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing authentication. The attack can only be done within the local network. The exploit…
-
High 7.5
ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead …
-
High 8.1CVE-2026-22704 Public exploit
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
-
High 8.5CVE-2026-22610 Public exploit
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in …
-
High 8.1CVE-2026-22594 Public exploit
Ghost has Staff 2FA bypass
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.
-
Critical 9.1
React Router has Path Traversal in File Session Storage
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/no…
-
High 7.6CVE-2025-59057 Public exploit
React Router has XSS Vulnerability
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags whi…
-
Medium 6.3CVE-2026-22024 Public exploit
CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the …
-
Medium 4.7CVE-2025-15495 Public exploit
BiggiDroid Simple PHP CMS editsite.php unrestricted upload
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made…
-
Critical 9.8CVE-2025-14598 Public exploit
CVE-2025-14598
BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.
-
Medium 6.5CVE-2025-14172 Public exploit
WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_tri…
-
High 8.8CVE-2025-69194 Public exploit
Wget2: arbitrary file write via metalink path traversal in gnu wget2
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the s…
-
Medium 6.4CVE-2025-14893 Public exploit
IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter
The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac…
-
Critical 9.8CVE-2025-14736 Public exploit
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'ge…
-
High 8.2CVE-2025-67070 Public exploit
A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker…
-
Critical 9.0CVE-2025-59470 Public exploit
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a ma…
-
High 7.3CVE-2026-22241 Public exploit
Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbit…
-
Critical 9.3
OWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …
-
Critical 10.0
n8n is vulnerable to Remote Code Execution via Arbitrary File Write
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instan…
-
Critical 9.8CVE-2025-67325 Public exploit
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticate…
-
Critical 9.8CVE-2025-61246 Public exploit
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId para…
-
High 7.5CVE-2025-65518 Public exploit
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability …
-
Medium 6.8CVE-2025-65731 Public exploit
An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attack…
-
Critical 10.0
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an u…
-
High 8.3CVE-2026-21857 Public exploit
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not val…
-
High 8.8CVE-2025-68705 Public exploit
RustFS Path Traversal Vulnerability
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.
-
Medium 6.8CVE-2026-22187 Public exploit
Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files
Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated wit…
-
High 8.1CVE-2025-69080 Public exploit
WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.
-
Medium 4.3CVE-2025-12030 Public exploit
ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the c…
-
Medium 5.3CVE-2025-15474 Public exploit
AuntyFey Smart Combination Lock BLE Connection Flood DoS
AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connect…
-
Medium 6.8CVE-2025-66837 Public exploit
A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafte…
-
Medium 6.5CVE-2025-66838 Public exploit
In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, …
-
High 8.8
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinc…
-
Critical 9.8CVE-2025-15001 Public exploit
FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. Thi…
-
Critical 9.2CVE-2025-68428 Public exploit
jsPDF has Local File Inclusion/Path Traversal vulnerability
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loa…
-
Critical 9.4CVE-2025-64424 Public exploit
Colify has command injection vulnerability in project git source
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low …