Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

212 results · Clear filters · Feed

  • High 8.6
    CVE-2025-14124 Public exploit Scanner template

    Team < 5.0.11 - Unauthenticated SQLi

    The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

    Web / CMS
  • High 7.5
    CVE-2025-67303 Public exploit Scanner template

    ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

    An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web…

    comfyui-manager PyPI
  • Medium 6.9
    CVE-2025-34171 Public exploit

    CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure

    CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path par…

    IceWhale Tech CasaOS
  • Critical 9.2
    CVE-2026-21440 Public exploit

    AdonisJS Path Traversal in Multipart File Handling

    AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through ve…

    adonisjs core @adonisjs/bodyparser npm
  • Critical 9.8
    CVE-2025-14998 Public exploit Scanner template

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

    The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

    WPMU DEV Branda – White Label & Branding, Free Login Page Customizer Web / CMS
  • Medium 5.3
    CVE-2024-55374 Public exploit

    REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.

  • High 7.5
    CVE-2025-67160 Public exploit

    An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traver…

  • High 7.5
    CVE-2025-67158 Public exploit

    An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attacke…

  • High 7.5
    CVE-2025-67159 Public exploit

    Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.

  • Low 2.0
    CVE-2026-21437 Public exploit

    eopkg vulnerable to package file list integrity bypass

    eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such pac…

    getsolus eopkg
  • Medium 5.8
    CVE-2026-21436 Public exploit

    eopkg has Path Traversal: '../filedir' vulnerability

    eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages …

    getsolus eopkg
  • Critical 9.7
    CVE-2025-66398 Public exploit EPSS 20%

    Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the at…

    SignalK signalk-server signalk-server npm