Archive
January 2026
Vulnerabilities first published in this month (UTC), newest first.
91 results · Clear filters · Feed
-
High 8.6CVE-2025-4686 Public exploit
Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection. This issue affects Online Exam a…
-
High 8.8CVE-2026-24854 Public exploit
Church CRM has SQL injection in PaddleNumEditor.php
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection …
-
High 7.2CVE-2026-0709 Public exploit
Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input valid…
-
High 7.1CVE-2026-25126 Public exploit
PolarLearn's unvalidated vote direction allows vote count manipulation
PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation. TypeScript types are not enforced at runtime, so an at…
-
High 8.5CVE-2026-1457 Public exploit
Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385
An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with ele…
-
High 7.3CVE-2025-15545 Public exploit
Insufficient Backup File Upload Input Validation on TP-Link Archer RE605X
The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Suc…
-
High 7.8CVE-2025-69604 Public exploit
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to i…
-
High 8.8CVE-2025-69516 Public exploit
A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactic…
-
High 8.7CVE-2026-22243 Public exploit
EGroupware has SQL Injection in Nextmatch Filter Processing
EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenti…
-
High 8.1
SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
KEV Feb 12, 2026 -
High 7.5CVE-2025-69421 Public exploit
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processi…
-
High 7.5CVE-2025-69420 Public exploit
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStam…
-
High 7.4CVE-2025-69419 Public exploit
Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…
-
High 8.8
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…
-
High 7.5CVE-2020-36939 Public exploit
Cassandra Web 0.5.0 - Remote File Read
Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files…
-
High 8.1CVE-2026-21721 Public exploit
Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This i…
-
High 8.6CVE-2026-24486 Public exploit
Python-Multipart has Arbitrary File Write via Non-Default Configuration
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbi…
-
High 8.7CVE-2026-24480 Public exploit
QGIS had validated RCE and Repository Takeover via GitHub Actions
QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code executio…
-
High 7.8
Microsoft Office Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
KEV Jan 26, 2026 -
High 7.8CVE-2026-23010 Public exploit
ipv6: Fix use-after-free in inet6_addr_del().
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before…
-
High 7.8CVE-2026-23004 Public exploit
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_i…
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
High 7.8CVE-2026-23001 Public exploit
macvlan: fix possible UAF in macvlan_forward_source()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…
-
High 7.5CVE-2026-0911 Public exploit
Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes i…
-
High 8.7CVE-2026-24136 Public exploit
Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in …
-
High 8.4CVE-2021-47881 Public exploit
dataSIMS Avionics ARINC 664-1 - Local Buffer Overflow
dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to overwrite memory by manipulating the milstd1553result.txt file. Attackers can craft a malicious file with carefully constructed payload and ali…
-
High 8.2CVE-2026-0994 Public exploit
Denial of Service in Python Protobuf
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…
-
High 8.3CVE-2026-0603 Public exploit
Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. T…
-
High 7.3CVE-2026-0776 Public exploit
Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-pr…
-
High 8.5CVE-2025-68999 Public exploit
WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through <= …
-
High 7.1CVE-2025-67923 Public exploit
WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.
-
High 8.1CVE-2026-24009 Public exploit
Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting…
-
High 7.1CVE-2026-24049 Public exploit
wheel Allows Arbitrary File Permission Modification via Path Traversal
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…
-
High 7.5CVE-2025-67221 Public exploit
orjson does not limit recursion for deeply nested JSON documents
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
-
High 7.4CVE-2025-69821 Public exploit
An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service…
-
High 7.4CVE-2025-69822 Public exploit
An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive informat…
-
High 7.1CVE-2026-24046 Public exploit
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…
-
High 8.5CVE-2026-23499 Public exploit
Saleor vulnerable to stored XSS via Unrestricted File Upload
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or Apps to upload arbitrary files, including malicious HTML and SVG files containing Javascript. Dependi…
-
High 7.2CVE-2026-22849 Public exploit
Saleor lacks proper HTML sanitization in rich text fields
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perfor…
-
High 8.8CVE-2026-22807 Public exploit
vLLM affected by RCE via auto_map dynamic module loading during model initialization
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attack…