Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

91 results · Clear filters · Feed

  • High 7.3
    CVE-2026-22241 Public exploit

    Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

    The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbit…

    gunet openeclass
  • High 7.5
    CVE-2025-65518 Public exploit

    Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability …

  • High 8.3
    CVE-2026-21857 Public exploit

    Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

    REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not val…

    redaxo redaxo redaxo/source Packagist
  • High 8.8
    CVE-2025-68705 Public exploit

    RustFS Path Traversal Vulnerability

    RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.

    rustfs rustfs rustfs crates.io
  • High 8.1
    CVE-2025-69080 Public exploit

    WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.

    JanStudio Gecko
  • High 8.8
    CVE-2026-0628 Public exploit EPSS 21%

    Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinc…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
  • High 8.6
    CVE-2025-14124 Public exploit Scanner template

    Team < 5.0.11 - Unauthenticated SQLi

    The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

    Web / CMS
  • High 7.5
    CVE-2025-67303 Public exploit Scanner template

    ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

    An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web…

    comfyui-manager PyPI
  • High 7.5
    CVE-2025-67160 Public exploit

    An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traver…

  • High 7.5
    CVE-2025-67158 Public exploit

    An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attacke…

  • High 7.5
    CVE-2025-67159 Public exploit

    Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.