Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

47 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-12030 Public exploit

    ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification

    The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the c…

    airesvsg ACF to REST API Web / CMS
  • Medium 5.3
    CVE-2025-15474 Public exploit

    AuntyFey Smart Combination Lock BLE Connection Flood DoS

    AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connect…

    AuntyFey AuntyFey Smart Combination Lock
  • Medium 6.8
    CVE-2025-66837 Public exploit

    A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafte…

  • Medium 6.5
    CVE-2025-66838 Public exploit

    In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, …

  • Medium 6.9
    CVE-2025-34171 Public exploit

    CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure

    CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path par…

    IceWhale Tech CasaOS
  • Medium 5.3
    CVE-2024-55374 Public exploit

    REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.

  • Medium 5.8
    CVE-2026-21436 Public exploit

    eopkg has Path Traversal: '../filedir' vulnerability

    eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages …

    getsolus eopkg