Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

1,804 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-15405

    PHPEMS cross-site request forgery

    A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely.

  • Medium 6.3
    CVE-2025-15404

    campcodes School File Management System save_file.php unrestricted upload

    A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.php. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated …

    Campcodes School File Management System
  • Medium 5.3
    CVE-2025-13820

    Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover

    The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.

    Web / CMS
  • Medium 5.3
    CVE-2025-69413

    Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

    In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

    Gitea Gitea code.gitea.io/gitea Go