CVEs published January 2, 2026

Which can lead to remote code execution or another exploitation.

Versions prior to 2.3.10 are vulnerable to server-side template injection.

API routes remain active even after initial installation is complete.

Article creation functionality is vulnerable to cross-site request forgery (CSRF).

A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem.

Multiple critical API endpoints in Langflow are missing authentication controls.

Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user.

A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor.

Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files.

A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths.

A vulnerability was found in code-projects Online Music Site 1.0.

A vulnerability has been found in code-projects Online Music Site 1.0.

A flaw has been found in code-projects Online Music Site 1.0.

A vulnerability was detected in code-projects Content Management System 1.0.

A weakness has been identified in code-projects Content Management System 1.0.

A vulnerability was determined in code-projects Content Management System 1.0.

An Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by…

A vulnerability was found in PHPGurukul Online Course Registration up to 3.1.

libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1.

Lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates.

Including takeover of admin accounts.

Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an article.

A security vulnerability has been detected in code-projects Content Management System 1.0.

The admin can set controls which makes users unable to edit or delete their articles after publishing them.

A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4.