CVEs published January 20, 2026
77,396 CVEs in 2026
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy…
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled.
A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.
SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command.
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal).
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to the database using hardcoded database…
Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain potentially sensitive information via a network log…
node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3.
Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in…
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
ImageMagick is free and open-source software used for editing and manipulating digital images.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Security Management System).
The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via deserialization of untrusted input in the…
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX).
A security flaw has been discovered in CRMEB up to 5.6.3.
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling…
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud).
Vulnerability in the SQLcl component of Oracle Database Server.
ImageMagick is free and open-source software used for editing and manipulating digital images.
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow.
Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform).
Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing).
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).
Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).
HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver.
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters.
Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset
The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up to, and including, 3.2.2…
The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to insufficient input…
A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0.
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).
HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver.
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver.
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages.
User-controlled header names and values containing newlines can allow injecting HTTP headers.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver).
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt.
A weakness has been identified in CRMEB up to 5.6.3.
ImageMagick is free and open-source software used for editing and manipulating digital images.
Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications).
Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App).
Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General).
Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security…
Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in…
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).
A security flaw has been discovered in MineAdmin 1.x/2.x.
The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .
HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an HTML injection due to a lack of proper validation of user input by sending a request…
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems).
A weakness has been identified in MineAdmin 1.x/2.x.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authenticated remote attackers to…
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
Vulnerability in the Java VM component of Oracle Database Server.
The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping.
The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to insufficient input…
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0.
The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and…
Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent).
Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent).
Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security).
Vulnerability in Oracle Java SE (component: JavaFX).
A vulnerability was detected in MineAdmin 1.x/2.x.
A security vulnerability has been detected in MineAdmin 1.x/2.x.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings.
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems).