CVEs published in January 2026
4,392 vulnerabilities, 438 critical, 16 exploited.
- sunfounder pironman dashboard (pm dashboard) SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion 9.3 Critical
- ays-pro popup box – create countdown, coupon, video, contact form popups Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change 4.3 Medium
- hayyatapps sell btc – cryptocurrency selling calculator Sell BTC - Cryptocurrency Selling Calculator <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action 7.2 High
- linux drm/gud: fix NULL fb and crtc dereferences on USB disconnect No score
- linux, siemens ruggedcom rst2428p, simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() 2.0 Low
- linux, siemens ruggedcom rst2428p +1 more can: etas_es58x: allow partial RX URB allocation to succeed No score
- linux btrfs: release path before iget_failed() in btrfs_read_locked_inode() No score
- linux net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv 5.6 Medium
- linux drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 No score
- linux, siemens ruggedcom rst2428p +1 more dmaengine: omap-dma: fix dma_pool resource leak in error paths 9.8 Critical
- linux, siemens ruggedcom rst2428p +1 more null_blk: fix kmemleak by releasing references to fault configfs items 7.8 High
- linux, siemens ruggedcom rst2428p +1 more can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak 6.7 Medium
- linux, siemens ruggedcom rst2428p +1 more phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() No score
- linux LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() No score
- linux LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() No score
- linux LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() No score
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 more dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() 5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +2 more mm/page_alloc: prevent pcp corruption with SMP=n 7.8 High
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 more dmaengine: at_hdmac: fix device leak on of_dma_xlate() 5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 more dmaengine: bcm-sba-raid: fix device leak on probe 5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 more dmaengine: dw: dmamux: fix OF node leak on route allocation failure 5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +2 more dmaengine: lpc18xx-dmamux: fix device leak on route allocation 5.5 Medium
- linux, linux kernel +1 more dmaengine: sh: rz-dmac: fix device leak on probe failure 5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 more dmaengine: stm32: dmamux: fix device leak on route allocation 5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 more dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation 5.5 Medium
- linux, linux kernel +1 more idpf: fix memory leak of flow steer list on rmmod 5.5 Medium
- linux, linux kernel +1 more idpf: fix memory leak in idpf_vport_rel() 5.5 Medium
- linux, linux kernel +1 more idpf: fix memory leak in idpf_vc_core_deinit() 5.5 Medium
- linux, linux kernel +1 more net: usb: pegasus: fix memory leak in update_eth_regs_async() 5.5 Medium
- linux, linux kernel +1 more net: 3com: 3c59x: fix possible null dereference in vortex_probe1() 5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more net: marvell: prestera: fix NULL dereference on devlink_alloc() failure 5.5 Medium
- linux, linux kernel +1 more btrfs: release path before initializing extent tree in btrfs_read_locked_inode() 5.5 Medium
- linux, linux kernel +1 more idpf: fix error handling in the init_task on load 5.5 Medium
- linux, linux kernel +1 more inet: frags: drop fraglist conntrack references 5.5 Medium
- linux, linux kernel +1 more gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths 5.5 Medium
- linux, linux kernel +1 more btrfs: fix NULL dereference on root when tracing inode eviction 5.5 Medium
- linux, linux kernel +1 more btrfs: always detect conflicting inodes when logging inode refs 9.1 Critical
- linux, linux kernel +1 more can: j1939: make j1939_session_activate() fail if device is no longer registered 5.5 Medium
- linux, linux kernel +1 more rust_binder: remove spin_lock() in rust_shrink_free_page() 5.5 Medium
- linux, linux kernel +1 more counter: interrupt-cnt: Drop IRQF_NO_THREAD flag 5.5 Medium
- psmplugins supportcandy – helpdesk & customer support ticket system SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference 5.4 Medium
- psmplugins supportcandy – helpdesk & customer support ticket system SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter 6.5 Medium
- dcooney ajax load more – infinite scroll, load more, & lazy load Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure 5.3 Medium
- wpdevelop booking calendar Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure 5.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure 5.3 Medium
-
gpsdOSS-Fuzz Use-of-uninitialized-value in aivdm_analyze No score -
gpsdOSS-Fuzz Use-of-uninitialized-value in ntrip_parse_url No score - hotcrp HotCRP vulnerable to stored XSS via comment attachments 7.3 High
- sunnygkp10 online-exam-system, online-exam-system- +1 more Online-Exam-System 2015 - 'fid' SQL Injection 8.8 High
- crystal shard http-protection Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass 6.9 Medium
- Show olderLoading…