CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.3 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.3 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.3 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.3 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero4.9 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero1.3 Low
- qnap qumagieQuMagie2.2 Low
- pluxmlPluXml Media Management medias.php __destruct deserialization5.1 Medium
- code-projects content management systemcode-projects Content Management System delete.php sql injection6.9 Medium
- phpgurukul online course registrationPHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload5.3 Medium
- code-projects content management systemcode-projects Content Management System search.php sql injection6.9 Medium
- ligerosmartLigeroSmart Environment Variable cross site scripting5.1 Medium
- yonyou ksoaYonyou KSOA work_edit.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA work_update.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA PrintZPYG.jsp sql injection6.9 Medium
- yeqifu carrentalyeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal6.9 Medium
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formFtpServerDirConfig strcpy buffer overflow8.7 High
- ninjaforms ninja formsNinja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure5.3 Medium
- unknown shopbuilderShopbuilder < 3.2.2 - Reflected XSS6.1 Medium
- logichunt logo sliderLogo Slider < 4.9.0 - Contributor+ Stored XSS6.1 Medium
- iqonicdesign wpbookitWPBookit <= 1.0.7 - Customer Deletion via CSRF6.5 Medium
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formFtpServerShareDirSelcet strcpy buffer overflow8.7 High
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formConfigCliForEngineerOnly strcpy buffer overflow8.7 High
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formRemoteControl strcpy buffer overflow8.7 High
- jackying h-ui.adminjackying H-ui.admin preview.php unrestricted upload6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter del_user.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injection6.9 Medium
- empiresoft empirecmsEmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload5.3 Medium
- wpmudev branda – white label & branding, free login page customizerBranda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationWP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion5.3 Medium
- empiresoft empirecmsEmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA agent_work_report.jsp sql injection6.9 Medium
- open5gsOpen5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of service4.8 Medium
- gpsd project gpsd, red hat enterprise linux 10, enterprise linux 9 +2 moreAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of...7.5 High
- gpsd project gpsd, red hat enterprise linux 10, enterprise linux 10.0 extended update support +1 more +3 moregpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers...9.8 Critical
- vatilon pa4 firmwareAn issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files...7.5 High
- Show moreLoading…