CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
fluent-bitOSS-FuzzHeap-buffer-overflow in cmt_mpack_consume_uint_tagNo score- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access7.9 High
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller Private Key Stored on Device7.2 High
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller Authentication Bypass10.0 Critical
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller OS Command Injection9.4 Critical
- nuvation energy battery management systemNuvation Energy BMS Client-side Authentication9.3 Critical
- knadh listmonklistmonk Vulnerable to Stored XSS Leading to Admin Account Takeover5.4 Medium
- msgpack messagepack, msgpack-java +1 moreMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation7.5 High
- bagistoBagisto has SSTI in parameter that can lead to RCE7.3 High
- bagistoBagisto has HTML Filter Bypass that Enables Stored XSS5.2 Medium
- bagistoBagisto has SSTI via first and last name from low-privilege user (not admin)7.4 High
- bagistoBagisto has Normal & Blind SSTI from low-privilege user when ordering product8.9 High
- bagistoBagisto has IDOR in Customer Order Reorder Functionality7.1 High
- yeqifu warehouseyeqifu warehouse AppFileUtils.java createResponseEntity path traversal5.3 Medium
- bagistoBagisto Missing Authentication on Installer API Endpoints8.8 High
- langflowLangflow Missing Authentication on Critical API Endpoints8.8 High
- libtpms project libtpmslibtpms returns wrong initialization vector when certain symmetric ciphers are used5.5 Medium
- code-projects online music sitecode-projects Online Music Site Feedback.php sql injection6.9 Medium
- emlogEmlog vulnerable to Server-Side Request Forgery (SSRF)7.7 High
- emlogEmlog has stored Cross-site Scripting issue that can lead to admin or another account ATO6.8 Medium
- adonisjs coreAdonisJS Path Traversal in Multipart File Handling9.2 Critical
- emlogEmlog vulnerable to stored Cross-site Scripting via image name2.0 Low
- emlogEmlog: CSRF chained with stored XSS leads to ATO7.0 High
- code-projects online music sitecode-projects Online Music Site AlbumByCategory.php sql injection6.9 Medium
- code-projects online music sitecode-projects Online Music Site ViewSongs.php sql injection6.9 Medium
- code-projects content management systemcode-projects Content Management System pages.php sql injection6.9 Medium
- emlogEmlog has Broken Access Control (BAC)2.0 Low
- icewhale casaosCasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure6.9 Medium
- daptinDaptin Aggregate API resource_aggregate.go goqu.L sql injection5.3 Medium
- plex media server, plex.tv backend +1 moreIn the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token...5.0 Medium
- plex media server, plex.tv backend +1 moreIn the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token...5.0 Medium
- plex media serverIn Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device...7.1 High
- plex media serverPlex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a ...8.5 High
- code-projects content management systemcode-projects Content Management System edit_posts.php unrestricted upload5.1 Medium
- qnap hyper data protectorHyper Data Protector8.1 High
- qnap hybrid backup sync, qnap systems inc. hbs 3 hybrid backup sync +1 moreHBS 3 Hybrid Backup Sync7.0 High
- qnap hybrid backup sync, qnap systems inc. hbs 3 hybrid backup sync +1 moreHBS 3 Hybrid Backup Sync7.0 High
- qnap malware removerMalware Remover8.1 High
- makeplane planeIn plane.io, a Guest User to a Workspace can still be able to see list of members4.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap systems inc. mars (multi-application recovery service)MARS (Multi-Application Recovery Service)8.1 High
- qnap qfilingQfiling8.1 High
- qnap qts, quts hero +1 moreQTS, QuTS hero6.9 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- qnap license centerLicense Center1.2 Low
- qnap systems inc. qfinder pro mac, qsync for mac, qvpn device client for mac +2 moreQfinder Pro, Qsync, QVPN4.4 Medium
- qnap license centerLicense Center1.3 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero2.7 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- Show moreLoading…