CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- unknown flextableFlexTable Google Sheets Connector < 3.19.2 - Admin+ Stored XSS3.5 Low
- radiustheme teamTeam < 5.0.11 - Unauthenticated SQLi8.6 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formUser strcpy buffer overflow8.7 High
- 1234n minicmsbg5sbk MiniCMS Article post-edit.php improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS Trash File Restore post.php improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS Publish page-edit.php improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS File Recovery Request page.php delete_page improper authentication6.9 Medium
- zhanglun letturazhanglun lettura RSS ContentRender.tsx cross site scripting2.3 Low
- milvus-io milvusmilvus HTTP Endpoint expr.go expr.Exec deserialization5.3 Medium
- wang.market wangmarketxnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting4.8 Medium
- wang.market wangmarketxnx3 wangmarket System Variables variableSave.do cross site scripting4.8 Medium
- sfturing hosp ordersfturing hosp_order orderHos findOrderHosNum sql injection5.3 Medium
- cld378632668 javamallcld378632668 JavaMall MinioController.java delete path traversal5.3 Medium
- kentico xperienceStored Cross-site Scripting (XSS) in Kentico Xperience 137.7 High
- cld378632668 javamallcld378632668 JavaMall MinioController.java upload unrestricted upload5.3 Medium
- evershopevershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API6.5 Medium
- evershopevershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API7.5 High
- passyAn issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands...9.1 Critical
- heytap internet browserAn issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary...5.4 Medium
- comfy comfyui-managerDuplicate Advisory: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)7.5 High
- zimbra collaboration, synacor zimbra collaboration suite (zcs), zimbra collaboration suite +2 moreZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS...7.2 High
- No product listedPLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to...4.3 Medium
- mega-fence project mega-fenceMega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF)...6.5 Medium
- samsung magicianAn issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates...7.8 High
- samsung exynos 1380 firmware, exynos 1480 firmware, exynos 1580 firmware +1 more +3 moreAn issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect...8.4 High
- samsung exynos 1330 firmware, exynos 1380 firmware, exynos 1480 firmware +3 more +5 moreAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos...7.1 High
- samsung exynos 1330 firmware, exynos 1380 firmware, exynos 1480 firmware +3 more +5 moreAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos...5.9 Medium
- samsung exynos 1330 firmware, exynos 1380 firmware, exynos 1480 firmware +3 more +5 moreAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos...6.2 Medium
- samsung exynos 1330 firmware, exynos 1380 firmware, exynos 1480 firmware +3 more +5 moreAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos...5.1 Medium
- samsung exynos 1380 firmware, exynos 1480 firmware, exynos 1580 firmware +1 more +3 moreAn issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400,...8.4 High
- samsung exynos 1080 firmware, exynos 1580 firmware, exynos 2400 firmware +8 more +10 moreAn issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos...7.5 High
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +16 more +18 moreAn issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980,...9.1 Critical
- code-projects online product reservation systemcode-projects Online Product Reservation System POST Parameter edit.php sql injection6.9 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System delete.php sql injection6.9 Medium
- crmebCRMEB product_export sql injection5.1 Medium
- crmebCRMEB product_list sql injection5.1 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System prod.php unrestricted upload5.3 Medium
- jfrog artifactory (workers)JFrog Artifactory Cross-Site Scripting4.9 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System Parameter prod.php sql injection6.9 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System Administrator Login adminlogin.php sql injection6.9 Medium
- yeqifu warehouseyeqifu warehouse Request UserController.java saveUserRole improper authorization5.3 Medium
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Audio Information Disclosure via API endpoint6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Authorization Bypass via Device Share API6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint6.9 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM Vulnerable to Username Enumeration w/ Password Recovery5.3 Medium
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller OS Command Injection8.7 High
- nuvation energy ncloud vpn serviceNuvation Energy nCloud Client-to-Client Communication9.4 Critical
- Show moreLoading…