CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- axtion odisA DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute...6.5 Medium
- go-shiori shioriShiori is vulnerable to authentication bypass via a brute force attack6.5 Medium
- fluidsynthfluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in...7.5 High
- xiaoliuchu pss.sale.comSQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php...6.5 Medium
- the wikimedia foundation mediawiki - monaco skini18n XSS, DoS and config SQLI in Monaco2.3 Low
- the wikimedia foundation mediawiki - wikibase extension, wikimedia wikibase +1 moreStored XSS through autocomment system messages in Wikibase2.3 Low
- phpgurukul online course registration systemPHPGurukul Online Course Registration System manage-students.php sql injection5.3 Medium
- d-link di-8200g, dlink di-8200g firmware +1 moreD-Link DI-8200G upgrade_filter.asp command injection5.3 Medium
- totolink wa1200, wa1200-poe, wa1200-poe firmware +2 moreTOTOLINK WA1200 HTTP Request cstecgi.cgi null pointer dereference6.9 Medium
github.com/awslabs/aws-sdk-swiftSwiftURLAWS SDK for Swift adopted defense in depth enhancement for region parameter value3.7 Lowaws-sdknpmJavaScript SDK v2 users should add validation to the region parameter value in or migrate to v33.7 Low- phpgurukul staff leave management systemPHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting4.8 Medium
@smithy/config-resolvernpmAWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value3.7 Low- vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 morevLLM - Denial of Service via Unvalidated Multimodal Embeddings8.7 High
aws-sdk-accessanalyzercrates.io,aws-sdk-accountcrates.io,aws-sdk-acmcrates.io +197 more +199 moreAWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value3.7 Low- ghostGhost has SQL Injection in Members Activity Feed6.7 Medium
- ghostGhost has SSRF via External Media Inliner5.1 Medium
- ghostGhost has Staff Token permission bypass8.1 High
- carmelo intern membership management systemcode-projects Intern Membership Management System add_activity.php sql injection5.1 Medium
- ghostGhost has Staff 2FA bypass8.1 High
- spreeSpree API has Unauthenticated IDOR - Guest Address7.5 High
- neeraj slit brevo for woocommerceBrevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting7.2 High
shakapackernpmShakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles7.5 High- yintibao fun print mobile, fun print +1 moreKL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking7.5 High
- @tanstack react-router, shopify remix-run\/react +1 moreReact Router has CSRF issue in Action/Server Action Request Processing6.5 Medium
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open Redirects8.0 High
- spreeSpree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification6.5 Medium
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router SSR XSS in ScrollRestoration8.2 High
- @tanstack react-routerReact Router has unexpected external redirect via untrusted paths6.5 Medium
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session Storage9.1 Critical
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router has XSS Vulnerability7.6 High
- carmelo intern membership management systemcode-projects Intern Membership Management System delete_admin.php sql injection5.1 Medium
- devolutions remote desktop managerExposure of sensitive information in the TeamViewer entry dashboard component in Devolutions...3.3 Low
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve is missing an authorization check in LFS lock deletion5.4 Medium
- pallets werkzeugWerkzeug safe_join() allows Windows special device names with compound extensions6.3 Medium
- salvoSalvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names8.8 High
- salvoSalvo is vulnerable to reflected XSS in the list_html function8.8 High
- getkirby kirbyKirby is missing permission checks in the content changes API5.8 Medium
- authlibAuthlib: 1-click Account Takeover5.7 Medium
- mmaitre314 picklescanpicklescan - Arbitrary File Read via Unsafe Pickle Deserialization8.7 High
- opexus ecomplaint, opexustech ecase ecomplaint +1 moreOPEXUS eComplaint IDOR8.7 High
- opexus ecase portalOPEXUS eCasePortal unauthenticated IDOR9.3 Critical
- opexus ecase auditOPEXUS eCASE Audit Project Cost stored XSS4.8 Medium
- opexus ecase auditOPEXUS eCASE Audit Project Setup stored XSS4.8 Medium
- opexus ecase auditOPEXUS eCASE Audit Document Check Out stored XSS4.8 Medium
- opexus ecase auditOPEXUS eCASE Audit incorrect access control7.2 High
- ideagen devonwayIdeagen DevonWay Reports page stored XSS4.8 Medium
- re galleryWordPress Re Gallery plugin <= 1.18.9 - Broken Access Control vulnerability5.3 Medium
- baqend speed kitWordPress Speed Kit plugin <= 2.0.2 - Broken Access Control vulnerability4.3 Medium
- ideabox creations dashboard welcome for beaver builderWordPress Dashboard Welcome for Beaver Builder plugin <= 1.0.8 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…