CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- openprojectOpenProject is Vulnerable to Code Execution in E-Mail function8.6 High
- openprojectOpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder9.1 Critical
- nasa cryptolibCryptoLib Has Heap Buffer Overflow Vulnerability in KMC Base64 Decode Handling (KMC JSON base64ciphertext/base64cleartext)7.5 High
- nasa cryptolibCryptoLib Vulnerable to Heap Buffer Overflow in MariaDB SA Hexstring Conversion5.7 Medium
- nasa cryptolibCryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion8.2 High
- nasa cryptolibCryptoLib Memory Leak on HTTP Error Response in KMC Client6.3 Medium
- nasa cryptolibCryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion6.3 Medium
- nasa cryptolibCryptoLib Has Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern8.2 High
- nasa cryptolibCryptoLib Has Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern8.2 High
- nasa cryptolibCryptoLib has an out-of-bounds read and crash vulnerability when decoding an empty Base64url string4.7 Medium
- nasa cryptolibCryptoLib Has Out-of-bounds Read in Crypto_AOS_ProcessSecurity8.2 High
- nasa cryptolibCryptoLib Has Out-of-Bounds Write in Crypto_Config_Add_Gvcid_Managed_Parameters7.3 High
- rustcrypto elliptic-curves, sm2 elliptic curve +1 moreRustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()7.5 High
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection9.3 Critical
- trailofbits ficklingFickling vulnerable to detection bypass due to "builtins" blindness8.9 High
- rustcrypto elliptic-curves, sm2 elliptic curve +1 moreRustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability8.7 High
- salesforce uni2tsSalesforce Uni2TS has a Code Injection vulnerability9.8 Critical
- sangfor operation and maintenance management systemSangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection9.3 Critical
- sangfor operation and maintenance management systemSangfor Operation and Maintenance Management System VersionController.java uploadCN os command injection8.7 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- palantir com.palantir.acme:dossier-app, com.palantir.acme:gotham-default-apps-bundle, com.palantir.acme:stencil-app-bundle +2 moreUnder certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended…3.5 Low
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved memory handling. This issue is fixed in tvOS 26.2, Safari...6.5 Medium
- apple ipados, macos, safari +5 more +7 moreA memory initialization issue was addressed with improved memory handling. This issue is fixed in...4.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS...4.3 Medium
- trailofbits ficklingFickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist8.9 High
- amazon kiro ideCommand Injection in Kiro GitLab Merge Request Helper8.4 High
- trailofbits ficklingFickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection8.9 High
- trailofbits ficklingFickling Blocklist Bypass: cProfile.run()8.9 High
- trailofbits ficklingFickling has a bypass via runpy.run_path() and runpy.run_module()8.9 High
- octobercms octoberOctober CMS Vulnerable to Stored XSS via Branding Styles6.1 Medium
- py-pdf pypdfpypdf has possible long runtimes for malformed startxref2.7 Low
- py-pdf pypdfpypdf has possible long runtimes for missing /Root object with large /Size values2.7 Low
github.com/beatt83/jose-swiftSwiftURLjose-swift has JWT Signature Verification Bypass via None Algorithm8.8 High- tencent weknoraWeKnora has Command Injection in MCP stdio test10.0 Critical
- tencent weknoraWeKnora vulnerable to SQL Injection5.6 Medium
- aws aws-sdk-netAWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value3.7 Low
- angular, siemens ruggedcom rst2428p, sidis prime +2 moreAngular has XSS Vulnerability via Unsanitized SVG Script Attributes8.5 High
- xwiki full calendar macro, xwiki-contrib macro-fullcalendar +1 moreXWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService10.0 Critical
- xwiki full calendar macro, xwiki-contrib macro-fullcalendar +1 moreXWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService5.3 Medium
- octobercms octoberOctober CMS Vulnerable to Stored XSS via Editor and Branding Styles6.1 Medium
- tp-link systems inc. archer axe75 v1.6, tp-link archer axe75 firmware +1 moreArbitrary File Deletion Vulnerability in TP-Link Archer AXE756.9 Medium
- guchengwuyue yshopmallguchengwuyue yshopmall jobs getPage sql injection5.3 Medium
- biggidroid simple php cmsBiggiDroid Simple PHP CMS editsite.php unrestricted upload5.1 Medium
- accessally, inc. accessallyAccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution9.3 Critical
- docsys project docsysRainyGao DocSys UserMapper.xml sql injection5.3 Medium
- docsys project docsysRainyGao DocSys ReposAuthMapper.xml sql injection5.3 Medium
- gestsupGestSup < 3.2.60 SQL Injection in Ticket Creation7.7 High
- gestsupGestSup < 3.2.60 Stored XSS in API Error Logs5.1 Medium
- gestsupGestSup < 3.2.60 Multiple SQL Injections in Asset List7.5 High
- gestsupGestSup < 3.2.60 SQL Injection in Search Bar7.7 High
- Show moreLoading…