CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- avahiAvahi has a reachable assertion in avahi_wide_area_scan_cache5.5 Medium
- espressif esp-usb, usb host hid driver +1 moreespressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path6.4 Medium
- espressif esp-usb, usb host hid driver +1 moreEspressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability6.8 Medium
- netapp ontap, ontap 9 +1 moreONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking...6.9 Medium
- espressif esp-usb, usb host uvc class driver +1 moreEspressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing6.8 Medium
- weblate wlcwlc can skip SSL verification2.5 Low
- humansignal label studio, label-studio +1 moreLabel Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field8.6 High
- mindsdbMindsDB has improper sanitation of filepath that leads to information disclosure and DOS8.1 High
- mrvladus errandsErrands before 46.2.10 does not verify TLS certificates for CalDAV servers.8.2 High
- viafirma documents, documents compose +1 moreMultiple vulnerabilities in Viafirma products8.7 High
- viafirma inboxMultiple vulnerabilities in Viafirma products8.6 High
- imaster mems events crmMultiple vulnerabilities in Imaster products Open configuration options9.3 Critical
- imaster mems events crmMultiple vulnerabilities in Imaster products Open configuration options8.7 High
- code-projects patient record management systemMultiple vulnerabilities in Imaster products Open configuration options8.7 High
- code-projects patient record management systemMultiple vulnerabilities in Imaster products Open configuration options5.1 Medium
- workdo ecommercego saasMultiple vulnerabilities in WorkDo products5.1 Medium
- workdo ecommercego saasMultiple vulnerabilities in WorkDo products5.1 Medium
- workdo ticketgoMultiple vulnerabilities in WorkDo products5.1 Medium
- workdo hrmgoMultiple vulnerabilities in WorkDo products5.1 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreDNS Rebinding Vulnerability in mlflow/mlflow8.1 High
- merit lilin ipd, ipr, ld +6 more +8 moreMerit LILIN｜IP Camera - OS Command Injection8.7 High
- ays pro quiz makerQuiz Maker < 6.7.0.89 - Admin+ Stored XSS4.8 Medium
- merit lilin dh032, dvr708, dvr716 +17 more +19 moreMerit LILIN｜NVR - OS Command Injection8.7 High
- broadcom dx netops spectrumSpectrum insecure deserialiation2.3 Low
- broadcom dx netops spectrumSpectrum outdated java library in class-path7.1 High
- broadcom dx netops spectrumSpectrum broken authorization scheme2.3 Low
- broadcom dx netops spectrumSpectrum broken authentication8.7 High
- broadcom dx netops spectrumSpectrum password returned in clear5.3 Medium
- broadcom dx netops spectrumSpectrum basic authentication in use2.3 Low
- broadcom dx netops spectrumSpectrum session token in URL2.3 Low
- broadcom dx netops spectrumSpectrum command injection in NCM service7.1 High
- broadcom dx netops spectrumSpectrum reflected XSS5.3 Medium
- broadcom dx netops spectrumSpectrum directory path traversal8.8 High
- a-plus video technologies ap-bs404, ap-bs408, ap-bs416 +5 more +7 moreA-Plus Video Technologies｜NVR - Sensitive Data Exposure6.9 Medium
- advantech iot edge linux docker, iot edge windows, iotsuite and iot edge products +3 more +5 moreExecution of arbitrary SQL commands10.0 Critical
- code-projects online music sitecode-projects Online Music Site AdminUpdateUser.php sql injection6.9 Medium
- quest kace desktop authorityQuest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for...5.3 Medium
- No product listedMultiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via...9.8 Critical
- abhishekmali21 gym management systemMultiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the ...9.4 Critical
- altumcode 66biolinksCross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to...5.4 Medium
- covid-19 contact tracing system project contact tracing systemSourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution)....9.8 Critical
- busymac pal mcp serverA path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated...6.5 Medium
- d3dsecurity xz-g12 firmwareD3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm...6.5 Medium
- d3dsecurity zx-g12 firmwareD3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz...9.8 Critical
- ddsn cm3 acora cmsA static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7...10.0 Critical
- jayesh online exam systemA SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0...9.1 Critical
- automai botmanagerAn issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via...9.8 Critical
- automai directorAn issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the...8.8 High
- automai directorAn issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain...8.2 High
- automai directorAn issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges9.9 Critical
- Show moreLoading…