CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- mozilla firefox, thunderbird +1 moreDenial-of-service in the DOM: Service Workers component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the XML component5.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreSandbox escape in the Messaging System component10.0 Critical
- zohocorp manageengine admanager plusPath Traversal5.5 Medium
- progress software flowmon ads, progress flowmon anomaly detection system +1 moreSQL injection leading to privilege escalation in Progress Flowmon ADS8.8 High
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Insecure Deserialization via Mailer File Spool5.2 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Recycler Module7.1 High
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Redirects Module5.3 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Edit Document Controller5.3 Medium
- ninjateam wp duplicate pageWP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication5.4 Medium
- siemens simatic et 200al im 157-1 pn, simatic et 200mp im 155-5 pn hf, simatic et 200sp im 155-6 mf hf +12 more +14 moreA vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All...8.7 High
- siemens telecontrol server basicA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4)....7.3 High
- siemens industrial edge cloud device (iecd), industrial edge device kit - arm64 v1.10, industrial edge device kit - arm64 v1.11 +104 more +106 moreAffected devices do not properly enforce user authentication on specific API endpoints. This...10.0 Critical
- phoenix contact cloud client 1101t-tx/tx, tc cloud client 1002-4g att, tc cloud client 1002-tx/tx +8 more +10 moreConfig-Upload Code Injection8.8 High
- unknown e-xact | hosted payment |e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion9.1 Critical
- unknown dreamer blogDreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation9.8 Critical
- hikvision ds-2cd1xx1, ds-2cd1xxxg0(t), ds-2cd1xxxg2 +96 more +98 moreThere is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision...8.8 High
- hikvision ds-k1t105a firmware, ds-k1t201a/k1t105a, ds-k1t201a firmware +43 more +45 moreThere is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision...8.8 High
- sap business connectorCross-Site Scripting (XSS) vulnerability in SAP Business Connector6.1 Medium
- sap supplier relationship management, sap se supplier relationship management (sicf handler in srm catalog) +1 moreOpen Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)4.7 Medium
- sap se fiori app (intercompany balance reconciliation)Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)8.1 High
- sap se nw as java ume user mappingObsolete Encryption Algorithm Used in NW AS Java UME User Mapping3.0 Low
- sap se application server for abap and sap netweaver rfcsdkOS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK8.4 High
- sap netweaver application server abap, sap se netweaver application server abap and abap platform +1 moreMissing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform8.1 High
- sap se identity managementInsufficient Input Handling in JNDI Operations of SAP Identity Management3.8 Low
- sap se erp central component and sap s/4hana (sap ehs management)Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)6.4 Medium
- sap se s/4hana private cloud and on-premise (financials � general ledger)SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)9.9 Critical
- sap introscope enterprise manager, sap se wily introscope enterprise manager (workstation) +1 moreRemote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)9.6 Critical
- sap se netweaver enterprise portalCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal6.1 Medium
- sap se s/4hana (private cloud and on-premise), sap s\/4 hana +1 moreCode Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)9.1 Critical
- sap se business server pages application (product designer web ui)Missing Authorization check in Business Server Pages Application (Product Designer Web UI)4.3 Medium
- sap se fiori app (intercompany balance reconciliation)Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)6.6 Medium
- sap se fiori app (intercompany balance reconciliation)Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)5.1 Medium
- sap se fiori app (intercompany balance reconciliation)Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)4.3 Medium
- sap se fiori app (intercompany balance reconciliation)Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)4.3 Medium
- sap hana databasePrivilege escalation vulnerability in SAP HANA database8.8 High
- sap se landscape transformationCode Injection vulnerability in SAP Landscape Transformation9.1 Critical
vlcOSS-FuzzHeap-buffer-overflow in iTUNTripletCallbackNo score- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 1478.1 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the DOM: Copy & Paste and Drag & Drop component5.4 Medium
- mozilla firefox, thunderbird +1 moreClickjacking issue, information disclosure in the PDF Viewer component4.3 Medium
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Graphics component5.3 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: GC component6.5 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript Engine component9.8 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking component5.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the IPC component8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to integer overflow in the Graphics component8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Graphics component9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component8.0 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMitigation bypass in the DOM: Security component8.1 High
- Show moreLoading…