CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- linuxcaif: fix integer underflow in cffrml_receive()8.1 High
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreperf/x86/amd: Check event before enable to avoid GPF5.7 Medium
- linuxchar: applicom: fix NULL pointer dereference in ac_ioctlNo score
- linuxf2fs: fix to avoid updating zero-sized extent in extent cache5.7 Medium
- linuxethtool: Avoid overflowing userspace buffer on stats query7.8 High
- linuxiomap: adjust read range correctly for non-block-aligned positions9.8 Critical
- linuxdrm/amdgpu: fix a job->pasid access race in gpu recovery7.8 High
- linuxtpm2-sessions: Fix out of range indexing in name_size7.8 High
- linuxfuse: missing copy_finish in fuse-over-io-uring argument copies7.8 High
- linuxnet/mlx5: Fix double unregister of HCA_PORTS componentNo score
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morefsnotify: do not generate ACCESS/MODIFY events on child for special files4.8 Medium
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morenetrom: Fix memory leak in nr_sendmsg()5.7 Medium
- linuxksmbd: skip lock-range check on equal size to avoid size==0 underflow5.3 Medium
- linuxnet: openvswitch: fix middle attribute validation in push_nsh() action7.1 High
- linuxxfs: fix a UAF problem in xattr repairNo score
- linuxALSA: usb-mixer: us16x08: validate meter packet indices5.4 Medium
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morescsi: target: Reset t_task_cdb pointer in error case7.5 High
- linuxusb: phy: fsl-usb: Fix use-after-free in delayed work during device removalNo score
- linuxsched/deadline: only set free_cpus for online runqueues7.8 High
- linuxnet/mlx5e: Avoid unregistering PSP twiceNo score
- linuxbtrfs: don't log conflicting inode if it's a dir moved in the current transaction5.5 Medium
- linuxInput: ti_am335x_tsc - fix off-by-one error in wire_order validationNo score
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morenet/hsr: fix NULL pointer dereference in prp_get_untagged_frame()5.7 Medium
- linuxnet/handshake: duplicate handshake cancellations leak socket9.8 Critical
- linuxhfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create7.5 High
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morespi: fsl-cpm: Check length parity before switching to 16 bit modeNo score
- linuxf2fs: fix to avoid updating compression context during writeback5.7 Medium
- linuxocfs2: fix kernel BUG in ocfs2_find_victim_chain7.1 High
- linuxbnxt_en: Fix XDP_TX path7.5 High
- linuxf2fs: fix return value of f2fs_recover_fsync_data()No score
- linuxinet: frags: flush pending skbs in fqdir_pre_exit()6.8 Medium
- linuxhfsplus: Verify inode mode when loading from disk7.1 High
- vivotek affected device model numbers are fd8365, fd8365v2, fd9165, fd9171, fd9187, fd9189, fd9365, fd9371, fd9381, fd9387, fd9389, fd9391,fe9180,fe9181, fe9191, fe9381, fe9382, fe9391, fe9582, ib9365, ib93587lpr, ib9371,ib9381, ib9387, ib9389, ib939,ip9165,ip9171, ip9172, ip9181, ip9191, it9389, ma9321, ma9322, ms9321, ms9390, tb9330Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi9.3 Critical
- tenable nessus agentLocal Privilege Escalation7.3 High
- n8nn8n has a Webhook Node IP Whitelist Bypass via Partial String Matching5.3 Medium
- samrocketman jervisJervis has AES CBC Mode Without Authentication8.7 High
- samrocketman jervisJervis has a JWT Algorithm Confusion Vulnerability6.9 Medium
- samrocketman jervisJervis has a Weak Random for Timing Attack Mitigation8.2 High
- samrocketman jervisJervis has a Salt for PBKDF2 derived from password8.7 High
- samrocketman jervisJervis has a SHA-256 Hex String Padding Bug8.7 High
- samrocketman jervisJervis has Deterministic AES IV Derivation from Passphrase8.7 High
- progress loadmaster, connection manager for objectscale*, ecs connection manager +2 more +4 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster8.4 High
- samrocketman jervisJervis has an RSA PKCS#1 v1.5 Padding Vulnerability8.7 High
- progress loadmaster, connection manager for objectscale, ecs connection manager +3 more +5 moreOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster8.4 High
- zohocorp manageengine pam360, manageengine access manager plus, manageengine password manager pro +2 moreBroken Access Control8.1 High
- metagauss eventprime – events calendar, bookings and ticketsEventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API5.3 Medium
- codepeople cp image store with slideshowCP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import4.3 Medium
- lemonsoft wordpress add-onAdmin reflected XSS8.4 High
- zohocorp manageengine adselfservice plusAuthentication Bypass9.1 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 147 and Thunderbird 1479.8 Critical
- Show moreLoading…