CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- renovatebot renovateRenovate 31.51.0 before 40.33.0 Command Injection via helmv38.4 High
- renovatebot renovateRenovate 39.53.0 before 40.33.0 Command Injection via gleam manager8.4 High
- renovatebot renovateRenovate 32.135.0 before 40.33.0 Command Injection via hermit8.4 High
- renovatebot renovateRenovate 35.63.0 before 40.33.0 Command Injection via npm8.4 High
- ethereum go-ethereum, go ethereum +1 morego-ethereum has a DoS via malicious p2p message7.1 High
- ethereum go-ethereum, go ethereum +1 morego-ethereum has a DoS via malicious p2p message7.1 High
- color iccdeviccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp8.8 High
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | NULL Pointer Dereference (CWE-476)5.5 Medium
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | Out-of-bounds Write (CWE-787)7.8 High
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | Out-of-bounds Write (CWE-787)7.8 High
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | NULL Pointer Dereference (CWE-476)5.5 Medium
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | Out-of-bounds Read (CWE-125)5.5 Medium
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | Out-of-bounds Read (CWE-125)5.5 Medium
- hewlett packard enterprise (hpe) virtual intranet access (via)Local Privilege Escalation Vulnerability in HPE Aruba Networking Virtual Intranet Access (VIA) Client for Linux7.8 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreOut-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System5.3 Medium
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreOut-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System5.3 Medium
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)6.5 Medium
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow6.5 Medium
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface7.2 High
- adobe substance 3d designerSubstance3D - Designer | Out-of-bounds Read (CWE-125)5.5 Medium
- adobe substance 3d designerSubstance3D - Designer | Out-of-bounds Write (CWE-787)7.8 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreImproper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreStack Overflow Vulnerability in AOS-10 Web-Based Management Interface7.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreUnauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System8.2 High
- renovatebot renovateRenovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize8.4 High
- adobe substance 3d samplerSubstance3D - Sampler | Out-of-bounds Write (CWE-787)7.8 High
- mend renovate-ce, renovatebot renovate, mend renovate-ee-server +1 more +3 moreRenovate before 42.68.5 Remote Code Execution via Gradle Wrapper8.4 High
- made i.t. formsUmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation7.5 High
- honoJWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass8.2 High
- honoJWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)8.2 High
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Use After Free (CWE-416)7.8 High
- adonisjs lucidMass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State8.2 High
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability4.4 Medium
- adobe substance3d - painter, substance 3d painter +1 moreSubstance3D - Painter | Out-of-bounds Write (CWE-787)7.8 High
- opencryptokiopenCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP6.6 Medium
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe incopyInCopy | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | Untrusted Search Path (CWE-426)8.6 High
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | NULL Pointer Dereference (CWE-476)5.5 Medium
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Out-of-bounds Read (CWE-125)5.5 Medium
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Access of Uninitialized Pointer (CWE-824)7.8 High
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Access of Uninitialized Pointer (CWE-824)7.8 High
- openc3 cosmosUnauthenticated Remote Code Execution in openc3-api10.0 Critical
- adobe dreamweaver desktop, dreamweaver +1 moreDreamweaver Desktop | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)8.6 High
- Show moreLoading…