CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- litexmedia audio conversion wizardAudio Conversion Wizard v2.01 - Buffer Overflow8.6 High
- ilwebmaster21 wow21WOW21 5.0.1.9 - 'Service WOW21_Service' Unquoted Service Path8.5 High
- sandboxie plus, sandboxie-plus sandboxie plus +1 moreSandboxie-Plus 5.50.2 - 'Service SbieSvc' Unquoted Service Path8.5 High
- tdarrTdarr 2.00.15 - Command Injection9.3 Critical
- vive runtime serviceVIVE Runtime Service - 'ViveAgentService' Unquoted Service Path8.5 High
- proton protonvpnProtonVPN 1.26.0 - Unquoted Service Path8.5 High
- e107, e107 cms +1 moree107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override8.7 High
- primera ptpublisherPTPublisher 2.3.4 - Unquoted Service Path8.5 High
- easeus data recoveryEaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path8.5 High
- itec tcqTCQ - 'ITeCProteccioAppServer.exe' Unquoted Service Path8.5 High
- impresscmsImpressCMS 1.4.4 - Unrestricted File Upload9.3 Critical
- beehive forum forum, beehiveforum beehive forum +1 moreBeehive Forum - Account Takeover8.5 High
- algo solutions 8028Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)8.6 High
- mailhogMailhog 1.0.1 - Stored Cross-Site Scripting (XSS)5.1 Medium
- e107, e107 cms +1 moree107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE8.6 High
- e107, e107 cms +1 moree107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS4.8 Medium
- e107, e107 cms +1 moree107 CMS v3.2.1 - Reflected XSS via Comment Flow6.1 Medium
- wondershare ubackitWondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service Path8.5 High
- wondershare mobiletransWondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path8.5 High
- wondershare famisafeWondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path8.5 High
- wondershare dr.foneWondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path8.5 High
- wondershare dr.foneWondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path8.5 High
- geonetworkGeonetwork 4.2.0 - XML External Entity (XXE)8.7 High
- kalyan02 nanocmsNanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)8.6 High
- mpdfmPDF 7.0 - Local File Inclusion8.7 High
- megatkc aero cms, aerocms project aerocms +1 moreAero CMS 0.0.1 - SQL Injection8.8 High
- skyjos owlfiles, owlfiles file manager +1 moreOwlfiles File Manager 12.0.1 Cross-Site Scripting via HTTP Server5.1 Medium
- skyjos owlfiles, owlfiles file manager +1 moreOwlfiles File Manager 12.0.1 - Path Traversal8.7 High
- cooler master technology inc. master masterplusCoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path8.5 High
- 4homepages 4images4images 1.9 - Remote Command Execution (RCE)8.6 High
- slims senayan library management systemSenayan Library Management System 9.0.0 - SQL Injection8.8 High
- splashtopSplashtop 8.71.12001.0 - Unquoted Service Path8.5 High
- phphtmledit cuteeditor, rich text editor +1 moreCuteEditor for PHP 6.6 - Directory Traversal5.3 Medium
- youphptubeYouPHPTube <= 7.8 - Directory Traversal8.7 High
- cobbr covenantCovenant 0.5 - Remote Code Execution (RCE)9.3 Critical
- akinloluwami outrayOutray cli is vulnerable to race conditions in tunnels creation6.3 Medium
- akinloluwami outrayOutray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts5.9 Medium
- jaraco jaraco.contextjaraco.context Has a Path Traversal Vulnerability8.6 High
- cal cal.comCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback10.0 Critical
- opensourcepos open source point of sale, opensourcepos +1 moreOpen Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name field4.3 Medium
- nsecsoft nseckrnlNSecsoft NSecKrnl process termination privilege escalation5.7 Medium
- elastic kibanaImproper Input Validation in Kibana Email Connector Leading to Excessive Allocation6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Fleet6.5 Medium
- elastic kibanaAllocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation6.5 Medium
- elastic metricbeat, kibana +1 moreImproper Input Validation in Metricbeat Leading to Denial of Service6.5 Medium
- datadog guarddogGuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE8.7 High
- datadog guarddogGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS7.1 High
- vaadin, vaadin rich-text-editor, vaadin-core +1 more +3 moreStored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed5.1 Medium
- anchore quillQuill 2.0.3 - Lack of data validation in HTML export allowing XSS5.1 Medium
- eigentEigent Allows Arbitrary Code Execution via pull_request_target CI Workflow8.9 High
- Show moreLoading…