CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- freeimage project freeimageFreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().9.8 Critical
- tenda ax1806 firmwareTenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of...7.5 High
- paessler prtg network monitorPaessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service (DoS) by an authenticated...6.5 Medium
- paessler prtg network monitorPaessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the...5.4 Medium
- paessler prtg network monitorPaessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the...6.1 Medium
- airth smart home aqi monitor bootloaderAn issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate...4.6 Medium
- blurams dome flare firmwareAn insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera...6.8 Medium
- blurams dome flare firmwareA vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier...6.1 Medium
- ph7builder ph7 social dating builderpH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability5.4 Medium
- libsndfile project libsndfileLibsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function...5.3 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +15 more +17 moreVsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing6.5 Medium
- agentfront enclaveSandbox Escape via Host Error Prototype Chain in enclave-vm10.0 Critical
- wordpress social-share-buttonsSocial-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter8.8 High
- automattic jetpackJetpack 11.4 - Cross Site Scripting (XSS)5.1 Medium
- zippy zstoreZstore 6.5.4 - Reflected Cross-Site Scripting (XSS)5.1 Medium
- testaTesta 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)5.1 Medium
- viaviweb wallpaper adminVIAVIWEB Wallpaper Admin 1.0 SQL Injection via edit_gallery_image.php7.1 High
- viaviweb wallpaper adminVIAVIWEB Wallpaper Admin 1.0 - Code Execution via Image Upload9.3 Critical
- viaviweb wallpaper adminVIAVIWEB Wallpaper Admin 1.0 - SQL Injection via Login Page8.8 High
- youphptubeYouPHPTube <= 7.8 - Cross-Site Scripting5.1 Medium
- syed balkhi wpformsWPForms 1.7.8 - Cross-Site Scripting (XSS)5.1 Medium
- jokkedk webgrindWebgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file Parameter5.1 Medium
- workorder cmsWorkOrder CMS 0.1.0 - SQL Injection8.8 High
- jokkedk webgrindWebgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter9.3 Critical
- pjo2 tftpd32 seTftpd32_SE 4.60 - 'Tftpd32_svc' Unquoted Service Path8.5 High
- sysax multi serverSysax Multi Server 6.95 - 'Password' Denial of Service (PoC)5.1 Medium
- infonetsoftware medicontaMediconta 3.7.27 - 'servermedicontservice' Unquoted Service Path8.5 High
- extplorereXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)9.3 Critical
- explorerplusplus explorer32++, explorer\+\+ +1 moreExplorer32++ 1.3.5.531 - Buffer overflow7.0 High
- getoutline outlineOutline 1.6.0 - Unquoted Service Path8.5 High
- inbit messengerInbit Messenger 4.9.0 - Unauthenticated Remote SEH Overflow9.3 Critical
- inbit messengerInbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)9.3 Critical
- aimone-video-converter aimone video converterAimOne Video Converter 2.04 Build 103 Buffer Overflow in Registration Form5.1 Medium
- clevo hotkey clipboardHotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path8.5 High
- e107, e107 cms +1 moree107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override8.6 High
- contpaqi contpaq adminpaqCONTPAQi® AdminPAQ 14.0.0 - Unquoted Service Path8.5 High
- ametys, ametys cms +1 moreAmetys CMS v4.4.1 - Cross Site Scripting (XSS)5.1 Medium
- wbce cmsWBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)8.7 High
- telcel flame ii modem usbFLAME II MODEM USB - Unquoted Service Path8.5 High
- malavida cain & abel, cain \& abel +1 moreCain & Abel 4.9.56 - Unquoted Service Path8.5 High
- kyocera command center rxKyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)8.7 High
- teamspeakTeamSpeak 3.5.6 - Insecure File Permissions8.5 High
- emerson pac machine editionEmerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path8.5 High
- connectify inc hotspotConnectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path8.5 High
- ivtcorporation bluesoleilcs, ivt corp bluetooth application bluesoleilcs +1 moreBluetooth Application 5.4.277 - 'BlueSoleilCS' Unquoted Service Path8.5 High
- vertiv cyclades serial console serverCyclades Serial Console Server 3.3.0 - Local Privilege Escalation8.5 High
- wago 750-8212 pfc200WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation8.7 High
- prowise reflectProwise Reflect v1.0.9 - Remote Keystroke Injection8.6 High
- private internet access internet accessPrivate Internet Access 3.3 - 'pia-service' Unquoted Service Path8.5 High
- cobiansoft cobian backupCobian Backup 0.9 - Unquoted Service Path8.5 High
- Show moreLoading…