CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- ludashi driverA local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a...7.3 High
- invoiceplaneFile upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload...9.9 Critical
- invoiceplaneDirectory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers...5.3 Medium
- invoiceplaneAn SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity"...6.5 Medium
- itflowAn SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id"...4.9 Medium
- agora-projectFile upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute...9.8 Critical
- agora-projectCross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing...6.1 Medium
- agora-projectFile upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or...8.8 High
- agora-projectDirectory traversal vulnerability in Omnispace Agora Project before 25.10 allowing...7.5 High
- anycomment anycomment.ioCross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to...6.1 Medium
- codewithcj sparkyfitnessSparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.6.1 Medium
- eachitaly wireless mini router wireless-n 300m firmwareA Stored Cross-Site Scripting (XSS) vulnerability in Web management interface in Each Italy...5.4 Medium
- emqx nanomqAn issue in nanomq v0.22.7 allows attackers to cause a Denial of Service (DoS) via a crafted...7.5 High
- sonatype nexus repositoryNexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration6.2 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginSimply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters7.5 High
- lenovo idea tab pro tb373fu, idea tab tb336fu, legion tab tb320fc +28 more +30 moreA potential missing authentication vulnerability was reported in some Lenovo Tablets that could...2.4 Low
- lenovo thinkpad l13 gen 6 2 in 1 bios, thinkpad l13 gen 6 bios, thinkpad l14 gen 6 bios +1 more +3 moreA potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and...7.0 High
- lenovo thinkplus fu100, thinkplus fu200, thinkplus tsd303 +5 more +7 moreA vulnerability was reported in ThinkPlus configuration software that could allow a local...7.3 High
- lenovo thinkplus fu100, thinkplus fu200, thinkplus tsd303 +5 more +7 moreA potential vulnerability was reported in ThinkPlus configuration software that could allow a...6.8 Medium
- lenovo thinkplus fu100, thinkplus fu200, thinkplus tsd303 +5 more +7 moreA potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with...5.1 Medium
- lenovo vantageAn improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo...6.8 Medium
- sonatype nexus repositoryNexus Repository 3 - Cross-Site Scripting5.1 Medium
algolia/algoliasearch-magento-2PackagistAlgolia Search & Discovery for Magento 2 Has Untrusted Data Handling6.9 Medium- go-chi chigo-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware5.1 Medium
github.com/go-chi/chiGo,github.com/go-chi/chi/v2Go,github.com/go-chi/chi/v3Go +6 more +8 moreDuplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware4.7 Medium- gnu glibcInteger overflow in memalign leads to heap corruption8.4 High
- sumatrapdfreader sumatrapdfSumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp8.6 High
- wiresharkOut-of-bounds Write in Wireshark5.5 Medium
- wiresharkOut-of-bounds Write in Wireshark5.3 Medium
- wiresharkLoop with Unreachable Exit Condition ('Infinite Loop') in Wireshark4.7 Medium
- wiresharkOut-of-bounds Write in Wireshark5.3 Medium
- nodejs undiciUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion5.9 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab7.7 High
- drupal facebook pixel, facebook pixel project pixel +1 moreXSS in Drupal 7 Facebook Pixel Module4.8 Medium
- drupal flagXSS in Drupal 7 Flag Module4.8 Medium
- nvidia nsight graphicsNVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command...7.8 High
- typesetterTypesetter CMS Reflected XSS via Move Message Handling4.8 Medium
- typesetterTypesetter CMS Reflected XSS via Status.php4.8 Medium
- typesetterTypesetter CMS Reflected XSS via Editing.php4.8 Medium
- frappe learning, lms +1 moreFrappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages1.3 Low
- pimcorePimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-308488.8 High
- rocket.chatRocket.Chat Unauthorized Access to OAuth App Details7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has a heap-buffer-overflow in urb_select_configuration5.6 Medium
- drupal microsoft entra id sso loginMicrosoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-0056.5 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has a global-buffer-overflow in crypto_base64_decode5.6 Medium
- bordeaux-metropole at internet piano analyticsAT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-0044.8 Medium
- bordeaux-metropole at internet smarttagAT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-0036.1 Medium
- drupal role delegation, role delegation project delegation +1 moreRole Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-0028.8 High
- freerdpFreeRDP has a heap-use-after-free in irp_thread_func6.8 Medium
- drupal group inviteGroup invite - Moderately critical - Access bypass - SA-CONTRIB-2026-0015.3 Medium
- Show moreLoading…