CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: unbounded relaxng include recursion leading to stack overflow3.7 Low
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing5.9 Medium
- google keras, red hat openshift ai (rhoai), openshift ai 2.25 +2 more +4 moreDenial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata7.1 High
- wpcenter affiliatex – amazon affiliate pluginAffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings6.4 Medium
- divisupreme supreme modules lite – divi theme, extra theme and divi builderSupreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass8.8 High
- laborator kalium 3 | creative wordpress & woocommerce themeKalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request5.3 Medium
- sick incoming goods suiteCertain error messages returned by the application expose internal system details that should not...4.3 Medium
- sick incoming goods suiteThe application discloses all used components, versions and license information to...5.3 Medium
- sick incoming goods suiteCertain requests pass the authentication token in the URL as string query parameter, making it...5.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker with administrative access may inject malicious content into the login page,...3.8 Low
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker may exploit missing protection against clickjacking by tricking users into performing...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreImproper input handling in a system endpoint may allow attackers to overload resources, causing a...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker with low privileges may be able to trigger critical system functions such as reboot...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker with low privileges may be able to read files from specific directories on the device...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker with limited permissions may still be able to write files to specific locations on...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreImproper handling of a URL parameter may allow attackers to execute code in a user's browser...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreImproper validation of a login parameter may allow attackers to redirect users to malicious...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreFirmware update files may expose password hashes for system accounts, which could allow a remote...5.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreThe device is deployed with weak and publicly known default passwords for certain hidden user...7.5 High
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreCertain system functions may be accessed without proper authorization, allowing attackers to...7.5 High
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreUploading unvalidated container images may allow remote attackers to gain full access to the...9.1 Critical
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker may gain unauthorized access to the host filesystem, potentially allowing them to...9.9 Critical
mysqlTuxCare,mysql-commonTuxCare,mysql-develTuxCare +4 more +6 moreUpdate of mysqlNo score- red hat build of keycloak, build of keycloak 26.4.9, jboss enterprise application platform 8 +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths3.7 Low
- codedropz contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion3.7 Low
- butlerblog wp-members, cbutlerjr wp-members membership plugin +1 moreWP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields5.4 Medium
vlcOSS-FuzzHeap-buffer-overflow in mkv::matroska_segment_c::TrackInitNo scorelibvpxOSS-FuzzUse-of-uninitialized-value in vp9_quantize_fp_avx2No scorelibdwarfOSS-FuzzHeap-use-after-free in _dwarf_exec_frame_instrNo scoreharfbuzzOSS-FuzzHeap-use-after-free in graph::LigatureSubstFormat1::shrinkNo scorevlcOSS-FuzzHeap-buffer-overflow in check_sync_pesNo score- tenda ax1806 firmwareTenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of...7.5 High
- phpgurukul cyber cafe management systemA time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System...8.8 High
- phpgurukul cyber cafe management systemPhpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user...9.8 Critical
- phpgurukul cyber cafe management systemA stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management...6.1 Medium
- phpgurukul cyber cafe management systemA stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An...6.1 Medium
- tenda ax1806 firmwareTenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of...7.5 High
- tenda ax1806 firmwareTenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the...7.5 High
- gpacA heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a...5.5 Medium
- gpacA stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause...5.5 Medium
- gpacAn out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to...7.5 High
- gpacA stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a...7.5 High
- gpacA stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of...5.5 Medium
- gpacA buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to...7.5 High
- gpacA heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a...5.5 Medium
- gpacA heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to...5.5 Medium
- gpacA heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a...6.5 Medium
- gpacGPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.8.2 High
- mitel cx, micontact center business +1 moreA vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2...8.2 High
- mitel mivoice mx-oneA vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50)...9.4 Critical
- Show moreLoading…