CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- schneider electric ecostruxure power build rapsody, schneider-electric ecostruxure power build - rapsody +1 moreCWE-416: Use After Free vulnerability that could cause remote code execution when the end user...8.4 High
- schneider electric ecostruxure power build rapsody, schneider-electric ecostruxure power build - rapsody +1 moreCWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end...8.4 High
- zitadelZITADEL has a user enumeration vulnerability in Login UIs5.3 Medium
- svelte kitSvelteKit has a memory amplification DoS in Remote Functions binary form deserializer8.2 High
- svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 moredevalue vulnerable to denial of service due to memory exhaustion in devalue.parse7.5 High
- svelte adapter-node, kit +1 moreSvelteKit Denial of service and possible SSRF when using prerendering8.4 High
- tp-link systems inc. tl-wr841n v14, tp-link tl-wr841n firmware +1 moreNull Pointer Dereference Vulnerability on TL-WR841N6.3 Medium
- pimcore, pimcore web2print tools +1 morePimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization5.4 Medium
- pimcorePimcore is Missing Function Level Authorization on "Static Routes" Listing4.3 Medium
- pimcore admin classic bundle, pimcore +1 morePimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing4.3 Medium
- national oceanic and atmospheric administration (noaa) live access server (las)NOAA PMEL Live Access Server (LAS) PyFerret command injection9.3 Critical
- pimcorePimcore ENV Variables and Cookie Informations are exposed in http_error_log8.6 High
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability4.8 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Cross-Site Scripting Vulnerability4.8 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Stored Cross-Site Scripting Vulnerability4.8 Medium
- lasuite docsLaSuite Doc affected by Stored XSS via Interlinking Block8.7 High
- roxy-wiRoxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE7.5 High
- glpi-project glpiGLPI has an unauthenticated SQL injection through the inventory endpoint7.5 High
- donknap dpanelDPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface8.1 High
- glpi-project glpiGLPI incorrectly authorizes access to documents7.5 High
- pabloandumundu tagstooTagstoo 2.0.1 - Stored XSS to RCE5.1 Medium
- projeqtor project managementProjeQtOr Project Management 9.1.4 - Remote Code Execution9.3 Critical
- visual-tools visual tools dvr vx16Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation8.5 High
- cyberfox web browserCyberfox Web Browser 52.9.1 - Denial of Service (PoC)6.7 Medium
- cmder console emulatorCmder Console Emulator 1.3.18 - 'Cmder.exe' Denial of Service (PoC)6.7 Medium
- ribccs build smart erpBuild Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)8.8 High
- umbraco, umbraco cms +1 moreUmbraco v8.14.1 - 'baseUrl' SSRF6.9 Medium
- litexmedia youtube video grabberYouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)8.4 High
- en kingdia cd extractorKingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)8.4 High
- dynojet power coreDynojet Power Core 2.3.0 - Unquoted Service Path8.5 High
- 10-strike network inventory explorer, strike network inventory explorer pro +1 more10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)8.4 High
- cinspiration rdp managerRDP Manager 4.9.9.3 - Denial-of-Service (PoC)6.8 Medium
- bdtask isshue, isshue shopping cart +1 moreIsshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)5.1 Medium
- cleidigh importexporttools ngImportExportTools NG 10.0.4 - HTML Injection5.3 Medium
- 10-strike network inventory explorer, strike network inventory explorer pro +1 more10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service Path8.5 High
- levelprograms kmaleonKmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)7.1 High
- celestial software absolutetelnetAbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)6.7 Medium
- celestial software absolutetelnetAbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)6.7 Medium
- aimeos laravel ecommerce platformAimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection8.8 High
- httpdebugger httpdebuggerproHTTPDebuggerPro 9.11 - Unquoted Service Path8.5 High
- millegpg millegpg5MilleGPG5 5.7.2 Luglio 2021 (x64) - Local Privilege Escalation8.5 High
- ttyplus mtputtyMTPutty 1.0.1.21 - SSH Password Disclosure6.8 Medium
- chikitsa patient management system, dharashah chikitsa patient management system +1 moreChikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)8.7 High
- chikitsa patient management system, dharashah chikitsa patient management system +1 moreChikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)8.7 High
- softlink education oliver library server, softlinkint oliver v5 library +1 moreOliver Library Server v5 - Arbitrary File Download8.7 High
- arunnaArunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)6.9 Medium
- phpkf cmsphpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)9.3 Critical
- sylkat-tools awebserver, awebserver ghostbuilding +1 moreAWebServer GhostBuilding 18 - Denial of Service (DoS)8.7 High
- epic games storeA local privilege escalation vulnerability exists during the installation of Epic Games Store via...8.8 High
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: libxml2: denial of service via crafted xml catalogs2.9 Low
- Show moreLoading…