CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- brother bragentBrother BRAgent 1.38 - 'WBA_Agent_Client' Unquoted Service Path8.5 High
- diskpulseDiskPulse 13.6.14 - Unquoted Service Path8.5 High
- smartertools smartertrackSmarterTools SmarterTrack 7922 -Information Disclosure6.9 Medium
- altium liveStored Cross-Site Scripting in Altium Live Support Center Comment Endpoint6.1 Medium
- altium enterprise server, on-prem enterprise server +1 moreStored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation8.0 High
- denoDeno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass8.1 High
- denoDeno node:crypto doesn't finalize cipher9.2 Critical
- altium liveStored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure9.0 Critical
- traefikTraefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall5.9 Medium
solspace/craft-freeformPackagistsolspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled AssetsNo scoresolspace/craft-freeformPackagistsolspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data1.9 Low- altium liveStored Cross-Site Scripting in Altium Live User Profile Fields7.6 High
- gnu glibcgetnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler7.5 High
- changjetong information technology co., ltd. t+, chanjetvip t\+ +1 moreChangjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE9.3 Critical
- steven uploadifyUploadify <= 1.0 Unauthenticated Arbitrary File Upload9.3 Critical
- lakefslakeFS is Missing Timestamp Validation in S3 Gateway Authentication6.5 Medium
- eclipse foundation vert.x, eclipse vert.x-web +1 moreEclipse Vert.x Web static handler file access denial6.9 Medium
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: When telemetry collectors are frequently subscribing and unsubscribing to sensors chassisd or rpd will crash7.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Specifically malformed SSL packet causes FPC crash8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: EX4000: A high volume of traffic destined to the device leads to a crash and restart8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card reset6.8 Medium
- juniper junos os evolvedJunos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stop7.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: EX4k Series, QFX5k Series: In an EVPN-VXLAN configuration link flaps cause Inter-VNI traffic drop7.1 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash7.1 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Use after free vulnerability In 802.1X authentication daemon can cause crash of the dot1xd process7.5 High
- juniper junos spaceJunos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)8.2 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: With GRE performance acceleration enabled, receipt of a specific ICMP packet causes the PFE to crash8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series, MX Series with MX-SPC3 or MS-MPC: Receipt of multiple specific SIP messages results in flow management process crash8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: Subscribing to telemetry sensors at scale causes all FPCs to crash7.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: Receipt of a specifically malformed ICMP packet causes an FPC restart7.1 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flap6.9 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: A specifically crafted 'show chassis' command causes chassisd to crash6.8 Medium
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash8.7 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable6.8 Medium
- defenseunicorns peprPepr Overly Permissive RBAC ClusterRole in Admin Mode0.0 None
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP server6.3 Medium
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash6.8 Medium
solspace/craft-freeformPackagistsolspace/craft-freeform Has a DoS Vulnerability2.7 Low- juniper paragon automation, juniper networks paragon automation (pathfinder, planner, insights) +1 moreParagon Automation: A clickjacking vulnerability in the web server configuration has been addressed5.1 Medium
- svelteSvelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)5.3 Medium
- entrust corporation instant financial issuance (if)Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE9.3 Critical
- alextselegidis easyappointments, easyappointments easy\!appointments +1 moreCSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover7.4 High
- h3h3 v1 has Request Smuggling (TE.TE) issue8.9 High
- arcaneArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE9.1 Critical
- svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 moredevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse7.5 High
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal6.6 Medium
- docmostDocmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)7.1 High
- Show moreLoading…