CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- axllent mailpitMailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API5.8 Medium
- sibercii6-crypto teklifolustur appteklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers7.1 High
- chatterbotChatterBot has Denial of Service via Database Connection Pool Exhaustion7.5 High
- leepeuker movaryMovary vulnerable to Cross-site Scripting with `?categoryCreated=` param9.3 Critical
- leepeuker movaryMovary vulnerable to Cross-site Scripting with `?categoryDeleted=` param9.3 Critical
- birkir primebirkir prime GraphQL Field graphql denial of service6.9 Medium
rust1.91SUSE,rust1.92SUSE +1 moreSecurity update for rust1.91, rust1.92No score- leepeuker movaryMovary vulnerable to Cross-site Scripting with `?categoryUpdated=` param9.3 Critical
- nixos nixpkgsTandoor Recipes module allows SQLite database to be externally accessible with the default settings8.7 High
- hcl aionHCL AION is affected by a Weak Password Policy vulnerability3.1 Low
- hcl aionHCL AION is affected by a Technical Error Disclosure vulnerability1.8 Low
- hotcrpHotCRP vulnerable to exposure of submitted documents6.5 Medium
- hotcrpHotCRP vulnerable to remote code execution through formulas10.0 Critical
- hcl aionHCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase...2.4 Low
- birkir primebirkir prime GraphQL API graphql information disclosure6.9 Medium
- hcl aionHCL AION is affected by a Missing Security Response Headers vulnerability.3.5 Low
- esphomeESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component1.7 Low
- hcl aionHCL AION is affected by a Cacheable HTTP Response vulnerability2.8 Low
- openprojectOpenProject users with "View Members" permission in any project can view all Group memberships4.3 Medium
- hcl aionHCL AION is affected by an Host Header Injection vulnerability2.7 Low
- openprojectOpenProject users can delete other user's session, causing them to be logged out6.5 Medium
- openprojectOpenProject has stored XSS regression using attachments and script-src self8.7 High
- hcl aionHCL AION is affected by an Unrestricted File Upload vulnerability3.1 Low
- birkir primebirkir prime cross-site request forgery5.3 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreHeap-use-after-free in gdi_set_bounds7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreHeap-use-after-free in update_pointer_new7.7 High
- freerdpFreeRDP has heap-buffer-overflow in Glyph_Alloc5.5 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +6 more +8 moreFreeRDP has heap-buffer-overflow in clear_decompress_bands_data7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in clear_decompress_residual_data7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in clear_decompress7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in planar_decompress_plane_rle7.7 High
- lobehub lobe-chatLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion3.7 Low
- ibericode koko analytics, koko-analytics +1 moreKoko Analytics vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import8.4 High
- fastify fastify-express@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)8.4 High
- utt hiper 810, 810 firmware +1 moreUTT HiPER 810 setSysAdm strcpy buffer overflow9.3 Critical
- frappe hrmspbrong hrms recruitment.go UpdateRecruitmentById cross site scripting5.1 Medium
- b&r industrial automation gmbh automation runtimeVulnerability on Automation Runtime my cause DoS Conditions8.9 High
- b&r industrial automation gmbh automation studioImproper Server Certificate Validation in Automation Studio9.1 Critical
- itsourcecode directory management systemPHPGurukul Directory Management System Search index.php sql injection6.9 Medium
- fastify middie, fastify\/middie +1 moreFastify Middie Middleware Path Bypass8.4 High
- kozea weasyprint, red hat ansible automation platform 2 +1 moreWeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect7.5 High
- h2o quiclyQuicly has assertion failures7.5 High
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System order_online.php sql injection6.9 Medium
- totolink lr350, lr350 firmware +1 moreTotolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflow8.7 High
- devolutions serverIncorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows...7.6 High
- devolutions serverSQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects...9.8 Critical
- hex hexpm, hexpm hex.pm +1 moreCross-site scripting (XSS) in OAuth Device Authorization screen8.5 High
- totolink lr350, lr350 firmware +1 moreTotolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflow8.7 High
- totolink lr350, lr350 firmware +1 moreTotolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflow8.7 High
- Show moreLoading…