CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- zoom communications inc. nodeZoom Node Deployments - Command Injection9.9 Critical
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- rockwell automation controllogix® redundancy enhanced moduleRockwell Automation Recommends Upgrading From 1756-RM2 XT To 1756-RM3 XT8.7 High
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- rockwell automation compactlogix® 5370Rockwell Automation CompactLogix® 5370 Denial of Service Vulnerability7.1 High
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- rockwell automation armorstart® lt, rockwellautomation armorstart lt firmware +1 moreRockwell Automation ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities8.7 High
- gnu glibcwordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory7.5 High
- rockwell automation verve asset managerVerve Asset Manager – Plaintext Storage Vulnerabilities8.8 High
- rockwell automation verve asset managerVerve Asset Manager – Plaintext Storage Vulnerabilities8.6 High
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri5.8 Medium
- zuinq studio ismygymReflected Cross-Site Scripting (XSS) in IsMyGym5.1 Medium
- botble athena, homzen, martfury +1 more +3 moreHTML injection in multiple Botble products5.1 Medium
- nikhil-bhalerao poultry farm management system, poultry farm management system farm management system +1 moreStored Cross-Site Scripting in Poultry Farm Management System5.1 Medium
- bdtask isshueHTML injection in Isshue from Bdtask5.1 Medium
- mackron dr flacCVE-2025-143695.5 Medium
- nikhil-bhalerao poultry farm management system, poultry farm management system farm management system +1 moreStored Cross-Site Scripting in Poultry Farm Management System5.1 Medium
- riftzilla qrgenReflected Cross-Site Scripting (XSS) in QRGen's Riftzilla5.1 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action9.8 Critical
- sesame labs s.l sesameStored Cross-Site Scripting (XSS) in Sesame web application5.1 Medium
- beckhoff automation tf2000-hmi-server, twincat.hmi.server +1 moreBeckhoff: XSS Vulnerability in TwinCAT 3 HMI Server5.5 Medium
- typo3 extension "mailqueue"Insecure Deserialization in extension "Mailqueue" (mailqueue)5.2 Medium
- foxit esign, foxit software inc. na1.foxitesign.foxit.com +1 moreReflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters6.1 Medium
- browan communications prismx mx100 ap controllerBROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials6.9 Medium
- browan communications prismx mx100 ap controllerBROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Arbitrary File Upload8.6 High
- browan communications prismx mx100 ap controllerBROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials9.3 Critical
- unknown bookingorBookingor <= 1.0.12 - Subscriber+ Category Deletion6.5 Medium
- bjskzy zhiyou erpBjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference5.3 Medium
- norcross wp hello barWP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters4.4 Medium
- nhomcaodem viet contactViet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters4.4 Medium
- wedevs wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerceweMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure5.3 Medium
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disc…8.1 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API5.3 Medium
- brainstormforce custom fonts – host your fonts locallyCustom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion5.3 Medium
- satollo newsletter – send awesome emails from wordpressNewsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription4.3 Medium
- peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi)PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- crmebCRMEB JSON Token LoginServices.php remoteRegister improper authentication6.3 Medium
- crmebCRMEB LoginController.php appleLogin improper authentication6.9 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreHeap buffer overflow with attacker-controlled data in XBM parser8.1 High
- imagemagickImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript5.5 Medium
- imagemagickImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails6.5 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS8.8 High
- mineadminMineAdmin downloadById information disclosure2.3 Low
- mineadminMineAdmin getFileInfoById information disclosure2.3 Low
- orvalOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation9.3 Critical
libjpeg-turboOSS-FuzzUse-after-poison in compress.ccNo score- Show moreLoading…