CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- neo4j enterprise editionEnumeration of restricted property value1.3 Low
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System edit_pwd_mall password recovery6.9 Medium
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injection8.7 High
- automated logic webctrl, carrier i-vu +1 moreAutomated Logic WebCTRL and Carrier i-Vu Session Fixation7.0 High
- solvera software services trade inc. teknoeraArbitrary File Upload in Solvera Software's Teknoera8.1 High
- solvera software services trade inc. teknoeraIDOR in Solvera Software's Teknoera7.5 High
kernel-firmwareSUSESecurity update for kernel-firmwareNo score- opensolution quick.cartRemote Code Execution via Local File Inclusion in Quick.Cart9.4 Critical
- opensolution quick.cartReflected XSS in Quick.Cart5.1 Medium
- exert computer technologies software ltd. co. education management systemIDOR in EXERT Computer Technologies' Education Management System7.5 High
- gitlabLoop with Unreachable Exit Condition ('Infinite Loop') in GitLab6.5 Medium
- qos.ch sarl logback-coreMalicious logback.xml configuration file allows instantiation of arbitrary classes1.8 Low
- hamastar technology meetinghub, hamastar meetinghub paperless meetings +1 moreHAMASTAR Technology｜MeetingHub - Missing Authentication6.9 Medium
- aida hotel guest hotspotSQLi in Aida Computer's Hotspot8.0 High
- aida hotel guest hotspotXSS in Aida Computer's Hotspot5.5 Medium
- amastar technology meetinghub, hamastar meetinghub paperless meetings +1 moreAMASTAR Technology｜MeetingHub - Arbitrary File Upload9.3 Critical
- hamastar technology meetinghub, hamastar meetinghub paperless meetings +1 moreHAMASTAR Technology｜MeetingHub - Arbitrary File Read8.7 High
- discord websocket api serviceDiscord through 2026-01-16 allows gathering information about whether a user's client state is...4.3 Medium
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter9.8 Critical
- pytestpytest has vulnerable tmpdir handling6.8 Medium
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path Traversal7.1 High
- appsmithAppsmith public apps can execute unpublished actions (viewMode confusion)9.4 Critical
- horillaHorilla's Improper Access Control Allows Employees to Auto-Approve Documents4.3 Medium
- horillaHorilla HR has 2FA Bypass through its OTP Handling Logic8.1 High
- horillaHorilla HRM has XSS Bypass through Project Name4.8 Medium
- horillaHorilla Exposes Unpublished Job Disclosures through Unauthenticated API5.3 Medium
- langfuseLangfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking6.3 Medium
- horillaHorilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee4.3 Medium
- horillaHorilla has File Upload XSS5.4 Medium
- horillaHorilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover8.8 High
- lxsmnsyc serovalSeroval affected by Denial of Service via Deeply Nested Objects7.5 High
- getgrist grist-corepyodide sandbox option is insecure9.1 Critical
- joinmastodon mastodonMastodon has insufficient access control to push notification settings6.5 Medium
- joinmastodon mastodonMastodon missing length limits on list names, filter names, and filter keywords4.3 Medium
- joinmastodon mastodonMastodon vulnerable to Denial of Service from a single post (client/server)7.5 High
- joinmastodon mastodonMastodon may allow a remote suspension bypass5.3 Medium
- dataeaseDataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover8.8 High
- ruijie networks co., ltd. ap180(ja) v1.xx, ap180(ja) v2.xx, ap180(jp) v1.xx +6 more +8 moreAP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection...8.6 High
- altium aes, on-prem enterprise server +1 moreHTML Injection Leading to Script Execution in Altium Enterprise Server7.6 High
- altium aes, on-prem enterprise server +1 moreStored Cross-Site Scripting in AES BOM Viewer6.8 Medium
- altium aes, on-prem enterprise server +1 moreSQL Injection in AES Due to Inactive SQL Parsing Configuration8.6 High
- sumatrapdfreader sumatrapdfSumatraPDF's Integer Underflow in PalmDbReader Leads to Crash5.5 Medium
- altium designerMissing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle Attacks5.3 Medium
pcapplusplusOSS-FuzzUse-of-uninitialized-value in pcpp::SSLServerHelloMessage::ServerHelloTLSFingerprint::toStringNo score- opencryptokiopenCryptoki has improper link resolution before file access (link following)6.8 Medium
- oisf suricataSuricata detect/alert: heap-use-after-free on alert queue expansion7.4 High
- oisf suricataSuricata http1: quadratic complexity in headers parsing over multiple packets5.3 Medium
- oisf suricataSuricata datasets: stack overflow when saving a set5.9 Medium
- oisf suricataSuricata eve/alert: http1 xff handling can lead to denial of service3.7 Low
- oisf suricataSuricata http1: infinite recursion in decompression7.5 High
- Show moreLoading…