CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- bladex springbladeIncorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with...9.9 Critical
- remyandrade domain availability checkerA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because t…5.4 Medium
- remyandrade modern image gallery appA Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file con…9.8 Critical
- newgensoft omniappAn unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to...7.5 High
- No product listedAn unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing...7.5 High
- doogee note59 firmware, note59 pro\+ firmware, note59 pro firmware +2 moreAn OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59,...7.8 High
- todesktop builderA reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows...5.9 Medium
- todesktop builderImproper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows...7.1 High
- todesktop builderAn improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This...9.8 Critical
- docopt docopt.cppA signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when...4.4 Medium
- svenstaro miniserveminiserve affected by a TOCTOU and symlink race vulnerability6.8 Medium
- free5gc pcfNull pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in...7.5 High
- free5gc nrfFree5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value9.1 Critical
- aptsys gemscms backendAn information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the...7.5 High
- aptsys gemscms backendAn SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys...9.4 Critical
- aptsys gemscms backendA vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which...9.4 Critical
- aptsys gemscms backendA vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows...5.3 Medium
- aptsys gemscms backendA vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows...5.3 Medium
- No product listedAn issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user...9.8 Critical
- tp-link omada controller, beam bridge 5 ur firmware, dr3220v-4g firmware +83 more +85 moreAuthentication Weakness on Omada Controllers, Gateways and Access Points6.0 Medium
- microsoft 365 word copilotWord Copilot Information Disclosure Vulnerability7.4 High
- microsoft accountMicrosoft Account Spoofing Vulnerability9.3 Critical
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability8.2 High
- microsoft 365 copilotM365 Copilot Information Disclosure Vulnerability9.3 Critical
- microsoft entra id, entra +1 moreAzure Entra ID Elevation of Privilege Vulnerability9.3 Critical
- microsoft azure data explorerAzure Data Explorer Information Disclosure Vulnerability7.4 High
- microsoft azure front doorAzure Front Door Elevation of Privilege Vulnerability9.8 Critical
- microsoft copilot studioCopilot Studio Information Disclosure Vulnerability7.5 High
- runtipiRuntipi is Vulnerable to Authenticated Arbitrary Remote Code Execution8.1 High
- evmapaEVMAPA Missing Authentication for Critical Function9.4 Critical
- evmapaEVMAPA Improper Restriction of Excessive Authentication Attempts7.5 High
- evmapaEVMAPA Insufficient Session Expiration7.3 High
- apple container, containerization +1 moreContainer and Containerization archive extraction does not guard against escapes from extraction base directory.7.8 High
- automationdirect click programmable logic controllerAutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password6.1 Medium
- automationdirect click programmable logic controllerAutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password6.1 Medium
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure9.1 Critical
- gitea, gitea open source git server +1 moreGitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes6.5 Medium
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)9.1 Critical
- gitea, gitea open source git server +1 moreGitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)4.3 Medium
- gitea, gitea open source git server +1 moreGitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure6.5 Medium
- gitea, gitea open source git server +1 moreNotification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation6.5 Medium
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)9.1 Critical
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check7.5 High
- gitea, gitea open source git server +1 moreGitea Release Email Notifications Leak Private Repository Release Details After Access Revocation3.5 Low
- akeo rufusRufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling7.3 High
- hubitat elevation c3, elevation c4, elevation c5 +3 more +5 moreAuthorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs9.4 Critical
- tp-link omada controller, oc200 firmware, oc220 firmware +5 more +7 moreCross-Site Scripting (XSS) on Omada Controllers5.7 Medium
- weintek cmt-ctrl01, cmt-svrx-820, cmt3072xh +1 more +3 moreUnverified Password Change in Weintek cMT X Series HMI EasyWeb Service8.7 High
- solspace freeform, craft-freeform +1 moreSolspace Freeform plugin affected by Stored Cross-Site Scripting (XSS) in Freeform Craft Plugin CP UI (builder/integrations)5.1 Medium
- weintek cmt-ctrl01, cmt-svrx-820, cmt3072xh +1 more +3 moreExternal Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service8.7 High
- Show moreLoading…