CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- color iccdeviccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize()8.8 High
- color iccdeviccDEV has Heap Buffer Overflow in CIccMpeCalculator::Read()8.8 High
- color iccdeviccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()7.1 High
- color iccdeviccDEV Undefined Behavior in CIccProfile::CheckHeader() Leads to Integer Overflow7.1 High
- salesforce marketing cloud engagementImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...9.8 Critical
- salesforce marketing cloud engagementImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...9.8 Critical
gpsdOSS-FuzzUse-of-uninitialized-value in rtcm2_unpackNo score- salesforce marketing cloud engagementHard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages,...9.8 Critical
harfbuzzOSS-FuzzUse-of-uninitialized-value in trySubsetNo score- salesforce marketing cloud engagementUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud...9.8 Critical
- chattermate, chattermate chattermate.chat +1 moreChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution9.3 Critical
- franklioxygen mytubeMyTube has Mass Assignment via Settings Management2.7 Low
- franklioxygen mytubeMyTube Allows Unauthorized Database Export by Guest Users8.7 High
- dioxuslabs componentsDioxus Components has JavaScript injection via user-supplied IDs5.3 Medium
- saleorSaleor has an Insecure Direct Object Reference (IDOR) in GraphQL API8.7 High
- typemillTypemill has Reflected XSS via login error view template5.4 Medium
- amazon firecrackerArbitrary Host File Overwrite via Symlink in Firecracker Jailer6.0 Medium
- phpmyfaqphpMyFAQ: Public API endpoints expose emails and invisible questions5.3 Medium
- phpmyfaqphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user6.5 Medium
- phpmyfaqphpMyFAQ: Attachment download allowed without dlattachment right (broken access control)6.5 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion6.5 Medium
github.com/cometbft/cometbftGoCometBFT has inconsistencies between how commit signatures are verified and how block time is derived7.1 High- smartertools smartermailSmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API9.3 Critical
- bloofox bloofoxcmsBloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting5.1 Medium
- mybb delete account, vintagedaddyo mybb delete account plugin +1 moreMyBB Delete Account Plugin 1.4 - Cross-Site Scripting5.1 Medium
- phreesoft phreebooksPhreeBooks 5.2.3 - Remote Code Execution8.7 High
- litespeed technologies inc web server enterpriseLiteSpeed Web Server Enterprise 5.4.11 - Command Injection8.6 High
- mfscripts yetishare file hosting scriptYetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability6.9 Medium
- epson america, inc. usb displayEpson USB Display 1.6.0.0 Unquoted Service Path Vulnerability8.5 High
- peel ecommerce shoppingPEEL Shopping 9.3.0 - 'address' Stored Cross-Site Scripting5.1 Medium
- pdf complete, inc. pdfcomplete corporate editionPDFCOMPLETE Corporate Edition 4.1.45 - 'pdfcDispatcher' Unquoted Service Path8.5 High
- nsasoft nsauditorNsauditor 3.2.2.0 - 'Event Description' Denial of Service6.7 Medium
- northwest performance software, inc. managed switch port mapping toolManaged Switch Port Mapping Tool 2.85.2 - Denial of Service6.7 Medium
- agatasoft pingmaster proAgataSoft PingMaster Pro 2.1 - Denial of Service6.7 Medium
- peel ecommerce shoppingPEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site Scripting5.1 Medium
- unified intents ab remoteUnified Remote 3.9.0.2463 - Remote Code Execution9.3 Critical
- softros systems logonexpertLogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service Path8.5 High
- softros systems lan messengerSoftros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service Path8.5 High
- the textpattern development team textpatternTextpattern 4.8.3 - Remote code execution8.7 High
- data device corporation datasims avionics arincdataSIMS Avionics ARINC 664-1 - Local Buffer Overflow6.7 Medium
- mybb trending widget, zainali99 mybb trending widget plugin +1 moreMyBB Trending Widget Plugin 1.2 - Cross-Site Scripting5.1 Medium
- jamiesage123 mybb thread redirect plugin, mybb thread redirect +1 moreMyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting5.1 Medium
- lavalite, lavalite cms +1 moreLavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search5.1 Medium
- xwiki, xwiki xwiki-platform, xwiki-rendering +2 moreXWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages6.5 Medium
- python software foundation cpythonemail BytesGenerator header injection due to unquoted newlines6.0 Medium
- linux, linux kernel +1 moreublk: fix use-after-free in ublk_partition_scan_work7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morebpf: Fix reference count leak in bpf_prog_test_run_xdp()5.5 Medium
- linux, linux kernel +1 moreidpf: Fix RSS LUT NULL ptr issue after soft reset5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morelibceph: return the handler error from mon_handle_auth_done()7.5 High
- linux, linux kernel +1 morelibceph: make free_choose_arg_map() resilient to partial allocation7.5 High
- Show moreLoading…