CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- gpacGPAC filedump.c DumpMovieInfo null pointer dereference4.8 Medium
- gpacGPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference4.8 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection5.3 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request port_validate portValidate command injection5.3 Medium
- sangfor operation and maintenance security management systemSangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injection6.9 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART access control5.4 Medium
mpvOSS-FuzzUse-of-uninitialized-value in initFilterNo scorempvOSS-FuzzSegv on unknown address in yuv2rgb4_X_cNo score- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART missing authentication5.4 Medium
- bladex springbladeIncorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with...9.9 Critical
- worklenzWorklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project...5.4 Medium
- continuous.software aangineAn issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive...7.5 High
- openjsf eslintWithdrawn Advisory: eslint has a Stack Overflow when serializing objects with circular references5.5 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART excessive authentication1.0 Low
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART weak password1.0 Low
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART information disclosure1.0 Low
- linux, linux kernel +1 morenet: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback7.0 High
- linux, linux kernel +1 moremm/damon/core: remove call_control in inactive contexts7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreipv4: ip_gre: make ipgre_header() robust5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreipv6: Fix use-after-free in inet6_addr_del().7.8 High
- linux, linux kernel +1 morexhci: sideband: don't dereference freed ring when removing sideband endpoint5.5 Medium
- linux, linux kernel +1 moredrm/vmwgfx: Fix KMS with 3D on HW version 105.5 Medium
- linux, linux kernel +1 moreblock: zero non-PI portion of auto integrity buffer5.5 Medium
- linux, linux kernel +1 moreASoC: tlv320adcx140: fix null pointer5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morex86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=15.5 Medium
- linux, linux kernel +1 moredst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()7.5 High
- linux, linux kernel +1 morelib/buildid: use __kernel_read() for sleepable context5.5 Medium
- linux, linux kernel +1 moremacvlan: fix possible UAF in macvlan_forward_source()7.8 High
- linux, linux kernel +1 morenet/mlx5e: Fix crash on profile change rollback failure5.5 Medium
- linux, linux kernel +1 morenet/sched: sch_qfq: do not free existing class in qfq_change_class()7.8 High
- linux, linux kernel +1 morenvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec7.5 High
- linux, linux kernel +1 morenet: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts7.5 High
- linux, linux kernel +1 morenet/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moredmaengine: idxd: fix device leaks on compat bind and unbind5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moredmaengine: tegra-adma: Fix use-after-free7.8 High
- memuplay memu playMEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path8.5 High
- magic utilities mouse 2 utilitiesMagic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service Path8.5 High
- kmspico service kmseldiKMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path8.5 High
- deepinstinct deep instinct windows agentDeep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service Path8.5 High
- htc iptinstallerIPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path8.5 High
- seacmsSeacms 11.1 - 'checkuser' Stored XSS5.1 Medium
- click2magicClick2Magic 1.1.5 - Stored Cross-Site Scripting5.1 Medium
- lcg0124 bootdolcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin5.1 Medium
oneshotcrates.iooneshot has potential Use After Free when used asynchronously8.2 High- cubewp1211 cubewp frameworkCubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php4.3 Medium
grokOSS-FuzzMemcpy-param-overlap in grk::memStreamReadNo score- wpgmaps wp go maps (formerly wp google maps)WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification5.3 Medium
- pdfcrowd save as pdf plugin by pdfcrowdSave as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via options6.1 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import7.5 High
- Show moreLoading…