CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM vulnerable to Path Traversal7.2 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM has key leak in `systemSettings.js`8.7 High
- western digital wd discoveryDLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows...8.9 High
- shaarliShaarli vulnerable to stored XSS via Suggested Tags5.3 Medium
- zalando skipperSkipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName8.1 High
- linuxfoundation everest, everest everest-core +1 moreEvseV2G has sequence state validation bypass4.3 Medium
- ijason-liu books manageriJason-Liu Books_Manager upload_bookCover.php unrestricted upload5.1 Medium
- expressionengineSQL Injection vulnerability in the Structure for Admin authenticated user6.0 Medium
- linuxfoundation sigstore-pythonsigstore has CSRF possibility in OIDC authentication during signing0.0 None
- ijason-liu books manageriJason-Liu Books_Manager add_book_check.php cross site scripting4.8 Medium
- assertjAssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion8.2 High
- pnpmpnpm has Path Traversal via arbitrary file permission modification6.7 Medium
- bentomlBentoML has a Path Traversal via Bentofile Configuration7.4 High
- pnpmpnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)6.5 Medium
- pnpmpnpm has Windows-specific tarball Path Traversal6.5 Medium
- pnpmpnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin6.5 Medium
- pnpmpnpm has symlink traversal in file:/git dependencies6.7 Medium
- code-projects online music sitecode-projects Online Music Site AdminDeleteUser.php sql injection6.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata3.1 Low
- red hat openshift virtualization 4Kubevirt: kubevirt: vm administration denial of service via guest agent6.4 Medium
- red hat build of quarkus 3.27.2.redhat, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 moreHibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect4.3 Medium
- red hat openshift virtualization 4, rhel-9-cnv-4.19 +1 moreVirt-cdi-controller: unauthorized pvc cloning via dataimportcron8.5 High
- tp-link omada controllerBlind Server-Side Request Forgery (SSRF) in Omada Controller5.1 Medium
- tp-link omada controllerPassword Confirmation Bypass in Omada Controller2.1 Low
- tp-link omada controllerIDOR Leading to Owner Account Hijacking in Omada Controller8.3 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +3 more +5 moreReact Server Components have multiple Denial of Service Vulnerabilities7.5 High
- patriksimek vm2vm2 has a Sandbox Escape9.8 Critical
- phala-network dcap-qvldcap-qvl has Missing Verification for QE Identity9.3 Critical
- tp-link archer mr600 firmware, tp-link systems inc. archer mr600 v5.0 +1 moreAuthenticated Command Injection Vulnerability in Archer MR6008.5 High
- micron technology, inc. crucial storage executiveCrucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPE7.1 High
- tanium discoverTanium addressed an improper input validation vulnerability in Discover.2.7 Low
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Permissive CORS Allows Cross-origin Data Access7.1 High
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Lacks X-Content-Type-Options Header2.1 Low
- hiawatha-webserver hiawatha, hiawatha web server +1 moreTomahawk authentication timing attack due to usage of 'strcmp'3.3 Low
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Missing CSRF Protections for Administrative Actions5.1 Medium
- hiawatha.leisink hiawatha webserver, hiawatha web server +1 moreDouble free in XSLT in 'show_index'6.5 Medium
- hiawatha-webserver hiawatha, hiawatha web server +1 moreImproper header parsing may lead to request smuggling5.3 Medium
- formalms forma lmsForma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting5.1 Medium
- idt pc audioIDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path8.5 High
- kiteKite 1.2020.1119.0 - 'KiteService' Unquoted Service Path8.5 High
- pdf-complete pdf completePDF Complete 3.5.310.2002 - 'pdfsvc.exe' Unquoted Service Path8.5 High
- igniterealtime openfireOpenfire 4.6.0 - 'path' Stored XSS5.1 Medium
- getgrav grav cms admin pluginGrav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting5.1 Medium
- xeroneit library management systemXeroneit Library Management System 3.1 - "Add Book Category " Stored XSS5.1 Medium
- minitool shadowmakerMiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service Path8.5 High
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Stored XSS via Username Field5.1 Medium
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Web UI Reveals Passwords in Cleartext7.1 High
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Missing Cache Controls for Credential-bearing Pages4.8 Medium
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Lacks Rate Limiting on Authentication9.2 Critical
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Incorrect Authorization Allows Administrator Password Change8.7 High
- Show moreLoading…