CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- briandilley jsonrpc4jBuffer Overflow Vulnerability in briandilley/jsonrpc4j5.3 Medium
- ralim ironosA Potential SPA-vulnerability in Ralim/IronOS6.9 Medium
- tildearrow furnaceA heap-based buffer over-read or buffer overflow in tildearrow/furnace10.0 Critical
- davisking dlibA heap-based buffer over-read or buffer overflow in davisking/dlib5.2 Medium
- gaijinentertainment dagorengineAn Uninitialized stack variable vulnerability in GaijinEntertainment/DagorEngine9.3 Critical
- neka-nat cupochAn out of bounds write due to a missing bounds check in neka-nat/cupoch6.9 Medium
- cloverhackycolor cloverbootloaderAn Out-of-bounds Write in CloverHackyColor/CloverBootloader5.1 Medium
- cloverhackycolor cloverbootloaderA Out-of-bounds Read vulnerability in CloverHackyColor/CloverBootloader6.9 Medium
- cardboardpowered cardboardChunk Unloading Security Vulnerability in CardboardPowered/cardboard9.2 Critical
- azerothcore, azerothcore azerothcore-wotlk +1 moreA heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk10.0 Critical
- muntashirakon appmanagerA possible integer overflow vulnerability in RawTherapee/RawTherapee4.6 Medium
- anyrtcio-community anyrtc-rtmp-opensourceA heap-based buffer over-read or buffer overflow in tildearrow/furnace8.7 High
grepleaksnpmWithdrawn Advisory: Malware in grepleaksNo score- linknacional link invoice payment for woocommerceLink Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation5.3 Medium
- fujifilm business innovation corp. beat-access for windowsbeat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which...5.4 Medium
- delta electronics asda-soft, deltaww asda soft +1 moreASDA-Soft Stack-based Buffer Overflow Vulnerability7.8 High
- gmrtdgmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values5.9 Medium
- amir20 dozzleDozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access8.7 High
- hustojHUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE9.3 Critical
- qgisQGIS had validated RCE and Repository Takeover via GitHub Actions8.7 High
- sap se fiori app (intercompany balance reconciliation)Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation)4.3 Medium
wamrOSS-FuzzNull-dereference READ in wasm_runtime_invoke_nativeNo score- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function5.3 Medium
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreMissing ASN1_TYPE validation in PKCS#12 parsing5.5 Medium
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php.9.8 Critical
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser...9.8 Critical
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php...9.8 Critical
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage...9.8 Critical
- carmelo computer book storecode-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php.9.8 Critical
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreNULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function7.5 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreMissing ASN1_TYPE validation in TS_RESP_verify_response() function7.5 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreOut of bounds write in PKCS12_get_friendlyname() UTF-8 conversion7.4 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreUnauthenticated/unencrypted trailing bytes with low-level OCB function calls4.0 Medium
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreHeap out-of-bounds write in BIO_f_linebuffer on short writes4.7 Medium
- opensslTLS 1.3 CompressedCertificate excessive memory allocation5.9 Medium
- cpuid cpu-zThe kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed...5.5 Medium
- libpngBuffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial...5.5 Medium
- libpngBuffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial...5.5 Medium
- openssl'openssl dgst' one-shot codepath silently truncates inputs >16MB5.5 Medium
- opensslNULL dereference in SSL_CIPHER_find() function on unknown cipher ID5.9 Medium
- openssl, red hat cost management 4, ai inference server 3.2 +316 more +318 moreStack buffer overflow in CMS (Auth)EnvelopedData parsing8.8 High
- opensslImproper validation of PBMAC1 parameters in PKCS#12 MAC verification6.1 Medium
- theupdateframework go-tufgo-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names4.7 Medium
- py-pdf pypdfpypdf has possible Infinite Loop when processing outlines/bookmarks5.1 Medium
- mobsf mobile-security-framework-mobsf, opensecurity mobile security framework +1 moreMobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field8.1 High
@saltcorn/servernpmSaltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE9.6 Critical- hisense transtech smart bus management systemHisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injection6.9 Medium
- d-link dir-615, dlink dir-615 firmware +1 moreD-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection8.6 High
- happyhackingspace gakidoGakido vulnerable to HTTP Header Injection (CRLF Injection)5.3 Medium
- fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 morePython-Multipart has Arbitrary File Write via Non-Default Configuration8.6 High
- Show moreLoading…