CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- browserstack browserstack-local, red hat fuse 7 +1 moreBrowserStack Local vulnerable to Command Injection through logfile variable7.8 High
- netgear r6230 firmware, r6260 firmware, r7000 firmware +7 more +9 moreFunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not...7.7 High
- netgear r6230 firmware, r6260 firmware, r7000 firmware +7 more +9 moreFunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an...7.7 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core Vulnerable to Stored XSS via Module Title9.1 Critical
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal7.7 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes7.7 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core Vulnerable to Stored XSS in Module Description7.7 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core has a potential XSS vulnerability in modules' header and footer6.8 Medium
- jmlepisto clatterClatter has a PSK Validity Rule Violation issue8.0 High
- meshtastic firmwareIn Meshtastic, an attacker can spoof licensed amateur flag for a node8.2 High
- open-emr openemrOpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint8.8 High
- open-emr openemrOpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege7.1 High
- bunIn Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed...5.9 Medium
- vltvlt Mishandles Path Sanitization for tar5.9 Medium
- studiocmsStudioCMS has an Authorization Bypass Through User-Controlled Key6.5 Medium
- script3 soroban-fixed-point-mathsoroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives7.5 High
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`7.1 High
- ghost, ghost portal +1 moreGhost vulnerable to XSS via malicious Portal preview links8.8 High
- infiniflow ragflowRAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser9.8 Critical
- phpunit project phpunit, debian linux +1 morePHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling7.8 High
- akuity kargoKargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access6.9 Medium
- c4illin convertxConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`8.1 High
- squidexSquidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration9.1 Critical
- google chromeInappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110...6.5 Medium
- juniper networks session smart conductor, session smart router, wan assurance managed router +2 moreSession Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability9.3 Critical
- linuxfoundation pytorch, red hat openshift ai (rhoai), openshift ai 2.25 +2 morePyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files8.8 High
- iba systems ibapdaIncorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA10.0 Critical
- nyariv sandboxjsSandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor10.0 Critical
- delinea secret server, delinea inc. secret server on-prem +1 moreFailure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of Credentials5.3 Medium
- honoHono has a Cross-site Scripting vulnerability4.7 Medium
- fortinet fortianalyzer, fortimanager, fortinac-f +6 more +8 moreAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability...9.4 Critical
- honoHono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)6.3 Medium
- honoHono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception5.3 Medium
- honoHono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing4.8 Medium
- pablosoftwaresolutions quick 'n easy ftp serviceQuick 'n Easy FTP Service 3.2 - Unquoted Service Path8.5 High
- motorola-device-manager motorola device managerMotorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path8.5 High
- filehorse motorola device managerMotorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path8.5 High
- segurazo santivirus icSAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service Path8.5 High
- atheros coex service applicationAtheros Coex Service Application 8.0.0.255 -'ZAtheros Bt&Wlan Coex Agent' Unquoted Service Path8.5 High
- froxlor froxlor server management panelFroxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting5.1 Medium
- wondershare driver install service helpWondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service Path8.5 High
- acer global registration serviceGlobal Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path8.5 High
- seiko epson corp status monitor 3EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path8.5 High
- realtek andrea rt filtersRealtek Andrea RT Filters 1.0.64.7 - 'AERTSr64.EXE' Unquoted Service Path8.5 High
- gnupg, gpg4win +1 moreIn GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success...3.7 Low
- gnupg, gpg4win, red hat enterprise linux 10 +5 more +7 moreIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...8.4 High
- gnupg, gpg4win, red hat enterprise linux 10 +4 more +6 moreIn GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized...8.1 High
- octoprintOctoPrint has Timing Side-Channel Vulnerability in API Key Authentication6.0 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
haproxyMageiaUpdated haproxy packages fix bugsNo score- Show moreLoading…