CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- verypdf docprint prodocPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter)8.4 High
- ik80 yatinywinftpYATinyWinFTP - Denial of Service8.7 High
- intelbras router rf 301kIntelbras Router RF 301K 1.1.2 - Authentication Bypass8.7 High
- tendenciTendenci 12.3.1 - CSV/ Formula Injection5.3 Medium
- 10-strike software network inventory explorer10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)8.4 High
- webdamn.com webdamn user registration & login system with user panelWebDamn User Registration & Login System with User Panel - SQLi Auth Bypass8.8 High
- ilias, ilias.de ilias learning management system +1 moreILIAS Learning Management System 4.3 - SSRF6.9 Medium
- asc applied software consultants timetablesaSc TimeTables 2021.6.2 - Denial of Service6.7 Medium
- explorance blueUnrestricted File Upload Vulnerability in Explorance Blue9.1 Critical
- drupal central authentication system (cas) server, jtenman central authentication system server +1 moreCentral Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-0074.2 Medium
- drupal canvasDrupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-0064.8 Medium
- explorance blueSQL Injection Vulnerability in Explorance Blue10.0 Critical
- apple ipados, macos, pages +2 more +4 moreAn out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26...4.3 Medium
- apple ipados, keynote, macos +2 more +4 moreThe issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26,...5.5 Medium
- explorance blueSQL Injection Vulnerability in Explorance Blue8.6 High
- openprojectOpenProject has Argument Injection on Repository module that allows Arbitrary File Write9.4 Critical
- broadcom symantec endpoint protection windows clientComponent Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client4.4 Medium
- broadcom symantec endpoint protection windows clientElevation of Privileges in Symantec Endpoint Protection Windows Client6.7 Medium
- open5gsOpen5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of service6.9 Medium
- broadcom symantec web security services agentElevation of Privileges in Web Security Services (WSS) Agent7.0 High
- egroupwareEGroupware has SQL Injection in Nextmatch Filter Processing8.7 High
ucode-amdSUSESecurity update for ucode-amdNo scoreucode-amdSUSESecurity update for ucode-amdNo scoreucode-amdopenSUSESecurity update for ucode-amdNo scoreagentos-taskweaverPyPITaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)6.5 Medium- vercel next.jsNext.js: Server-Side Request Forgery in Server Actions on Custom Servers8.3 High
- vercel next.jsNext.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies6.3 Medium
- vercel next.jsNext.js: Unbounded Server Action payload in Edge runtime6.3 Medium
- vercel next.jsNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname8.3 High
- vercel next.jsNext.js: Unauthenticated Disclosure of Internal Server Function endpoints6.3 Medium
- vercel next.jsNext.js: Cross-site scripting in App Router applications using CSP nonces4.7 Medium
- vercel next.jsNext.js: Cross-site scripting in beforeInteractive scripts with untrusted input6.1 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Denial of Service via connection exhaustion in applications using Cache Components7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Server-side request forgery in applications using WebSocket upgrades8.6 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Denial of Service in the Image Optimization API5.9 Medium
- vercel next.jsNext.js: Cache poisoning in React Server Component responses5.4 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in Pages Router applications using i18n7.5 High
- vercel next.jsNext.js: Middleware / Proxy redirects can be cache-poisoned3.7 Low
- vercel next.jsNext.js: HTTP request smuggling in rewrites6.3 Medium
- vercel next.jsNext.js: Unbounded next/image disk cache growth can exhaust storage6.9 Medium
- facebook react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +2 moreNext.js HTTP request deserialization can lead to DoS when using insecure React Server Components7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: credential leakage via http redirects5.8 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header5.8 Medium
- canonical jujuJuju has broken CMR authorization2.1 Low
helmopenSUSESecurity update for helmNo scorekubernetesopenSUSESecurity update for kubernetesNo scorecontainer-suseconnectSUSESecurity update for container-suseconnectNo score- open5gsOpen5GS SGWC s5c-handler.c denial of service6.9 Medium
- No product listedrethinkdb Secondary Index cross site scripting4.8 Medium
- litonice13 wp adminify – white label wordpress, admin menu editor, login customizerWP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API5.3 Medium
- Show moreLoading…