CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- jishenghua jsherpjishenghua jshERP installByPath install path traversal5.1 Medium
- open5gsOpen5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of service6.9 Medium
- open5gsOpen5GS SGWC s11-handler.c ogs_gtp2_f_teid_to_ip denial of service6.9 Medium
- akinsoft qr menuImproper Access Control in Akinsoft's QR Menu8.0 High
- akinsoft qr menuSession Hijacking in Akinsoft's QR Menu5.7 Medium
- nova-a planmanagerStored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager6.9 Medium
- dell openmanage network integrationDell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication...4.3 Medium
- teamviewer dex, digital employee experience +1 moreLog timestamp tampering vulnerability in Content Distribution Service6.5 Medium
- teamviewer dex, digital employee experience +1 moreOut-of-bounds read vulnerability in Content Distribution Service6.5 Medium
- teamviewer dex, digital employee experience +1 moreOut-of-bounds read vulnerability in Content Distribution Service5.4 Medium
- teamviewer dex, digital employee experience +1 moreInteger underflow in Content Distribution Service UDP handler6.5 Medium
- teamviewer dex, digital employee experience +1 moreLog Injection in Content Distribution Service UDP Handler6.5 Medium
- teamviewer dex, digital employee experience +1 moreDenial-of-Service in Content Distribution Service6.5 Medium
- teamviewer dex, digital employee experience +1 moreTransmission of Unencrypted Data in Content Distribution Service6.5 Medium
- teamviewer dex, digital employee experience +1 moreCommand Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEX6.8 Medium
- teamviewer dex, digital employee experience +1 morePrivilege escalation in TeamViewer DEX via DeleteFileByPath instruction5.7 Medium
- eclipse omrIn the Eclipse OMR port library component since release 0.2.0, an API function to return the...6.9 Medium
- unknown custom login page customizerCustom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset8.1 High
- smartertools smartermailSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion6.9 Medium
- brother industries, ltd. multiple mfpsHidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which...6.9 Medium
- brother industries, ltd. multiple mfpsMultiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates...6.3 Medium
- sem-cms semcmsSEMCMS SEMCMS_Info.php sql injection5.3 Medium
- icinga, icinga icinga2 +1 moreIcinga has insecure permission of %ProgramData%\icinga2\var on Windows6.8 Medium
- oneflowAn input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor...6.2 Medium
- oneflowAn input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9...6.2 Medium
- oneflowA segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx...6.2 Medium
- n3uron web user interfaceAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate...9.8 Critical
- tale project taleCross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code.6.1 Medium
- shirt-pocket superduper\!An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the...7.8 High
- amidaware tactical rmmA Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/...8.8 High
- monkey-project monkeyA stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit...7.5 High
- monkey-project monkeyAn out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit...7.5 High
- monkey-project monkeyAn out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit...7.5 High
- monkey-project monkeyA NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey...7.5 High
- monkey-project monkeyAn out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit...7.5 High
- monkey-project monkeyA use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit...7.5 High
- monkey-project monkeyA use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit...7.5 High
- monkey-project monkeyAn out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit...7.5 High
- monkey-project monkeyAn out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server...7.5 High
cactiDebianA HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a...5.4 Medium- tanium assetTanium addressed a SQL injection vulnerability in Asset.6.3 Medium
- angeljudesuarez school management systemitsourcecode School Management System controller.php sql injection5.3 Medium
- phpgurukul hospital management systemPHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization5.3 Medium
- jishenghua jsherpjishenghua jshERP PluginController uploadPluginConfigFile path traversal5.3 Medium
- b3log siyuanSiYuan has a File Read Interface Case Bypass Vulnerability7.5 High
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection5.3 Medium
- erugoAuthenticated Remote Code Execution via Arbitrary File Upload10.0 Critical
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi setUnloadUserData command injection5.3 Medium
- jishenghua jsherpjishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection5.3 Medium
- stellar rs-soroban-sdksoroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u645.3 Medium
- Show moreLoading…