CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreInsecure Encryption in Communication with the Web Interface on TP-Link VX800v7.7 High
- bdtask bhojon, bhojon all-in-one restaurant management system +1 moreBdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error5.3 Medium
- icinga icinga-powershell-framework, powershell framework +1 moreIcinga for Windows certificate can have too-open permissions6.8 Medium
- bdtask bhojon, bhojon all-in-one restaurant management system +1 moreBdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error5.3 Medium
- tp-link systems inc. archer re605x, tp-link archer re605x firmware +1 moreInsufficient Backup File Upload Input Validation on TP-Link Archer RE605X7.3 High
- katacontainers kata containers, kata-containers +1 moreKata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers8.8 High
- futo immichimmich API Key Privilege Escalation vulnerability7.2 High
- bdtask bhojon, bhojon all-in-one restaurant management system +1 moreBdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting5.1 Medium
- bdtask saleserpBdtask SalesERP Administrative Endpoint improper authorization5.3 Medium
- parsec.cloud parsec, scille parsec-cloud +1 more`libparsec_crypto` does not check for weak order point of curve 255198.3 High
- obsidianforensics unfurlUnfurl - Werkzeug Debugger Exposure via String Config Parsing9.3 Critical
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection5.3 Medium
- angeljudesuarez society management systemitsourcecode Society Management System edit_student_query.php sql injection6.9 Medium
- obsidianforensics unfurlUnfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression8.7 High
- b&r industrial automation gmbh process visualization interface (pvi)Insertion of Sensitive Information into Logfile5.1 Medium
- schneider electric ecostruxure™ process expert, ecostruxure™ process expert for aveva system platform +1 moreCWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege...7.0 High
- b3log siyuanSiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE9.1 Critical
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT is Vulnerable to RCE via Disabled Block Execution8.6 High
- global interactive design media software inc. content management system (cms), globalmedya content management system +1 moreTime Based SQLi in Global Medya's PHP CMS7.5 High
- global interactive design media software inc. content management system (cms), globalmedya content management system +1 moreReflected XSS in Global Medya's PHP CMS7.5 High
- angeljudesuarez society management systemitsourcecode Society Management System add_expenses.php sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System edit_expenses_query.php sql injection6.9 Medium
- 10-strike bandwidth monitorBandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path8.5 High
- sonarqubeSonarQube 8.3.1 - Unquoted Service Path8.5 High
- goautodialGOautodial 4.0 - Persistent Cross-Site Scripting5.1 Medium
- wibu codemeterCodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path8.5 High
- barcode-ocr barcodeocrBarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service Path8.5 High
- ruijienetworks ruijie networks switch eweb s29 rgosRuijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal7.1 High
- tucows inc. audio playback recorderAudio Playback Recorder 3.2.2 - Local Buffer Overflow (SEH)8.4 High
- ammarfaizi2 tea latexTea LaTex 1.0 - Remote Code Execution9.3 Critical
- gnome fonts viewerGnome Fonts Viewer 3.34.0 Heap Corruption8.4 High
- bearshareofficial bearshare liteBearShare Lite 5.2.5 - 'Advanced Search'Buffer Overflow in (PoC)8.4 High
- meddream pacs serverMedDream PACS Server 6.8.3.751 - Remote Code Execution8.7 High
- elektraweb easypmsEasyPMS 1.0.0 - Authentication Bypass8.7 High
- salihciftci limanLiman 0.7 - Cross-Site Request Forgery (Change Password)5.1 Medium
- crm-now gmbh berlicrmberliCRM 1.0.24 - 'src_record' SQL Injection7.1 High
- timeclock software softwareTimeClock Software 1.01 Authenticated Time-Based SQL Injection7.1 High
- codexcube ultimate project manager crm proUltimate Project Manager CRM PRO 2.0.5 - SQLi Credentials Leakage7.1 High
- ajentiAjenti 2.1.36 Authenticated Remote Code Execution8.7 High
- frigate3 frigate professionalFrigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter)8.4 High
- cleanersoft software free mp3 cd ripperFree MP3 CD Ripper 2.8 - Stack Buffer Overflow (SEH + Egghunter)8.4 High
- elaniin cmselaniin CMS 1.0 - Authentication Bypass8.8 High
- dummysoftware backlinkspeedBacklinkSpeed 2.4 - Buffer Overflow PoC (SEH)8.4 High
- telnet-lite mocha telnet lite for iosMocha Telnet Lite for iOS 4.2 - 'User' Denial of Service4.6 Medium
- qliktech international ab qlikviewQlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service4.6 Medium
- angeljudesuarez school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- angeljudesuarez school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- qr menu pro smart menu systems menu panelSession Hijacking in QRMenumPro's Menu Panel5.7 Medium
- qr menu pro smart menu systems menu panelIDOR in QRMenumPro's Menu Panel5.7 Medium
- red hat osim, redhat open security issue management +1 moreosim: Path Traversal via query parameters in Nginx configuration7.5 High
- Show moreLoading…