CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- dell unity, unity operating environment +1 moreDell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements...7.8 High
- codriapp innovation and software technologies inc. heygarsonSensitive Data Exposure in CoDeriApp's HeyGarson8.2 High
- dell unityvsa, unity operating environment +1 moreDell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special...7.8 High
- llamastack llama stackLlama Stack exposes secret in initialization log3.2 Low
- libexpat project libexpat, siemens ruggedcom rst2428p (6gk6242-6pa00), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size...6.9 Medium
- arcadia technology, llc crafty controllerImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller8.2 High
- arcadia technology, llc crafty controllerImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller9.9 Critical
- danofficeit local admin serviceLocal Privilege Escalation in Local Admin Service7.1 High
- zephyrproject-rtos zephyrnet: icmp: Out of bound memory read6.5 Medium
- netgear productsSome end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic...8.7 High
- internet information co., ltd dreammakerInterinfo DreamMaker - Unrestricted Upload of File with Dangerous Type10.0 Critical
- internet information co., ltd dreammakerInterinfo DreamMaker - Missing Authentication for Critical Function9.3 Critical
- tanium serverTanium addressed an improper access controls vulnerability in Tanium Server.4.3 Medium
- geopandasgeopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure8.6 High
- aelsantex runcommandaelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to...9.8 Critical
- tenda ac21, ac21 firmware +1 moreTenda AC21 mDMZSetCfg command injection5.3 Medium
- nvm-sh nvmCommand Injection in nvm via NVM_AUTH_HEADER in wget code path5.4 Medium
- tenda ac21, ac21 firmware +1 moreTenda AC21 AdvSetMacMtuWan fromAdvSetMacMtuWan stack-based overflow8.7 High
- polarlearnPolarLearn's unvalidated vote direction allows vote count manipulation7.1 High
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection5.3 Medium
- d-link dwr-m961, dlink dwr-m961 firmware +1 moreD-Link DWR-M961 formLtefotaUpgradeFibocom command injection5.3 Medium
- pwncollege dojopwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution8.3 High
- runtipiRuntipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal7.6 High
- gradle gradle-completiongradle-completion has a Bash command injection issue8.3 High
- digitalcorpora tcpflow, debian linux +1 moretcpflow has TIM Element OOB Write in wifipcap5.5 Medium
- sharpred deephasdeepHas vulnerable to Prototype Pollution via constructor.prototype9.4 Critical
- moonshotai kimi-agent-sdk[Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js2.9 Low
- budibaseBudibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role5.7 Medium
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 moreA code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated...9.8 Critical
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 moreA code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated...9.8 Critical
- inspektor-gadget, linuxfoundation inspektor gadget +1 moreInspektor Gadget has a Command Injection vulnerability in Makefile.build6.6 Medium
- adguard trusttunnelTrustTunnel has SSRF and private network restriction bypass via numeric address destinations7.1 High
- adguard trusttunnelTrustTunnel has `client_random_prefix` rule bypass via fragmented or partial TLS ClientHello5.3 Medium
- chainguard malcontentmalcontent's archive extraction could write outside extraction directory5.5 Medium
- chainguard malcontentmalcontent's OCI image scanning could expose registry credentials6.5 Medium
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi setUpgradeFW command injection5.3 Medium
- tanium interactTanium addressed an improper access controls vulnerability in Interact.3.1 Low
- umbraco forms, umbraco.forms.issues +1 moreUmbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac6.0 Medium
- loft-sh loftvCluster Platform's Access Keys Allows Access Beyond Scope9.1 Critical
- birkir primebirkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL5.1 Medium
- fluentcmsFluentCMS 2026 Stored XSS via SVG Upload in File Management4.8 Medium
- alsa project alsa-libalsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow4.6 Medium
- kiloview encoder series e1 hardware version 1.4, encoder series e1 hardware version 1.6.20, encoder series e1-s hardware version 1.4 +7 more +9 moreMissing Authentication for Critical Function in KiloView Encoder Series9.3 Critical
- tenda ax12 pro v2, ax12 pro firmware +1 moreTenda AX12 Pro V2 Telnet Service hard-coded credentials9.2 Critical
- tp-link vigi c385 firmware, tp-link systems inc. vigi c485 v1 +1 moreAuthenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C3858.5 High
- totolink a7000r, a7000r firmware +1 moreTotolink A7000R cstecgi.cgi setUploadUserData command injection5.3 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreMissing Application-Layer Encryption in Web Interface Endpoints on TP-Link VX800v5.3 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreRead-Only Root Access via USB Storage Device in TP-Link VX800v5.1 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreDenial of Service (DoS) of VoIP Communication on TP-Link VX800v6.3 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreAccess to System Files via SFTP on TP-Link VX800v6.9 Medium
- Show moreLoading…