CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- totolink x6000rTOTOLINK X6000R Unauthenticated Command Injection Vulnerability9.2 Critical
- orvalOrval has a code injection via unsanitized x-enum-descriptions uing JS comments9.3 Critical
- aliasrobotics caiCybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool9.7 Critical
- bobthecow psyshPsySH has Local Privilege Escalation via CWD .psysh.php auto-load6.7 Medium
- lobehub lobe-chatLobeHub Vulnerable to Improper Authorization in Presigned Upload5.7 Medium
- the wikimedia foundation mediawiki - discussiontools extensionDiscussionTools should use better regex8.8 High
- opentext™ verticaCleartext Storage of Sensitive Information vulnerability has been discovered in OpenText™ Vertica.6.9 Medium
- openvpnInsufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote...3.8 Low
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software User Management user.php improper authorization5.3 Medium
- itsourcecode school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- projectworlds house rental and property listing, house rental and property listing project +1 moreprojectworlds House Rental and Property Listing sms.php cross site scripting5.1 Medium
- adlered bolo-solobolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization5.3 Medium
- tenda hg10, hg10 firmware +1 moreTenda HG10 formSysCmd system command injection5.1 Medium
- tenda hg10, hg10 firmware +1 moreTenda HG10 Login formLogin checkUserFromLanOrWan command injection6.9 Medium
- drive-software atomic alarm clock x86Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path8.5 High
- getpopcorntime popcorn timePopcorn Time 6.2 - 'Update service' Unquoted Service Path8.5 High
- andrea electronics st filters serviceAndrea ST Filters Service 1.0.64.7 - Unquoted service path8.5 High
- getoutline outline serviceOutline Service 1.3.3 - 'Outline Service ' Unquoted Service Path8.5 High
- openz erpOpenZ ERP 3.6.60 - Persistent Cross-Site Scripting5.1 Medium
- orchardcore orchard coreOrchard Core RC1 - Persistent Cross-Site Scripting5.1 Medium
- trytonTryton 5.4 - Persistent Cross-Site Scripting5.1 Medium
- sellacious ecommerceSellacious eCommerce 4.6 - Persistent Cross-Site Scripting5.1 Medium
- forma e-learning suiteforma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting5.1 Medium
- php-fusion phpfusionPHPFusion 9.03.50 - Persistent Cross-Site Scripting5.1 Medium
- dolibarrDolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting5.1 Medium
- clive 21 directory management systemitsourcecode Directory Management System index.php sql injection6.9 Medium
- tenda hg10, hg10 firmware +1 moreTenda HG10 Boa Webserver formSamba command injection6.9 Medium
- kodmatic computer software tourism construction industry and trade ltd. co. online exam and assessmentTime-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment8.6 High
- naturalintelligence fast-xml-parserfast-xml-parser has RangeError DoS Numeric Entities Bug7.5 High
- vendureVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy2.7 Low
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover7.2 High
- churchcrm, churchcrm crm +1 moreChurch CRM has SQL injection in PaddleNumEditor.php8.8 High
- silabs.com silicon labs zigbee stackZigbee Router Denial of Service9.2 Critical
- totolink a3600r, a3600r firmware +1 moreTotolink A3600R app.so setAppEasyWizardConfig buffer overflow8.7 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Login sub_40AC74 excessive authentication6.3 Medium
- free5gc, free5gc smf +1 moreFree5GC SMF PFCP UDP Endpoint pfcp_reports.go HandleReports denial of service6.9 Medium
- red hat build of apicurio registry 2, build of quarkus, data grid 8 +7 more +9 moreUndertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks7.5 High
- progress software chef inspecUntrusted user data can lead to privilege escalation5.8 Medium
- free5gc, free5gc smf +1 moreFree5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service6.9 Medium
- free5gc, free5gc smf +1 moreFree5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference6.9 Medium
- zohocorp manageengine opmanager, manageengine netflow analyzer, manageengine oputils +2 moreStored XSS4.6 Medium
- watchguard fireware osWatchGuard Firebox LDAP Injection7.0 High
- eset, spol. s.r.o eset inspect connectorLocal privilege escalation in ESET Inspect Connector for Windows8.4 High
- johnson controls metasysMetasys product command injection vulnerability could allow remote SQL execution9.5 Critical
- hiksemi hs-afs-s1h1Due to insufficient input parameter validation on the interface, authenticated users of certain...4.9 Medium
- hiksemi hs-afs-s1h1Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of...4.6 Medium
- hiksemi hs-afs-s1h1Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can...4.3 Medium
- hiksemi hs-afs-s1h1Due to insufficient input parameter validation on the interface, authenticated users of certain...7.2 High
- hikvision ds-3wap521-si, ds-3wap522-si, ds-3wap621e-si +3 more +5 moreSome Hikvision Wireless Access Points are vulnerable to authenticated command execution due to...7.2 High
- eclipse theia website, eclipse foundation theia - website +1 moreIn the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview...10.0 Critical
- Show moreLoading…