CVE-2026 list

CVE-2026 records published in January 2026

Page two of two: records 1,001 to 1,830 of the 1,830 published in January 2026, newest first. The first page carries the figures for January 2026.

CVE-2026 records published in January 2026, newest first: records 1,001 to 1,830 of 1,830
CVE Summary CVSS EPSS Published Signals
CVE-2026-23829Mailpit has SMTP header injection via Regex Bypass5.3CNA v3.11.4%2026-01-19NucleiExploit codeFix
CVE-2026-23732FreeRDP FastGlyph parser heap-based buffer overflow5.5CNA v4.00.6%2026-01-19Fix
CVE-2026-23721OpenProject users with View Members permission in any project can view all Group memberships4.3CNA v3.10.2%2026-01-19Fix
CVE-2026-23646OpenProject users can delete other user's session, causing them to be logged out6.5CNA v3.10.4%2026-01-19Fix
CVE-2026-23625OpenProject has stored XSS regression using attachments and script-src self8.7CNA v3.10.2%2026-01-19Fix
CVE-2026-23534FreeRDP ClearCodec bands decoder heap buffer overflow7.7CNA v4.00.5%2026-01-19Fix
CVE-2026-23533FreeRDP ClearCodec residual data decoder heap buffer overflow7.7CNA v4.00.5%2026-01-19Fix
CVE-2026-23532FreeRDP GDI surface-to-surface copy heap buffer overflow7.7CNA v4.00.5%2026-01-19Fix
CVE-2026-23531FreeRDP ClearCodec decoder heap buffer overflow7.7CNA v4.00.5%2026-01-19Fix
CVE-2026-23530FreeRDP planar codec decompression heap buffer overflow7.7CNA v4.00.5%2026-01-19Fix
CVE-2026-23522LobeHub Lobe Chat knowledge base file removal insecure direct object reference3.7CNA v3.10.2%2026-01-19Fix
CVE-2026-22850ibericode Koko Analytics analytics export and import SQL injection8.4CNA v3.10.5%2026-01-19Fix
CVE-2026-22797OpenStack keystonemiddleware authentication bypass by spoofing9.9CNA v3.10.7%2026-01-19Fix
CVE-2026-22219Chainlit SQLAlchemy Data Layer SSRF via /project/element7.7NVD v3.15.1%2026-01-19Fix
CVE-2026-22218Chainlit arbitrary file read via /project/element6.5NVD v3.19.5%2026-01-19Fix
CVE-2026-22037@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)8.4CNA v3.10.4%2026-01-19Fix
CVE-2026-22031Fastify Middie Middleware Path Bypass8.4CNA v3.10.5%2026-01-19Fix
CVE-2026-21696Pterodactyl Wings activity log processing resource exhaustion8.3CNA v4.00.5%2026-01-19Fix
CVE-2026-21618hexpm cross-site scripting (XSS) in OAuth Device Authorization screen8.5CNA v4.00.3%2026-01-19Fix
CVE-2026-1193MineAdmin view view improper authorization8.8v3.10.4%2026-01-19
CVE-2026-1192Tosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection6.9CNA v4.06.9%2026-01-19
CVE-2026-1181Altium 365 Over-Permissive CORS Configuration allows Credentialed Cross-Origin Workspace Access9.0CNA v3.10.4%2026-01-19
CVE-2026-1179Yonyou KSOA HTTP GET parameter user_popedom.jsp SQL injection9.8v3.10.4%2026-01-19
CVE-2026-1178Yonyou KSOA HTTP GET parameter select.jsp SQL injection9.8v3.10.4%2026-01-19
CVE-2026-1177Yonyou KSOA HTTP GET parameter save_folder.jsp SQL injection9.8v3.10.4%2026-01-19
CVE-2026-1176itsourcecode School Management System index.php SQL injection9.8v3.10.4%2026-01-19
CVE-2026-1175birkir prime GraphQL Directive graphql information exposure7.5v3.10.5%2026-01-19
CVE-2026-1174birkir prime GraphQL Alias graphql resource consumption7.5v3.10.8%2026-01-19
CVE-2026-1173birkir prime GraphQL Array Based Query Batch graphql denial of service9.8v3.10.8%2026-01-19
CVE-2026-1172birkir prime GraphQL Directive graphql denial of service7.5v3.10.6%2026-01-19
CVE-2026-1171birkir prime GraphQL field graphql denial of service7.5v3.10.6%2026-01-19
CVE-2026-1170birkir prime GraphQL API graphql information disclosure6.9CNA v4.00.4%2026-01-19
CVE-2026-1169birkir prime cross-site request forgery8.8v3.10.2%2026-01-19
CVE-2026-1162UTT HiPER 810 setSysAdm strcpy buffer overflow9.3CNA v4.00.8%2026-01-19
CVE-2026-1161pbrong hrms recruitment.go UpdateRecruitmentById cross-site scripting5.1CNA v4.00.2%2026-01-19
CVE-2026-1160PHPGurukul Directory Management System Search index.php SQL injection9.8v3.10.4%2026-01-19
CVE-2026-1159itsourcecode Online Frozen Foods Ordering System order_online.php SQL injection9.8v3.10.4%2026-01-19
CVE-2026-1158Totolink LR350 POST request cstecgi.cgi setWizardCfg buffer overflow8.7CNA v4.00.7%2026-01-19
CVE-2026-1157Totolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflow8.7CNA v4.01.0%2026-01-19Emerging Threats
CVE-2026-1156Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflow8.7CNA v4.00.7%2026-01-19
CVE-2026-1155Totolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflow8.7CNA v4.00.9%2026-01-19
CVE-2026-1154SourceCodester E-Learning System Lesson index.php cross-site scripting5.4v3.10.4%2026-01-19
CVE-2026-1153technical-laohu mpay cross-site request forgery4.3v3.10.3%2026-01-19
CVE-2026-1152technical-laohu mpay QR Code Image unrestricted upload9.8v3.10.3%2026-01-19
CVE-2026-1151technical-laohu mpay User Center cross-site scripting5.4v3.10.2%2026-01-19
CVE-2026-1150Totolink LR350 POST request cstecgi.cgi setTracerouteCfg command injection8.8v3.12.7%2026-01-19
CVE-2026-1149Totolink LR350 POST request cstecgi.cgi setDiagnosisCfg command injection8.8v3.13.1%2026-01-19
CVE-2026-1148SourceCodester Patients Waiting Area Queue Management System cross-site request forgery6.5v3.10.2%2026-01-19
CVE-2026-1147SourceCodester Patients Waiting Area Queue Management System cross-site scripting5.4v3.10.3%2026-01-19
CVE-2026-1146SourceCodester Patients Waiting Area Queue Management System cross-site scripting5.4v3.10.2%2026-01-19
CVE-2026-1145quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow8.8v3.10.4%2026-01-19Fix
CVE-2026-1144quickjs-ng quickjs Atomics Ops quickjs.c use-after-free8.8v3.10.4%2026-01-19Fix
CVE-2026-1143TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflow8.7CNA v4.00.7%2026-01-19
CVE-2026-1142PHPGurukul News Portal cross-site request forgery6.5v3.10.2%2026-01-19
CVE-2026-1141PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization8.8v3.10.3%2026-01-19
CVE-2026-1140UTT 进取 520W ConfigExceptAli strcpy buffer overflow8.7CNA v4.00.8%2026-01-19
CVE-2026-1139UTT 进取 520W ConfigExceptMSN strcpy buffer overflow8.7CNA v4.01.0%2026-01-19
CVE-2026-1138UTT 进取 520W ConfigExceptQQ strcpy buffer overflow8.7CNA v4.01.0%2026-01-19
CVE-2026-1137UTT 进取 520W formWebAuthGlobalConfig strcpy buffer overflow8.7CNA v4.01.0%2026-01-19
CVE-2026-1136lcg0124 BootDo ContentController save cross-site scripting5.1CNA v4.00.3%2026-01-19
CVE-2026-1135itsourcecode Society Management System activity.php cross-site scripting6.1v3.10.4%2026-01-19
CVE-2026-1134itsourcecode Society Management System expenses.php cross-site scripting6.1v3.10.4%2026-01-19
CVE-2026-1133Yonyou KSOA HTTP GET parameter folder.jsp SQL injection9.8v3.10.5%2026-01-19
CVE-2026-1132Yonyou KSOA HTTP GET parameter edit_folder.jsp SQL injection9.8v3.10.6%2026-01-19
CVE-2026-1131Yonyou KSOA HTTP GET parameter save_catalog.jsp SQL injection9.8v3.10.6%2026-01-19
CVE-2026-1130Yonyou KSOA HTTP GET parameter worksadd_plan.jsp SQL injection9.8v3.10.5%2026-01-19
CVE-2026-1129Yonyou KSOA HTTP GET parameter worksadd.jsp SQL injection9.8v3.10.5%2026-01-19
CVE-2026-1007Devolutions Server virtual gateway component incorrect authorization7.6CISA ADP v3.10.2%2026-01-19Fix
CVE-2026-0943HarfBuzz::Shaper versions for Perl contains a bundled library with a null pointer dereference7.5CISA ADP v3.10.5%2026-01-19Fix
CVE-2026-0610Devolutions Server remote-sessions SQL injection9.8CISA ADP v3.10.3%2026-01-19Fix
CVE-2026-23733LobeHub Lobe Chat Mermaid artifact renderer stored cross-site scripting6.4CNA v3.10.1%2026-01-18Fix
CVE-2026-23644Esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages7.7CNA v4.00.5%2026-01-18Fix
CVE-2026-23626Kimai vulnerable to authenticated server-side template injection (SSTI)6.8CNA v3.10.5%2026-01-18Fix
CVE-2026-235251Panel App Store vulnerable to cross-site scripting6.4CNA v3.10.4%2026-01-18Fix
CVE-2026-1126lwj flow SVG File FormResource.java uploadFile unrestricted upload5.3CNA v4.00.3%2026-01-18
CVE-2026-1125D-Link DIR-823X set_wifidog_settings sub_412E7C command injection9.8v3.115.7%2026-01-18Emerging Threats
CVE-2026-1124Yonyou KSOA HTTP GET parameter work_report.jsp SQL injection9.8v3.10.5%2026-01-18
CVE-2026-1123Yonyou KSOA HTTP GET parameter work_mod.jsp SQL injection9.8v3.10.5%2026-01-18
CVE-2026-1122Yonyou KSOA HTTP GET parameter work_info.jsp SQL injection9.8v3.10.5%2026-01-18
CVE-2026-1121Yonyou KSOA HTTP GET parameter del_workplan.jsp SQL injection9.8v3.10.5%2026-01-18
CVE-2026-1120Yonyou KSOA HTTP GET parameter del_work.jsp SQL injection9.8v3.10.5%2026-01-18
CVE-2026-1119itsourcecode Society Management System delete_activity.php SQL injection9.8v3.10.4%2026-01-18
CVE-2026-1118itsourcecode Society Management System add_activity.php SQL injection9.8v3.10.4%2026-01-18
CVE-2026-1112Sanluan PublicCMS trade address deletion endpoint improper authorization8.1v3.10.4%2026-01-18
CVE-2026-1111Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal7.2v3.10.7%2026-01-18
CVE-2026-1110cijliu librtsp rtsp_parse_method buffer overflow7.8v3.10.3%2026-01-18
CVE-2026-1109cijliu librtsp rtsp_parse_request buffer overflow7.8v3.10.2%2026-01-18
CVE-2026-1108cijliu librtsp rtsp_rely_dumps buffer overflow7.8v3.10.2%2026-01-18
CVE-2026-1107EyouCMS Member Avatar Diyajax.php check_userinfo unrestricted upload9.8v3.10.5%2026-01-18Exploit code
CVE-2026-1106Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization5.3CNA v4.00.4%2026-01-18
CVE-2026-1105EasyCMS UserAction.class.php SQL injection9.8v3.10.5%2026-01-18
CVE-2026-0863Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host9.9NVD v3.19.4%2026-01-18Fix
CVE-2026-1066kalcaddle kodbox Compression zip command injection8.8v3.15.6%2026-01-17
CVE-2026-1064bastillion-io Bastillion System Management SystemKtrl.java command injection5.1CNA v4.04.6%2026-01-17
CVE-2026-1063bastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injection5.1CNA v4.04.6%2026-01-17
CVE-2026-1062xiweicheng TMS HtmlUtil.java summary server-side request forgery9.8v3.10.4%2026-01-17
CVE-2026-1061xiweicheng TMS FileController.java upload unrestricted upload9.8v3.10.4%2026-01-17
CVE-2026-1059FeMiner wms chkuser.php SQL injection9.8v3.10.4%2026-01-17
CVE-2026-1050risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java SQL injection6.9CNA v4.00.4%2026-01-17
CVE-2026-1049LigeroSmart index.pl cross-site scripting5.4v3.10.2%2026-01-17
CVE-2026-1048LigeroSmart index.pl cross-site scripting5.4v3.10.3%2026-01-17
CVE-2026-0833Team Section Block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-17Fix
CVE-2026-0820RepairBuddy WordPress plugin insecure direct object reference4.3CNA v3.10.2%2026-01-17Fix
CVE-2026-0808Spin Wheel WordPress plugin unauthenticated Client-Side Prize manipulation via prize_index parameter5.3CNA v3.10.4%2026-01-17Fix
CVE-2026-0725Integrate Dynamics 365 CRM WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-17Fix
CVE-2026-0691CM E-Mail Blacklist WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-01-17Fix
CVE-2026-0682Church Admin WordPress plugin blind server-side request forgery2.2CNA v3.10.3%2026-01-17Fix
CVE-2026-0519Information disclosure in Secure Access Between and4.6CNA v4.00.1%2026-01-17Fix
CVE-2026-0518XSS in Secure Access Consoles4.8CNA v4.00.2%2026-01-17Fix
CVE-2026-0517Denial of service in Secure Access Servers6.0CNA v4.00.3%2026-01-17Fix
CVE-2026-23800Modular DS WordPress plugin privilege escalation10.0CNA v3.10.5%2026-01-16Fix
CVE-2026-23769NAVER lucy-xss-filter cross-site scripting6.1v3.10.2%2026-01-16Fix
CVE-2026-23768NAVER lucy-xss-filter server-side request forgery6.1CISA ADP v3.10.2%2026-01-16Fix
CVE-2026-23745node-tar vulnerable to arbitrary file overwrite and Symlink Poisoning8.2CNA v4.00.4%2026-01-16Exploit codeFix
CVE-2026-23744REC in MCPJam inspector due to HTTP endpoint exposes9.8CNA v3.167.5%2026-01-16Reported exploitedNucleiMetasploitExploit codeFix
CVE-2026-23742Skipper arbitrary code execution through lua filters8.8CNA v3.10.5%2026-01-16Fix
CVE-2026-23735Concurrent execution using shared resource with improper synchronization in graphql-modules8.7CNA v4.00.6%2026-01-16Fix
CVE-2026-23731LabRedesCefetRJ WeGIA clickjacking4.3CNA v3.10.3%2026-01-16Fix
CVE-2026-23730WeGIA has an open redirect vulnerability in control.php endpoint4.8CNA v4.00.2%2026-01-16Fix
CVE-2026-23729WeGIA has an open redirect vulnerability in control.php endpoint4.8CNA v4.00.2%2026-01-16Fix
CVE-2026-23728WeGIA has an open redirect vulnerability in control.php endpoint4.8CNA v4.00.2%2026-01-16Fix
CVE-2026-23727WeGIA has an open redirect vulnerability in control.php endpoint4.8CNA v4.00.2%2026-01-16Fix
CVE-2026-23726WeGIA has an open redirect vulnerability in control.php endpoint4.8CNA v4.00.2%2026-01-16Fix
CVE-2026-23725WeGIA stored cross-site scripting (XSS) nome parameter on Adopters Information page5.3CNA v4.00.2%2026-01-16Fix
CVE-2026-23724WeGIA stored cross-site scripting atendido_idatendido parameter on Occurrence Registration page4.3CNA v3.10.2%2026-01-16Fix
CVE-2026-23723WeGIA has a critical SQL injection in Atendido_ocorrenciaControle via id_memorando parameter7.2CNA v3.10.4%2026-01-16Exploit codeFix
CVE-2026-23722LabRedesCefetRJ WeGIA memorando dispatch page reflected cross-site scripting9.1CNA v3.10.2%2026-01-16Fix
CVE-2026-23645SiYuan vulnerable to stored cross-site scripting (XSS) via Unrestricted SVG file upload5.3CNA v4.00.3%2026-01-16Fix
CVE-2026-23643CakePHP PaginatorHelper::limitControl vulnerable to reflected cross-site-scripting5.4CNA v3.10.3%2026-01-16Fix
CVE-2026-23634Pepr Overly Permissive RBAC ClusterRole in Admin Mode0.0CNA v3.10.3%2026-01-16Fix
CVE-2026-23535wlc path traversal: Unsanitized API slugs in download command8.1CNA v3.10.4%2026-01-16Fix
CVE-2026-23529Aiven-Open bigquery-connector-for-apache-kafka arbitrary file read in Google BigQuery Sink connector7.7CNA v3.10.4%2026-01-16Fix
CVE-2026-23528Dask distributed vulnerable to remote code execution via Jupyter Proxy and Dashboard5.3CNA v4.00.2%2026-01-16Fix
CVE-2026-23523Dive allows One-click remote code execution through Deep Links for MCP Install9.7CNA v3.17.2%2026-01-16Fix
CVE-2026-23490pyasn1 has a DoS vulnerability in decoder7.5CNA v3.10.8%2026-01-16Fix
CVE-2026-22876TOA Multiple Network Cameras TRIFORA 3 series path traversal7.1CNA v4.00.5%2026-01-16
CVE-2026-22865Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts8.6CNA v4.00.2%2026-01-16Fix
CVE-2026-22816Gradle fails to disable repositories which can expose builds to malicious artifacts8.6CNA v4.00.2%2026-01-16Fix
CVE-2026-22782RustFS RPC signature verification logs shared secret2.9CNA v4.00.5%2026-01-16Fix
CVE-2026-21625Extension Stackideas.com Lack of mime type validation in EasyDiscuss component for Joomla8.8NVD v3.10.4%2026-01-16
CVE-2026-21624Extension Stackideas.com persistent XSS in EasyDiscuss component for Joomla5.4NVD v3.10.2%2026-01-16
CVE-2026-21623Extension Stackideas.com persistent XSS in EasyDiscuss component for Joomla5.4NVD v3.10.2%2026-01-16
CVE-2026-21223Microsoft Edge (Chromium-based) security feature bypass7.1CNA v3.10.3%2026-01-16Fix
CVE-2026-20960PowerApps Desktop Client remote code execution8.0CNA v3.10.5%2026-01-16Fix
CVE-2026-20894TOA Multiple Network Cameras TRIFORA 3 series cross-site scripting4.8CNA v4.00.2%2026-01-16
CVE-2026-20759TOA Multiple Network Cameras TRIFORA 3 series OS command injection8.7CNA v4.01.6%2026-01-16
CVE-2026-1023Gotac｜Statistics Database System missing authentication8.7CNA v4.00.5%2026-01-16Fix
CVE-2026-1022Gotac｜Statistics Database System arbitrary file read8.7CNA v4.00.7%2026-01-16Fix
CVE-2026-1011Stored cross-site scripting in Altium Live Support Center Comment endpoint6.1CNA v3.10.3%2026-01-16Fix
CVE-2026-1004Essential Addons for Elementor WordPress plugin information disclosure5.3CNA v3.10.4%2026-01-16Fix
CVE-2026-1003GetGenie WordPress plugin authorization bypass4.3CNA v3.10.2%2026-01-16Fix
CVE-2026-1000MailerLite - WooCommerce integration WordPress plugin missing authorization to data deletion6.5CNA v3.10.3%2026-01-16Fix
CVE-2026-0975DIAView command injection7.8CNA v3.11.5%2026-01-16Fix
CVE-2026-0949Adobe PEM stored cross-site scripting6.5CNA v3.10.2%2026-01-16Fix
CVE-2026-0942Rede Itaú for WooCommerce WordPress plugin unauthorized access5.3CNA v3.10.3%2026-01-16Fix
CVE-2026-0939linknacional Rede Itaú for WooCommerce payment callback verification vulnerability5.3CNA v3.10.2%2026-01-16Fix
CVE-2026-0916Related Posts by Taxonomy WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-16Fix
CVE-2026-0913User Submitted Posts WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-01-16Fix
CVE-2026-0858net.sourceforge.plantuml:plantuml cross-site scripting5.1CNA v4.00.3%2026-01-16Fix
CVE-2026-0696ConnectWise PSA Session Cookies Missing HttpOnly attribute6.5CNA v3.10.4%2026-01-16Fix
CVE-2026-0695ConnectWise PSA stored XSS in Time Entry Audit Trail8.7CNA v3.10.3%2026-01-16Fix
CVE-2026-0629Authentication bypass in Password Recovery feature via Local Web App on multiple VIGI Cameras8.7CNA v4.00.4%2026-01-16Fix
CVE-2026-0616The Librarian web_fetch tool information disclosure7.5CISA ADP v3.10.4%2026-01-16
CVE-2026-0615The Librarian web_fetch tool vulnerability7.3CISA ADP v3.10.3%2026-01-16
CVE-2026-0613The Librarian web_fetch tool server-side request forgery7.5CISA ADP v3.10.4%2026-01-16
CVE-2026-0612The Librarian web_fetch tool information disclosure7.5CISA ADP v3.10.4%2026-01-16
CVE-2026-23746Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE9.3CNA v4.01.2%2026-01-15Fix
CVE-2026-23622Alextselegidis/easyappointments is vulnerable to CSRF Protection Bypass7.4CNA v4.00.2%2026-01-15
CVE-2026-23527h3js H3 Transfer-Encoding header parsing HTTP request smuggling8.9CNA v3.10.6%2026-01-15Fix
CVE-2026-23520Arcane has a command injection in Arcane Updater Lifecycle Labels enables RCE9.1CNA v3.11.9%2026-01-15Exploit codeFix
CVE-2026-23519RustCrypto Cmov: Thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz8.9CNA v4.00.6%2026-01-15Fix
CVE-2026-23511ZITADEL has a user enumeration vulnerability in Login UIs5.3CNA v3.10.4%2026-01-15Fix
CVE-2026-23496Pimcore Web2Print Tools Bundle Favourite Output Channel Configuration improper access control5.4CNA v3.10.3%2026-01-15Fix
CVE-2026-23495Pimcore Admin Classic Bundle Predefined Properties listing improper access control4.3CNA v3.10.4%2026-01-15Fix
CVE-2026-23494Pimcore is Missing Function Level Authorization on Static Routes Listing4.3CNA v3.10.4%2026-01-15Fix
CVE-2026-23493Pimcore ENV variables and Cookie Informations are exposed in http_error_log8.6CNA v3.10.4%2026-01-15Fix
CVE-2026-22919SICK TDC-X401GL cross-site scripting3.8CNA v3.10.3%2026-01-15Fix
CVE-2026-22918SICK TDC-X401GL clickjacking4.3CNA v3.10.3%2026-01-15
CVE-2026-22917SICK TDC-X401GL resource exhaustion4.3CNA v3.10.6%2026-01-15Fix
CVE-2026-22916SICK TDC-X401GL incorrect privilege assignment4.3CNA v3.10.4%2026-01-15
CVE-2026-22915SICK TDC-X401GL system information disclosure4.3CNA v3.10.4%2026-01-15
CVE-2026-22914SICK TDC-X401GL incorrect privilege assignment4.3CNA v3.10.3%2026-01-15
CVE-2026-22913SICK TDC-X401GL cross-site scripting4.3CNA v3.10.4%2026-01-15Fix
CVE-2026-22912SICK TDC-X401GL open redirect4.3CNA v3.10.4%2026-01-15Fix
CVE-2026-22911SICK TDC-X401GL hard-coded credentials5.3CNA v3.10.5%2026-01-15
CVE-2026-22910SICK TDC-X401GL weak credentials7.5CNA v3.10.5%2026-01-15
CVE-2026-22909SICK TDC-X401GL improper access control7.5CNA v3.10.6%2026-01-15
CVE-2026-22908SICK TDC-X401GL incorrect privilege assignment9.1CNA v3.10.6%2026-01-15Fix
CVE-2026-22907SICK TDC-X401GL incorrect privilege assignment9.9CNA v3.10.4%2026-01-15Fix
CVE-2026-22867LaSuite Doc affected by stored XSS via Interlinking block8.7CNA v3.10.3%2026-01-15Fix
CVE-2026-22864Deno Windows batch file spawning command injection8.1CNA v3.10.7%2026-01-15Fix
CVE-2026-22863Deno node:crypto doesn't finalize cipher9.2CNA v4.00.2%2026-01-15Fix
CVE-2026-22803sveltejs kit SvelteKit has a memory amplification DoS in Remote functions binary form deserializer8.2CNA v4.00.6%2026-01-15Fix
CVE-2026-22775devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse7.5CNA v3.10.6%2026-01-15Fix
CVE-2026-22774devalue vulnerable to denial of service due to memory exhaustion in devalue.parse7.5CNA v3.10.6%2026-01-15Fix
CVE-2026-22646SICK Incoming Goods Suite information disclosure through error messages4.3CNA v3.10.4%2026-01-15Fix
CVE-2026-22645SICK Incoming Goods Suite information disclosure5.3CNA v3.10.5%2026-01-15Fix
CVE-2026-22644SICK Incoming Goods Suite sensitive query strings5.3CNA v3.10.5%2026-01-15
CVE-2026-22265Roxy-WI has a command injection via grep parameter in logs.py allows authenticated RCE7.5CNA v3.12.3%2026-01-15Fix
CVE-2026-22249Docmost affected by an arbitrary file write via Zip Import Feature (ZipSlip)7.1CNA v3.10.6%2026-01-15Fix
CVE-2026-22045Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall5.9CNA v3.10.3%2026-01-15Fix
CVE-2026-21921Juniper Networks Junos OS chassis daemon use-after-free7.1CNA v4.00.4%2026-01-15Fix
CVE-2026-21920Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash8.7CNA v4.00.5%2026-01-15Fix
CVE-2026-21918Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes8.7CNA v4.00.4%2026-01-15Fix
CVE-2026-21917Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crash8.7CNA v4.00.4%2026-01-15Fix
CVE-2026-21914Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash8.7CNA v4.00.3%2026-01-15Fix
CVE-2026-21913Junos OS: EX4000: A high volume of traffic destined to the device leads to a crash and restart8.7CNA v4.00.4%2026-01-15Fix
CVE-2026-21912Junos OS: MX10k Series: Show system firmware CLI command may lead to LC480 or LC2101 line card reset6.8CNA v4.00.1%2026-01-15Fix
CVE-2026-21911Juniper Networks Junos OS Evolved Layer incorrect calculation7.1CNA v4.00.2%2026-01-15Fix
CVE-2026-21910Juniper Networks Junos OS packet forwarding engine improper check for exceptional conditions7.1CNA v4.00.3%2026-01-15Fix
CVE-2026-21909Juniper Networks Junos OS routing protocol daemon memory leak7.1CNA v4.00.3%2026-01-15Fix
CVE-2026-21908Juniper Networks Junos OS 802.1X authentication daemon use-after-free7.5CNA v4.00.3%2026-01-15Fix
CVE-2026-21907Junos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)8.2CNA v4.00.2%2026-01-15Fix
CVE-2026-21906Juniper Networks Junos OS packet forwarding engine improper exception handling8.7CNA v4.00.6%2026-01-15Fix
CVE-2026-21905Juniper Networks Junos OS SIP application layer gateway infinite loop8.7CNA v4.00.4%2026-01-15Fix
CVE-2026-21903Junos OS: Subscribing to telemetry sensors at scale causes all FPCs to crash7.1CNA v4.00.4%2026-01-15Fix
CVE-2026-20076Cisco Identity Services Engine stored cross-site scripting4.8CNA v3.10.3%2026-01-15Fix
CVE-2026-20075Cisco Evolved Programmable Network Manager and Prime Infrastructure stored cross-site scripting4.8CNA v3.10.3%2026-01-15Fix
CVE-2026-20047Cisco Identity Services Engine cross-site scripting4.8CNA v3.10.3%2026-01-15Fix
CVE-2026-1010Stored cross-site scripting in Altium Enterprise Server Workflow Engine allows privilege escalation8.0CNA v3.10.3%2026-01-15Fix
CVE-2026-1009Altium Live stored cross-site scripting9.0CNA v3.10.2%2026-01-15Fix
CVE-2026-1008Stored cross-site scripting in Altium Live User Profile fields7.6CNA v3.10.2%2026-01-15Fix
CVE-2026-1002Eclipse Vert.x Web static handler file access denial6.9CNA v4.00.4%2026-01-15Fix
CVE-2026-0992Libxml2: Libxml2: Denial of service via crafted XML catalogs2.9CNA v3.10.5%2026-01-15Fix
CVE-2026-0990Libxml2: Libxml2: Denial of service via uncontrolled recursion in XML catalog processing5.9CNA v3.11.0%2026-01-15Fix
CVE-2026-0989Libxml2: Unbounded relaxng include recursion leading to stack overflow3.7CNA v3.10.5%2026-01-15Fix
CVE-2026-0976Keycloak has an improper input validation3.7CNA v3.10.5%2026-01-15Fix
CVE-2026-0915The GNU C Library glibc getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler7.5CISA ADP v3.10.6%2026-01-15Exploit codeFix
CVE-2026-0897Google denial of service in Keras via excessive memory allocation in HDF5 Metadata7.1CNA v4.00.3%2026-01-15Exploit codeFix
CVE-2026-0227PAN-OS: Firewall denial of service (DoS) in GlobalProtect Gateway and portal6.6CNA v4.00.7%2026-01-15Fix
CVE-2026-0203Junos OS: Receipt of a specifically malformed ICMP packet causes an FPC restart7.1CNA v4.00.3%2026-01-15Fix
CVE-2026-23550Modular DS WordPress plugin privilege escalation10.0CNA v3.121.4%2026-01-14NucleiExploit codeFix
CVE-2026-23512SumatraPDF has an untrusted search path in sumatrapdf/src/AppTools.cpp8.6CNA v3.10.2%2026-01-14
CVE-2026-23498Shopware improper control of generation of code in Twig rendered views7.2CNA v3.10.4%2026-01-14Exploit codeFix
CVE-2026-23497Frappe LMS has a stored XSS via Unsanitized Image Filename in Course and Jobs pages1.3CNA v4.00.2%2026-01-14
CVE-2026-23492Pimcore has a blind SQL injection in Admin Search Find API due to an incomplete fix for8.8CNA v3.10.5%2026-01-14Fix
CVE-2026-23477Rocket.Chat unauthorized access to OAuth App Details7.7CNA v3.10.3%2026-01-14Fix
CVE-2026-22859FreeRDP URBDRC client out-of-bounds read5.6CNA v4.00.9%2026-01-14Fix
CVE-2026-22858FreeRDP has a global-buffer-overflow in crypto_base64_decode5.6CNA v4.00.7%2026-01-14Fix
CVE-2026-22857FreeRDP has a heap-use-after-free in irp_thread_func6.8CNA v4.00.5%2026-01-14Fix
CVE-2026-22856FreeRDP has a heap-use-after-free in create_irp_thread6.8CNA v4.00.3%2026-01-14Fix
CVE-2026-22855FreeRDP smart card attribute unpacking out-of-bounds read5.6CNA v4.00.9%2026-01-14Fix
CVE-2026-22854FreeRDP drive redirection read handling out-of-bounds write6.8CNA v4.00.5%2026-01-14Fix
CVE-2026-22853FreeRDP RDPEAR NDR array reader out-of-bounds write6.8CNA v4.00.8%2026-01-14Fix
CVE-2026-22852FreeRDP audio input format processing out-of-bounds write6.8CNA v4.00.4%2026-01-14Fix
CVE-2026-22851FreeRDP RDPGFX ResetGraphics handling use-after-free6.9CNA v4.00.3%2026-01-14Fix
CVE-2026-22820Outray cli is vulnerable to race conditions in tunnels creation6.3CNA v4.00.2%2026-01-14Fix
CVE-2026-22819Outray has a race condition in main/apps/web/src/routes/API/$orgSlug/subdomains/index.ts5.9CNA v3.10.2%2026-01-14Fix
CVE-2026-22787html2pdf.js has a cross-site scripting8.7CNA v4.00.4%2026-01-14Fix
CVE-2026-22779BlackSheep ClientSession is vulnerable to CRLF injection6.3CNA v4.00.4%2026-01-14Fix
CVE-2026-22718Spring CLI VSCode Extension command injection6.8CNA v3.10.6%2026-01-14
CVE-2026-22708Cursor has a Terminal Tool Allowlist Bypass via Environment variables7.2CNA v4.00.8%2026-01-14Fix
CVE-2026-22694AliasVault is Missing Origin Validation in Android Passkey Credential Provider6.1CNA v3.10.1%2026-01-14Fix
CVE-2026-22686agentfront enclave sandbox escape via Host Error Prototype Chain in enclave-vm10.0CNA v3.10.8%2026-01-14Exploit codeFix
CVE-2026-22240Bluspark Global BLUVOYIX users API information disclosure7.5NVD v3.13.4%2026-01-14
CVE-2026-22239Bluspark Global BLUVOYIX email sending API vulnerability5.3NVD v3.10.3%2026-01-14
CVE-2026-22238Administrator Account Creation vulnerability in BLUVOYIX9.8v3.10.7%2026-01-14
CVE-2026-22237Exposed Internal API Documentation vulnerability in BLUVOYIX9.8v3.10.5%2026-01-14
CVE-2026-22236Improper authentication vulnerability in BLUVOYIX9.8v3.10.5%2026-01-14
CVE-2026-22211TinyOS global buffer overflow in printfUART5.1CNA v4.00.2%2026-01-14
CVE-2026-22036Node.js undici HTTP response decompression resource exhaustion5.9CNA v3.10.5%2026-01-14Fix
CVE-2026-21889Weblate leaks information via screenshots2.3CNA v4.00.4%2026-01-14Fix
CVE-2026-0962Out-of-bounds write in Wireshark5.3CNA v3.10.2%2026-01-14Fix
CVE-2026-0961Out-of-bounds write in Wireshark5.5CNA v3.10.2%2026-01-14Fix
CVE-2026-0960Loop with unreachable exit condition (infinite loop) in Wireshark4.7CNA v3.10.1%2026-01-14Fix
CVE-2026-0959Out-of-bounds write in Wireshark5.3CNA v3.10.2%2026-01-14Fix
CVE-2026-0861The GNU C Library glibc integer overflow in memalign leads to heap corruption8.4CISA ADP v3.10.4%2026-01-14Fix
CVE-2026-0813Short Link WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2026-0812LinkedIn SC WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2026-0741Electric Studio Download Counter WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2026-0739WMF Mobile Redirector WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-01-14
CVE-2026-0734WP Allowed Hosts WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2026-0717LottieFiles WordPress plugin information disclosure5.3CNA v3.10.9%2026-01-14NucleiFix
CVE-2026-0694SearchWiz WordPress plugin authenticated (Contributor+) stored cross-site scripting via post Title6.4CNA v3.10.3%2026-01-14
CVE-2026-0680Real Post Slider Lite WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-01-14
CVE-2026-0678Shipping Rates by City for WooCommerce WordPress plugin SQL injection4.9CNA v3.10.3%2026-01-14
CVE-2026-0635Responsive Accordion Slider WordPress plugin missing authorization authenticated Slider update4.3CNA v3.10.3%2026-01-14
CVE-2026-0601Nexus Repository 3 cross-site scripting5.1CNA v4.00.4%2026-01-14Fix
CVE-2026-0600Nexus Repository 3 server-side request forgery in Proxy Repository Configuration6.2CNA v4.00.3%2026-01-14Fix
CVE-2026-0594List Site Contributors WordPress plugin reflected cross-site scripting via alpha6.1CNA v3.10.8%2026-01-14NucleiExploit code
CVE-2026-0532Elastic Kibana Google Gemini connector server-side request forgery8.6CNA v3.10.5%2026-01-14Fix
CVE-2026-0529Improper validation of array index in Packetbeat leading to Overflow Buffers6.5CNA v3.10.2%2026-01-14
CVE-2026-0421Lenovo ThinkPad L13 Gen 6 BIOS unchecked return value7.0CNA v4.00.2%2026-01-14Fix
CVE-2026-23478Cal.com has an authentication bypass via Unvalidated Email in Custom JWT Callback10.0CNA v4.00.5%2026-01-13Fix
CVE-2026-22871GuardDog path traversal vulnerability leads to arbitrary file overwrite and RCE8.7CNA v4.01.1%2026-01-13Fix
CVE-2026-22870GuardDog zip bomb vulnerability in safe_extract allows DoS7.1CNA v4.00.5%2026-01-13Fix
CVE-2026-22869Eigent allows arbitrary code execution via pull_request_target CI Workflow8.9CNA v4.00.6%2026-01-13Exploit code
CVE-2026-22868go-ethereum has a DoS via malicious p2p message7.1CNA v4.00.6%2026-01-13Fix
CVE-2026-22862go-ethereum has a DoS via malicious p2p message7.1CNA v4.00.7%2026-01-13Exploit codeFix
CVE-2026-22861iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe at IccProfLib/IccMpeCalc.cpp8.8CNA v3.10.7%2026-01-13Fix
CVE-2026-22818JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks alg8.2CNA v3.10.1%2026-01-13Fix
CVE-2026-22817Hono JWT middleware improper signature verification8.2CNA v3.10.2%2026-01-13Fix
CVE-2026-22814Mass assignment in AdonisJS Lucid allows Overwriting Internal ORM State8.2CNA v4.00.5%2026-01-13Fix
CVE-2026-22809tarteaucitron.js has regular expression denial of service (ReDoS)4.4CNA v3.10.1%2026-01-13Fix
CVE-2026-22791openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP6.6CNA v3.10.3%2026-01-13Fix
CVE-2026-22755Legacy Vivotek Camera firmware command injection in upload_map.cgi9.3CNA v4.020.2%2026-01-13Fix
CVE-2026-21308Substance3D Designer out-of-bounds read5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21307Substance3D Designer out-of-bounds write7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21306Substance3D Sampler out-of-bounds write7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21305Adobe Substance3D Painter out-of-bounds write7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21304Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-21303Adobe Substance3D Modeler out-of-bounds read5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21302Adobe Substance3D Modeler out-of-bounds read5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21301Adobe Substance3D Modeler null pointer dereference5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21300Adobe Substance3D Modeler null pointer dereference5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21299Adobe Substance3D Modeler out-of-bounds write7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21298Adobe Substance3D Modeler out-of-bounds write7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21288Adobe Illustrator null pointer dereference5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21287Adobe Substance3D Stager use-after-free7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21283Adobe Bridge heap-based buffer overflow7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-21281Adobe InCopy heap-based buffer overflow7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21280Adobe Illustrator untrusted search path8.6CNA v3.10.3%2026-01-13Fix
CVE-2026-21278Adobe InDesign Desktop out-of-bounds read5.5CNA v3.10.2%2026-01-13Fix
CVE-2026-21277Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-21276Adobe InDesign Desktop access of uninitialized pointer7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21275Adobe InDesign Desktop access of uninitialized pointer7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21274Dreamweaver Desktop incorrect authorization7.8CNA v3.10.2%2026-01-13Fix
CVE-2026-21272Dreamweaver Desktop improper input validation8.6CNA v3.10.2%2026-01-13Fix
CVE-2026-21271Dreamweaver Desktop improper input validation8.6CNA v3.10.2%2026-01-13Fix
CVE-2026-21268Dreamweaver Desktop improper input validation8.6CNA v3.10.2%2026-01-13Fix
CVE-2026-21267Dreamweaver Desktop improper neutralization of special elements used in an OS command8.6CNA v3.10.8%2026-01-13Fix
CVE-2026-21265Microsoft Windows secure Boot Certificate Expiration security feature bypass6.4CNA v3.11.1%2026-01-13Fix
CVE-2026-21226Microsoft Azure Core Shared Client Library for Python remote code execution7.5CNA v3.10.9%2026-01-13Fix
CVE-2026-21224Microsoft Azure Connected Machine Agent elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-21221Microsoft Windows capability Access Management service (camsvc) elevation of privilege7.0CNA v3.10.2%2026-01-13Fix
CVE-2026-21219Microsoft Windows SDK inbox COM Objects (Global Memory) remote code execution7.0CNA v3.10.4%2026-01-13Fix
CVE-2026-20965Microsoft Windows Admin Center elevation of privilege7.5CNA v3.10.2%2026-01-13Fix
CVE-2026-20963Microsoft SharePoint deserialization of untrusted data9.8CNA v3.129.6%2026-01-13KEVFix
CVE-2026-20962Microsoft Windows Dynamic Root of Trust for Measurement (DRTM) information disclosure4.4CNA v3.10.4%2026-01-13Fix
CVE-2026-20959Microsoft SharePoint server spoofing4.6CNA v3.17.6%2026-01-13Fix
CVE-2026-20958Microsoft SharePoint information disclosure5.4CNA v3.10.3%2026-01-13Fix
CVE-2026-20957Microsoft Excel remote code execution7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20956Microsoft Excel remote code execution7.8CNA v3.10.4%2026-01-13Fix
CVE-2026-20955Microsoft Excel remote code execution7.8CNA v3.10.6%2026-01-13Fix
CVE-2026-20953Microsoft Office remote code execution8.4CNA v3.10.6%2026-01-13Fix
CVE-2026-20952Microsoft Office remote code execution8.4CNA v3.10.5%2026-01-13Fix
CVE-2026-20951Microsoft SharePoint server remote code execution7.8CNA v3.10.8%2026-01-13Fix
CVE-2026-20950Microsoft Excel remote code execution7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20949Microsoft Excel security feature bypass7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20948Microsoft Word remote code execution7.8CNA v3.10.6%2026-01-13Fix
CVE-2026-20947Microsoft SharePoint server remote code execution8.8CNA v3.118.8%2026-01-13Fix
CVE-2026-20946Microsoft Excel remote code execution7.8CNA v3.10.7%2026-01-13Fix
CVE-2026-20944Microsoft Word remote code execution8.4CNA v3.10.5%2026-01-13Fix
CVE-2026-20943Microsoft Office Click-To-Run remote code execution7.0CNA v3.10.7%2026-01-13Fix
CVE-2026-20941Microsoft Host Process for Windows Tasks elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20940Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20939Microsoft Windows File Explorer information disclosure5.5CNA v3.10.5%2026-01-13Fix
CVE-2026-20938Microsoft Windows Virtualization-Based Security (VBS) Enclave elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20937Microsoft Windows File Explorer information disclosure5.5CNA v3.10.5%2026-01-13Fix
CVE-2026-20936Microsoft Windows NDIS information disclosure4.3CNA v3.10.5%2026-01-13Fix
CVE-2026-20935Microsoft Windows Virtualization-Based Security (VBS) information disclosure6.2CNA v3.10.4%2026-01-13Fix
CVE-2026-20934Microsoft Windows SMB server elevation of privilege7.5CNA v3.10.8%2026-01-13Fix
CVE-2026-20932Microsoft Windows File Explorer information disclosure5.5CNA v3.10.7%2026-01-13Fix
CVE-2026-20931Microsoft Windows Telephony service elevation of privilege8.0CNA v3.10.9%2026-01-13Reported exploitedFix
CVE-2026-20929Microsoft Windows HTTP.sys elevation of privilege7.5CNA v3.12.9%2026-01-13MetasploitFix
CVE-2026-20927Microsoft Windows SMB server denial of service5.3CNA v3.10.9%2026-01-13Fix
CVE-2026-20926Microsoft Windows SMB server elevation of privilege7.5CNA v3.10.8%2026-01-13Fix
CVE-2026-20925Microsoft Windows NTLM hash disclosure spoofing6.5CNA v3.118.2%2026-01-13Fix
CVE-2026-20924Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20923Microsoft Windows Management services elevation of privilege7.8CNA v3.10.4%2026-01-13Fix
CVE-2026-20922Microsoft Windows NTFS remote code execution7.8CNA v3.11.1%2026-01-13Fix
CVE-2026-20921Microsoft Windows SMB server elevation of privilege7.5CNA v3.11.2%2026-01-13Fix
CVE-2026-20920Microsoft Windows win32k elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20919Microsoft Windows SMB server elevation of privilege7.5CNA v3.10.8%2026-01-13Fix
CVE-2026-20918Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20877Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20876Microsoft Windows Virtualization-Based Security (VBS) Enclave elevation of privilege6.7CNA v3.10.5%2026-01-13Fix
CVE-2026-20875Microsoft Windows Local Security Authority subsystem Service (LSASS) denial of service7.5CNA v3.11.6%2026-01-13Fix
CVE-2026-20874Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20873Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20872Microsoft Windows NTLM hash disclosure spoofing6.5CNA v3.120.1%2026-01-13Fix
CVE-2026-20871Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.14.2%2026-01-13Fix
CVE-2026-20870Microsoft Windows Win32 Kernel subsystem elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20869Microsoft Windows Local Session Manager (LSM) elevation of privilege7.0CNA v3.10.3%2026-01-13Fix
CVE-2026-20868Microsoft Windows Routing and Remote Access Service (RRAS) remote code execution8.8CNA v3.11.4%2026-01-13Fix
CVE-2026-20867Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20866Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20865Microsoft Windows Management services elevation of privilege7.8CNA v3.10.4%2026-01-13Fix
CVE-2026-20864Microsoft Windows Connected Devices Platform service elevation of privilege7.8CNA v3.10.6%2026-01-13Fix
CVE-2026-20863Microsoft Windows win32k elevation of privilege7.0CNA v3.10.4%2026-01-13Fix
CVE-2026-20862Microsoft Windows Management services information disclosure5.5CNA v3.10.6%2026-01-13Fix
CVE-2026-20861Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20860Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.18.4%2026-01-13Fix
CVE-2026-20859Microsoft Windows Kernel-Mode driver elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20858Microsoft Windows Management services elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20857Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20856Microsoft Windows Server Update Service (WSUS) remote code execution8.1CNA v3.11.1%2026-01-13Fix
CVE-2026-20854Microsoft Windows Local Security Authority subsystem Service (LSASS) remote code execution7.5CNA v3.11.1%2026-01-13Fix
CVE-2026-20853Microsoft Windows WalletService elevation of privilege7.4CNA v3.10.3%2026-01-13Fix
CVE-2026-20852Microsoft Windows Hello tampering7.7CNA v3.10.5%2026-01-13Fix
CVE-2026-20851Microsoft Windows capability Access Management service (camsvc) information disclosure6.2CNA v3.10.6%2026-01-13Fix
CVE-2026-20849Microsoft Windows Kerberos elevation of privilege7.5CNA v3.11.0%2026-01-13Fix
CVE-2026-20848Microsoft Windows SMB server elevation of privilege7.5CNA v3.10.8%2026-01-13Fix
CVE-2026-20847Microsoft Windows File Explorer spoofing6.5CNA v3.11.4%2026-01-13Fix
CVE-2026-20844Microsoft Windows Clipboard Server elevation of privilege7.4CNA v3.10.3%2026-01-13Fix
CVE-2026-20843Microsoft Windows Routing and Remote Access Service (RRAS) elevation of privilege7.8CNA v3.13.5%2026-01-13Fix
CVE-2026-20842Microsoft DWM Core library elevation of privilege7.0CNA v3.10.4%2026-01-13Fix
CVE-2026-20840Microsoft Windows NTFS remote code execution7.8CNA v3.14.7%2026-01-13Fix
CVE-2026-20839Microsoft Windows Client-Side Caching (CSC) service information disclosure5.5CNA v3.10.5%2026-01-13Fix
CVE-2026-20838Microsoft Windows Kernel information disclosure5.5CNA v3.10.7%2026-01-13Fix
CVE-2026-20837Microsoft Windows Media remote code execution7.8CNA v3.10.7%2026-01-13Fix
CVE-2026-20836Microsoft Windows DirectX Graphics Kernel elevation of privilege7.0CNA v3.10.3%2026-01-13Fix
CVE-2026-20835Microsoft Windows capability Access Management service (camsvc) information disclosure5.5CNA v3.10.6%2026-01-13Fix
CVE-2026-20834Microsoft Windows spoofing4.6CNA v3.10.8%2026-01-13Fix
CVE-2026-20833Microsoft Windows Kerberos information disclosure5.5CNA v3.10.5%2026-01-13Exploit codeFix
CVE-2026-20832Microsoft Windows Remote Procedure Call Interface Definition Language (IDL) elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20831Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20830Microsoft Windows capability Access Management service (camsvc) elevation of privilege7.0CNA v3.10.3%2026-01-13Fix
CVE-2026-20829Microsoft Windows TPM Trustlet information disclosure5.5CNA v3.10.6%2026-01-13Fix
CVE-2026-20828Microsoft Windows rndismp6.sys information disclosure4.6CNA v3.10.7%2026-01-13Fix
CVE-2026-20827Microsoft Tablet Windows User Interface (TWINUI) subsystem information disclosure5.5CNA v3.10.7%2026-01-13Fix
CVE-2026-20826Microsoft Tablet Windows User Interface (TWINUI) subsystem information disclosure7.8CNA v3.10.3%2026-01-13Fix
CVE-2026-20825Microsoft Windows Hyper-V information disclosure4.4CNA v3.10.5%2026-01-13Fix
CVE-2026-20824Microsoft Windows Remote Assistance security feature bypass5.5CNA v3.10.9%2026-01-13Fix
CVE-2026-20823Microsoft Windows File Explorer information disclosure5.5CNA v3.10.7%2026-01-13Fix
CVE-2026-20822Microsoft Windows Graphics component elevation of privilege7.8CNA v3.10.4%2026-01-13Fix
CVE-2026-20821Microsoft Windows Remote Procedure Call information disclosure6.2CNA v3.10.7%2026-01-13Fix
CVE-2026-20820Microsoft Windows Common Log File System driver elevation of privilege7.8CNA v3.12.6%2026-01-13Fix
CVE-2026-20819Microsoft Windows Virtualization-Based Security (VBS) information disclosure5.5CNA v3.10.6%2026-01-13Fix
CVE-2026-20818Microsoft Windows Kernel information disclosure6.2CNA v3.10.7%2026-01-13Fix
CVE-2026-20817Microsoft Windows Error Reporting service elevation of privilege7.8CNA v3.15.5%2026-01-13Exploit codeFix
CVE-2026-20816Microsoft Windows Installer elevation of privilege7.8CNA v3.12.5%2026-01-13Fix
CVE-2026-20815Microsoft Windows capability Access Management service (camsvc) elevation of privilege7.0CNA v3.10.3%2026-01-13Fix
CVE-2026-20814Microsoft Windows DirectX Graphics Kernel elevation of privilege7.0CNA v3.10.3%2026-01-13Fix
CVE-2026-20812Microsoft Windows LDAP tampering6.5CNA v3.11.1%2026-01-13Fix
CVE-2026-20811Microsoft Windows win32k elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20810Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.10.5%2026-01-13Fix
CVE-2026-20809Microsoft Windows Kernel Memory elevation of privilege7.8CNA v3.10.4%2026-01-13Fix
CVE-2026-20808Microsoft Windows File Explorer elevation of privilege7.0CNA v3.10.3%2026-01-13Fix
CVE-2026-20805Microsoft Windows information disclosure5.5CNA v3.17.5%2026-01-13KEVExploit codeFix
CVE-2026-20804Microsoft Windows Hello tampering7.7CNA v3.10.5%2026-01-13Fix
CVE-2026-20803Microsoft SQL Server elevation of privilege7.2CNA v3.11.3%2026-01-13Fix
CVE-2026-0892Mozilla memory safety bugs fixed in Firefox 147 and Thunderbird 1479.8CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0891Mozilla memory safety bugs fixed in Firefox ESR, Thunderbird ESR, Firefox 147 and Thunderbird 1478.1CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0890Mozilla Firefox spoofing issue in the DOM: Copy and Paste and Drag and Drop component5.4CISA ADP v3.10.3%2026-01-13Fix
CVE-2026-0889Mozilla Firefox denial of service in the DOM: Service Workers component7.5CISA ADP v3.10.6%2026-01-13Fix
CVE-2026-0888Mozilla Firefox information disclosure in the XML component5.3CISA ADP v3.10.4%2026-01-13Fix
CVE-2026-0887Mozilla Firefox clickjacking issue, information disclosure in the PDF Viewer component4.3CISA ADP v3.10.3%2026-01-13Fix
CVE-2026-0886Mozilla Firefox incorrect boundary conditions in the Graphics component5.3CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0885Mozilla Firefox use-after-free in the JavaScript: GC component6.5CISA ADP v3.10.4%2026-01-13Fix
CVE-2026-0884Mozilla Firefox use-after-free in the JavaScript Engine component9.8CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0883Mozilla Firefox information disclosure in the Networking component5.3CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0882Mozilla Firefox use-after-free in the IPC component8.8CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0881Mozilla Firefox sandbox escape in the Messaging System component10.0CISA ADP v3.10.4%2026-01-13Fix
CVE-2026-0880Mozilla Firefox sandbox escape due to integer overflow in the Graphics component8.8CISA ADP v3.10.7%2026-01-13Fix
CVE-2026-0879Mozilla Firefox sandbox escape due to incorrect boundary conditions in the Graphics component9.8CISA ADP v3.10.6%2026-01-13Fix
CVE-2026-0878Mozilla Firefox and Thunderbird CanvasWebGL sandbox escape8.0CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0877Mozilla Firefox mitigation bypass in the DOM: Security component8.1CISA ADP v3.10.5%2026-01-13Fix
CVE-2026-0859TYPO3 CMS allows insecure deserialization via Mailer File Spool5.2CNA v4.00.2%2026-01-13Fix
CVE-2026-0716Red Hat Enterprise Linux 10 libsoup: Out-of-bounds read in libsoup websocket frame processing4.8CNA v3.10.4%2026-01-13Fix
CVE-2026-0684CP Image Store with Slideshow WordPress plugin authorization bypass4.3CNA v3.10.3%2026-01-13Fix
CVE-2026-0543Improper input validation in Kibana Email Connector leading to Excessive Allocation6.5CNA v3.10.4%2026-01-13Fix
CVE-2026-0531Allocation of resources without limits or throttling in Kibana Fleet6.5CNA v3.10.5%2026-01-13Fix
CVE-2026-0530Allocation of resources without limits or throttling in Kibana leading to Excessive Allocation6.5CNA v3.10.3%2026-01-13Fix
CVE-2026-0528Improper input validation in Metricbeat leading to denial of service6.5CNA v3.10.4%2026-01-13Fix
CVE-2026-0514Cross-site scripting (XSS) vulnerability in SAP Business Connector6.1CNA v3.10.2%2026-01-13Fix
CVE-2026-0513Open redirect vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)4.7CNA v3.10.2%2026-01-13Fix
CVE-2026-0511Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)8.1CNA v3.10.3%2026-01-13Fix
CVE-2026-0510Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping3.0CNA v3.10.1%2026-01-13Fix
CVE-2026-0507OS command injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK8.4CNA v3.10.9%2026-01-13Fix
CVE-2026-0506Missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform8.1CNA v3.10.3%2026-01-13Fix
CVE-2026-0504Insufficient Input Handling in JNDI Operations of SAP Identity Management3.8CNA v3.10.2%2026-01-13Fix
CVE-2026-0503Missing authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)6.4CNA v3.10.2%2026-01-13Fix
CVE-2026-0501SQL injection vulnerability in SAP S/4HANA Private Cloud and On-Premise9.9CNA v3.10.5%2026-01-13Fix
CVE-2026-0500Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)9.6CNA v3.10.4%2026-01-13Fix
CVE-2026-0499Cross-site scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal6.1CNA v3.10.2%2026-01-13Fix
CVE-2026-0498Code injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)9.1CNA v3.10.5%2026-01-13Fix
CVE-2026-0497Missing authorization check in Business Server Pages Application (Product Designer Web UI)4.3CNA v3.10.2%2026-01-13Fix
CVE-2026-0496Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)6.6CNA v3.10.2%2026-01-13Fix
CVE-2026-0495Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)5.1CNA v3.10.2%2026-01-13Fix
CVE-2026-0494Information disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)4.3CNA v3.10.2%2026-01-13Fix
CVE-2026-0493Cross-site request forgery vulnerability in SAP Fiori App4.3CNA v3.10.1%2026-01-13Fix
CVE-2026-0492Privilege escalation vulnerability in SAP HANA database8.8CNA v3.10.3%2026-01-13Fix
CVE-2026-0491Code injection vulnerability in SAP Landscape Transformation9.1CNA v3.10.5%2026-01-13Fix
CVE-2026-0408Path traversal vulnerability in Netgear WiFi Range Extenders6.1CNA v4.00.3%2026-01-13Fix
CVE-2026-0407Authentication bypass in NETGEAR WiFi Range Extenders via network adjacent attacks6.1CNA v4.00.3%2026-01-13Fix
CVE-2026-0406Insufficient input validation in NETGEAR Nighthawk router XR1000v26.1CNA v4.00.2%2026-01-13Fix
CVE-2026-0405Authentication bypass in NETGEAR Orbi Devices6.1CNA v4.00.4%2026-01-13Fix
CVE-2026-0404Insufficient input validation in NETGEAR Orbi routers4.8CNA v4.01.2%2026-01-13Fix
CVE-2026-0403Insufficient input validation in NETGEAR Orbi routers1.1CNA v4.00.3%2026-01-13Fix
CVE-2026-0386Microsoft Windows Deployment services remote code execution7.5CNA v3.10.6%2026-01-13Fix
CVE-2026-22813Malicious website can execute commands on the local system through XSS in the OpenCode web UI9.4CNA v4.00.9%2026-01-12Fix
CVE-2026-22812OpenCode's Unauthenticated HTTP Server allows arbitrary command execution8.8CNA v3.116.5%2026-01-12NucleiExploit codeFix
CVE-2026-22805Metabase channel test endpoint can reach internal local addresses2.1CNA v4.00.2%2026-01-12Fix
CVE-2026-22804Termix file manager stored cross-site scripting8.0CNA v3.10.2%2026-01-12Exploit codeFix
CVE-2026-22801LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*6.8CNA v3.10.1%2026-01-12Fix
CVE-2026-22800PILOS affected by a CSRF2.4CNA v3.10.1%2026-01-12Fix
CVE-2026-22799emlog arbitrary file upload9.3CNA v4.00.7%2026-01-12
CVE-2026-22798Hermes's raw options logging may disclose secrets passed in via subcommand options argument5.9CNA v3.10.2%2026-01-12Fix
CVE-2026-22794Account takeover vulnerability in Appsmith9.7CNA v3.10.4%2026-01-12Exploit codeFix
CVE-2026-22789WebErpMesv2 has a file upload Validation Bypass leading to RCE5.4CNA v3.10.3%2026-01-12Fix
CVE-2026-22788WebErpMesv2 allows unauthenticated API Access8.2CNA v3.10.6%2026-01-12Fix
CVE-2026-22786Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal7.3CNA v4.01.1%2026-01-12
CVE-2026-22785Orval MCP client is vulnerable to a code injection attack9.3CNA v4.00.8%2026-01-12Exploit codeFix
CVE-2026-22784Lychee cross-album password propagation on Album unlocking2.3CNA v4.00.3%2026-01-12Fix
CVE-2026-22783Iris allows arbitrary file deletion via mass assignment in Datastore File Management9.6CNA v3.10.3%2026-01-12Fix
CVE-2026-22781TinyWeb CGI command injection10.0CNA v4.02.5%2026-01-12Fix
CVE-2026-22776cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb8.7CNA v4.00.4%2026-01-12Fix
CVE-2026-22772Fulcio vulnerable to server-side request forgery (SSRF) via MetaIssuer Regex Bypass5.8CNA v3.10.2%2026-01-12Fix
CVE-2026-22771envoyproxy gateway envoy Extension Policy lua scripts injection causes arbitrary command execution8.8CNA v3.10.6%2026-01-12Fix
CVE-2026-22695LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from fix)6.1CNA v3.10.2%2026-01-12Fix
CVE-2026-22252LibreChat MCP Stdio remote command execution9.1CNA v3.14.1%2026-01-12
CVE-2026-22251wlc may leak API keys due to an insecure API key configuration5.3CNA v3.10.2%2026-01-12Fix
CVE-2026-22250wlc can skip SSL verification2.5CNA v3.10.2%2026-01-12Fix
CVE-2026-22214RIOT OS stack-based buffer overflow in ethos Serial Frame parser9.8v3.10.5%2026-01-12
CVE-2026-22213RIOT OS stack-based buffer overflow in tapslip6 utility9.8v3.10.4%2026-01-12
CVE-2026-22212TinyOS stack-based buffer overflow in mcp2200gpio4.8CNA v4.00.1%2026-01-12
CVE-2026-22200osTicket (.x,.x) PDF export arbitrary file read7.5v3.173.9%2026-01-12NucleiMetasploitExploit codeFix
CVE-2026-22050NetApp ONTAP 9 insecure direct object reference6.9CNA v4.00.2%2026-01-12Fix
CVE-2026-22033HumanSignal Label Studio custom hotkeys field stored cross-site scripting8.6CNA v4.00.3%2026-01-12
CVE-2026-0855Merit LILIN｜IP Camera OS command injection8.7CNA v4.01.2%2026-01-12
CVE-2026-0854Merit LILIN｜NVR OS command injection8.7CNA v4.01.2%2026-01-12Fix
CVE-2026-0853A-Plus Video Technologies｜NVR sensitive data exposure6.9CNA v4.00.3%2026-01-12Fix
CVE-2026-0852code-projects Online Music Site AdminUpdateUser.php SQL injection9.8v3.10.4%2026-01-12
CVE-2026-0851code-projects Online Music Site AdminAddUser.php SQL injection9.8v3.10.4%2026-01-12
CVE-2026-0850code-projects Intern Membership Management System delete_activity.php SQL injection7.2v3.10.4%2026-01-11
CVE-2026-0843Jiujiujia/victor123/wxw850227 jjjfood/jjjshop_food index SQL injection5.3CNA v4.00.2%2026-01-11
CVE-2026-0842Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication5.3CNA v4.00.4%2026-01-11Exploit code
CVE-2026-0841UTT 进取 520W formPictureUrl strcpy buffer overflow8.7CNA v4.03.9%2026-01-11Emerging Threats
CVE-2026-0840UTT 进取 520W formConfigNoticeConfig strcpy buffer overflow8.7CNA v4.04.1%2026-01-11Emerging Threats
CVE-2026-0839UTT 进取 520W APSecurity strcpy buffer overflow8.7CNA v4.01.1%2026-01-11Emerging Threats
CVE-2026-0838UTT 进取 520W ConfigWirelessBase strcpy buffer overflow8.7CNA v4.03.9%2026-01-11Emerging Threats
CVE-2026-0837UTT 进取 520W formFireWall strcpy buffer overflow8.7CNA v4.03.9%2026-01-11Emerging Threats
CVE-2026-0836UTT 进取 520W formConfigFastDirectionW strcpy buffer overflow8.7CNA v4.00.9%2026-01-11Emerging Threats
CVE-2026-22777ComfyUI-Manager is vulnerable to CRLF injection in Configuration handler7.5CNA v3.10.3%2026-01-10Exploit codeKCVFix
CVE-2026-22773vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions6.5CNA v3.10.4%2026-01-10Fix
CVE-2026-22705RustCrypto: Signatures has timing side-channel in ML-DSA decomposition6.4CNA v3.10.2%2026-01-10Fix
CVE-2026-22704haxtheweb issues HAXcms has stored XSS vulnerability that may lead to account takeover8.1CNA v3.11.0%2026-01-10Exploit codeFix
CVE-2026-22703Cosign verification accepts any valid Rekor entry under certain conditions5.5CNA v3.10.1%2026-01-10Fix
CVE-2026-22702Virtualenv has TOCTOU vulnerabilities in Directory Creation4.5CNA v3.10.1%2026-01-10Fix
CVE-2026-22701filelock time-of-check-time-of-use (TOCTOU) Symlink vulnerability in SoftFileLock5.3CNA v3.10.1%2026-01-10Fix
CVE-2026-22700RustCrypto has Insufficient Length Validation in decrypt in SM2-PKE7.5CNA v3.10.3%2026-01-10
CVE-2026-22699RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt7.5CNA v3.10.4%2026-01-10
CVE-2026-22698RustCrypto SM2-PKE has 32-bit Biased Nonce vulnerability8.7CNA v4.00.3%2026-01-10Fix
CVE-2026-22697CryptoLib has heap buffer overflow vulnerability in KMC Base64 Decode Handling7.5CNA v3.10.5%2026-01-10Fix
CVE-2026-22693harfbuzz null pointer dereference in SubtableUnicodesCache::create leading to DoS5.3CNA v3.10.4%2026-01-10Fix
CVE-2026-22691pypdf has possible long runtimes for malformed startxref2.7CNA v4.00.4%2026-01-10Fix
CVE-2026-22690pypdf has possible long runtimes for missing /Root object with large /Size values2.7CNA v4.00.4%2026-01-10Fix
CVE-2026-22689Mailpit is vulnerable to Cross-Site WebSocket Hijacking allowing unauthenticated access to emails6.5CNA v3.10.2%2026-01-10Fix
CVE-2026-22688WeKnora has command injection in MCP stdio test10.0CNA v3.12.0%2026-01-10Fix
CVE-2026-22687WeKnora vulnerable to SQL injection5.6CNA v3.10.4%2026-01-10Fix
CVE-2026-22685DevToys path traversal (Zip Slip) vulnerability in DevToys Extension Installation8.8CNA v3.10.5%2026-01-10Fix
CVE-2026-22612Fickling vulnerable to detection bypass due to builtins blindness8.9CNA v4.00.3%2026-01-10Fix
CVE-2026-22611AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value3.7CNA v3.10.2%2026-01-10Fix
CVE-2026-22610Angular has XSS vulnerability via Unsanitized SVG script attributes8.5CNA v4.00.4%2026-01-10Exploit codeFix
CVE-2026-22609Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist8.9CNA v4.00.6%2026-01-10Fix
CVE-2026-22608Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection8.9CNA v4.00.4%2026-01-10Fix
CVE-2026-22607Fickling Blocklist Bypass: CProfile.run8.9CNA v4.00.5%2026-01-10Fix
CVE-2026-22606Fickling has a bypass via runpy.run_path and runpy.run_module8.9CNA v4.00.5%2026-01-10Fix
CVE-2026-22605OpenProject is vulnerable to insecure direct object reference in Meetings4.3CNA v3.10.2%2026-01-10Fix
CVE-2026-22604OpenProject is vulnerable to user enumeration via the change password function6.9CNA v4.00.3%2026-01-10Fix
CVE-2026-22603OpenProject has no protection against brute-force attacks in the Change Password function6.9CNA v4.00.3%2026-01-10Fix
CVE-2026-22602OpenProject is vulnerable to User Enumeration via User ID3.5CNA v3.10.3%2026-01-10Fix
CVE-2026-22601OpenProject is vulnerable to code execution in E-Mail function8.6CNA v4.00.4%2026-01-10Fix
CVE-2026-22600OpenProject is vulnerable to arbitrary file read via ImageMagick SVG Coder9.1CNA v3.10.3%2026-01-10Fix
CVE-2026-22597Ghost has SSRF via External Media Inliner5.1CNA v4.00.3%2026-01-10Fix
CVE-2026-22596Ghost has SQL injection in Members Activity Feed6.7CNA v3.10.5%2026-01-10Fix
CVE-2026-22595Ghost has Staff Token permission bypass8.1CNA v3.10.5%2026-01-10Fix
CVE-2026-22594TryGhost Ghost improper authentication8.1CNA v3.11.3%2026-01-10MetasploitExploit codeKCVFix
CVE-2026-22589Spree API has unauthenticated IDOR Guest Address7.5CNA v3.10.4%2026-01-10Fix
CVE-2026-22030React Router has CSRF issue in Action/Server action Request Processing6.5CNA v3.10.2%2026-01-10Fix
CVE-2026-22029React Router vulnerable to XSS via Open Redirects8.0CNA v3.10.9%2026-01-10Fix
CVE-2026-22027CryptoLib vulnerable to heap buffer overflow in MariaDB SA Hexstring Conversion5.7CNA v4.00.2%2026-01-10Fix
CVE-2026-22026CryptoLib Unbounded Memory Allocation in KMC HTTP Response handler allows resource exhaustion8.2CNA v4.00.6%2026-01-10Fix
CVE-2026-22025CryptoLib memory leak on HTTP Error Response in KMC client6.3CNA v4.00.5%2026-01-10Fix
CVE-2026-22024CryptoLib memory leak in KMC Encrypt function leads to resource exhaustion6.3CNA v4.00.5%2026-01-10Fix
CVE-2026-22023CryptoLib has out-of-bounds read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern8.2CNA v4.00.6%2026-01-10Fix
CVE-2026-21900CryptoLib has out-of-bounds read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern8.2CNA v4.00.6%2026-01-10Fix
CVE-2026-21899CryptoLib has an out-of-bounds read and crash vulnerability when decoding an empty Base64url string4.7CNA v3.10.4%2026-01-10Fix
CVE-2026-21898CryptoLib has out-of-bounds read in Crypto_AOS_ProcessSecurity8.2CNA v3.10.5%2026-01-10Fix
CVE-2026-21897CryptoLib Has out-of-bounds write in Crypto_Config_Add_Gvcid_Managed_Parameters7.3CNA v3.10.3%2026-01-10Fix
CVE-2026-21884React Router SSR XSS in ScrollRestoration8.2CNA v3.10.5%2026-01-10Fix
CVE-2026-0831Templately WordPress plugin unauthenticated limited arbitrary JSON file write5.3CNA v3.10.3%2026-01-10Fix
CVE-2026-0824questdb ui Web console cross-site scripting5.1CNA v4.00.3%2026-01-10Fix
CVE-2026-0822quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow8.8v3.10.5%2026-01-10
CVE-2026-0821quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow9.8v3.10.5%2026-01-10Fix
CVE-2026-22714The Wikimedia Foundation Mediawiki i18n XSS, DoS and config SQLI in Monaco2.3CNA v4.00.4%2026-01-09
CVE-2026-22713Stored XSS through edit summaries in GrowthExperiments2.3CNA v4.00.2%2026-01-09Fix
CVE-2026-22712The Wikimedia Foundation Mediawiki ApprovedRevs allows bypassing the inline CSS sanitizer2.3CNA v4.00.2%2026-01-09Fix
CVE-2026-22710Stored XSS through autocomment system messages in Wikibase2.3CNA v4.00.2%2026-01-09Fix
CVE-2026-22584Salesforce Uni2TS has a code injection9.8CISA ADP v3.10.4%2026-01-09Fix
CVE-2026-22198GestSup stored XSS in API Error Logs6.1v3.10.3%2026-01-09Fix
CVE-2026-22197GestSup multiple SQL Injections in Asset List8.1v3.10.3%2026-01-09Fix
CVE-2026-22196GestSup ticket creation SQL injection8.1v3.10.3%2026-01-09Fix
CVE-2026-22195GestSup SQL injection in Search Bar8.1v3.10.3%2026-01-09Fix
CVE-2026-22194GestSup CSRF allows Privileged Actions8.8v3.10.2%2026-01-09Fix
CVE-2026-22082Insecure Session ID Management vulnerability in Tenda Wireless Routers8.8CNA v4.00.5%2026-01-09Fix
CVE-2026-22081Cookie without HTTPOnly Flag vulnerability in Tenda Wireless Routers8.8CNA v4.00.4%2026-01-09Fix
CVE-2026-22080Insecure Transmission vulnerability in Tenda Wireless Routers8.7CNA v4.00.1%2026-01-09Fix
CVE-2026-22079Cleartext transmission vulnerability in Tenda Wireless Routers8.7CNA v4.00.1%2026-01-09Fix
CVE-2026-21409RICOH Streamline NX improper authorization8.2CNA v4.00.3%2026-01-09
CVE-2026-20976Samsung Mobile Galaxy Store improper input validation5.1CNA v4.00.2%2026-01-09Fix
CVE-2026-20975Samsung Mobile Samsung Cloud Improper handling of improper permissions2.1CNA v4.00.1%2026-01-09Fix
CVE-2026-20974Samsung Mobile Devices data related to network restrictions improper input validation5.2CNA v4.00.2%2026-01-09Fix
CVE-2026-20973Samsung Mobile Devices libimagecodec.quram.so out-of-bounds read5.3CNA v3.10.5%2026-01-09Fix
CVE-2026-20972Samsung Mobile Devices UwbTest improper export of Android application components4.8CNA v4.00.1%2026-01-09Fix
CVE-2026-20971Samsung Mobile Devices PROCA driver use-after-free7.3CNA v4.00.2%2026-01-09Fix
CVE-2026-20970Samsung Mobile Devices SLocation improper access control6.8CNA v4.00.1%2026-01-09Fix
CVE-2026-20969Samsung Mobile Devices SecSettings improper input validation2.3CNA v4.00.3%2026-01-09Fix
CVE-2026-20968Samsung Mobile Devices DualDAR use-after-free6.7CNA v4.00.2%2026-01-09Fix
CVE-2026-0830Command injection in Kiro GitLab Merge Request Helper8.4CNA v4.01.4%2026-01-09Fix
CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLs5.3CISA ADP v3.10.3%2026-01-09Fix
CVE-2026-0803PHPGurukul Online Course Registration System enroll.php SQL injection8.8v3.10.4%2026-01-09
CVE-2026-0733PHPGurukul Online Course Registration System manage-students.php SQL injection8.8v3.10.4%2026-01-09
CVE-2026-0732D-Link DI-8200G upgrade_filter.asp command injection9.8v3.111.7%2026-01-09Emerging Threats
CVE-2026-0627AMP for WP WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-01-09Fix
CVE-2026-0563Pagup WP Google Street View plugin wpgsv_map shortcode stored cross-site scripting6.4CNA v3.10.2%2026-01-09Fix
CVE-2026-22588Spree API has authenticated insecure direct object reference (IDOR) via Order Modification6.5CNA v3.10.4%2026-01-08Fix
CVE-2026-22587Ideagen DevonWay Reports page stored XSS4.8CNA v4.00.2%2026-01-08Fix
CVE-2026-22522Block Slider WordPress plugin broken access control6.5CNA v3.10.3%2026-01-08
CVE-2026-22521Handmade Framework WordPress plugin local file inclusion7.5CNA v3.10.5%2026-01-08
CVE-2026-22519MediaPress WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-08Fix
CVE-2026-22518X Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-01-08
CVE-2026-22517GA4WP: Google Analytics for WordPress plugin broken access control5.4CNA v3.10.2%2026-01-08Fix
CVE-2026-22492Docket Cache WordPress plugin broken access control4.3CNA v3.10.3%2026-01-08Fix
CVE-2026-22490Bulk Landing Page Creator for WordPress LPagery plugin broken access control5.4CNA v3.10.2%2026-01-08Fix
CVE-2026-22489Image Slider Slideshow WordPress plugin insecure direct object references (IDOR)4.3CNA v3.10.2%2026-01-08
CVE-2026-22488Dashboard Welcome for Beaver Builder WordPress plugin broken access control5.3CNA v3.10.2%2026-01-08
CVE-2026-22487Speed Kit WordPress plugin broken access control4.3CNA v3.10.2%2026-01-08
CVE-2026-22486Re Gallery WordPress plugin broken access control5.3CNA v3.10.3%2026-01-08Fix
CVE-2026-22257Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names8.8CNA v3.10.3%2026-01-08Fix
CVE-2026-22256Salvo is vulnerable to reflected XSS in the list_html function8.8CNA v3.10.3%2026-01-08Fix
CVE-2026-22255iccDEV has heap-buffer-overflow in CIccCLUT::Init at IccProfLib/IccTagLut.cpp8.8CNA v3.10.4%2026-01-08Fix
CVE-2026-22253charmbracelet soft-serve soft Serve is missing an authorization check in LFS lock deletion5.4CNA v3.10.3%2026-01-08Fix
CVE-2026-22246Local Mastodon users can enumerate and access severed relationships of every other local user6.5CNA v3.10.3%2026-01-08Fix
CVE-2026-22245Mastodon has SSRF Protection bypass7.1CNA v4.00.3%2026-01-08Fix
CVE-2026-22244OpenMetadata server-side template injection (SSTI) in FreeMarker email templates that leads to RCE8.5CNA v4.01.3%2026-01-08Fix
CVE-2026-22242CoreShop vulnerable to SQL injection via Admin Reports4.9CNA v3.10.4%2026-01-08Fix
CVE-2026-22241gunet openeclass open eClass has unrestricted file upload that leads to remote code execution (RCE)7.3CNA v4.03.3%2026-01-08Exploit codeFix
CVE-2026-22235OPEXUS eComplaint IDOR8.7CNA v4.00.4%2026-01-08Fix
CVE-2026-22234OPEXUS eCasePortal unauthenticated IDOR9.3CNA v4.00.4%2026-01-08Fix
CVE-2026-22233OPEXUS eCASE Audit Project Cost stored XSS5.4v3.10.2%2026-01-08Fix
CVE-2026-22232OPEXUS eCASE Audit Project Setup stored XSS5.4v3.10.2%2026-01-08Fix
CVE-2026-22231OPEXUS eCASE Audit Document Check Out stored XSS5.4v3.10.2%2026-01-08Fix
CVE-2026-22230OPEXUS eCASE Audit incorrect access control7.2CNA v4.00.3%2026-01-08Fix
CVE-2026-22043RustFS has IAM deny_only Short-Circuit that allows privilege escalation via Service Account Minting5.7CNA v4.00.4%2026-01-08Fix
CVE-2026-22042RustFS has IAM incorrect authorization in ImportIam that allows privilege escalation5.7CNA v4.00.4%2026-01-08Fix
CVE-2026-22041loggingredactor converts non-string types to string types in logs2.0CNA v4.00.3%2026-01-08Fix
CVE-2026-22035Greenshot vulnerable to OS command injection via ExternalCommand plugin7.8CNA v3.11.0%2026-01-08Fix
CVE-2026-22034Snuffleupagus upload validation feature vulnerability9.2CNA v4.00.7%2026-01-08Fix
CVE-2026-22032Directus has open redirect in SAML4.3CNA v3.10.2%2026-01-08Fix
CVE-2026-22028Preact has JSON VNode injection issue7.2CNA v4.00.3%2026-01-08Fix
CVE-2026-21896Kirby is missing permission checks in the content changes API5.8CNA v4.00.2%2026-01-08Fix
CVE-2026-21895Rsa crate has potential panic on a prime being equal to 12.7CNA v4.00.4%2026-01-08Fix
CVE-2026-21894N8n's Missing Stripe-signature verification allows Unauthenticated Forged Webhooks6.5CNA v3.10.5%2026-01-08Fix
CVE-2026-21892Parsl Monitoring Visualization vulnerable to SQL injection5.3CNA v3.10.3%2026-01-08Fix
CVE-2026-21891ZimaOS has authentication bypass via System-Level Username9.4CNA v3.12.3%2026-01-08Nuclei
CVE-2026-21885Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources6.5CNA v3.10.3%2026-01-08Fix
CVE-2026-21883Bokeh server applications have Incomplete Origin Validation in WebSockets4.5CNA v4.00.2%2026-01-08Fix
CVE-2026-21881Kanboard is vulnerable to Reverse Proxy authentication bypass9.1CNA v3.10.5%2026-01-08Fix
CVE-2026-21880Kanboard LDAP injection vulnerability can lead to User Enumeration and information disclosure5.3CNA v3.10.4%2026-01-08Fix
CVE-2026-21879Kanboard vulnerable to open redirect via protocol-relative URLs4.7CNA v3.10.3%2026-01-08Fix
CVE-2026-21877n8n is vulnerable to remote code execution via arbitrary file write10.0CNA v3.15.4%2026-01-08NucleiEmerging ThreatsKCVFix
CVE-2026-21876OWASP CRS has multipart bypass using multiple content-type parts9.3CNA v3.117.9%2026-01-08Exploit codeFix
CVE-2026-21875ClipBucket v5 vulnerable to blind SQL injection through Channel Comments9.8CNA v3.11.7%2026-01-08Nuclei
CVE-2026-21874NiceGUI has Redis connection leak via tab storage causes service degradation5.3CNA v3.10.6%2026-01-08Fix
CVE-2026-21873NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS7.2CNA v3.10.3%2026-01-08Fix
CVE-2026-21872Zauberzeug NiceGUI sub-pages link rendering cross-site scripting6.1CNA v3.10.3%2026-01-08Fix
CVE-2026-21871NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push / replace6.1CNA v3.10.3%2026-01-08Fix
CVE-2026-21869llama.cpp has out-of-bounds write in llama-server8.8CNA v3.10.5%2026-01-08Fix
CVE-2026-21868FlagForgeCTF flagForge Flag Forge has ReDoS vulnerability in User Profile Lookup API7.5CNA v3.10.3%2026-01-08Fix
CVE-2026-21860Werkzeug safe_join allows Windows special device names with compound extensions6.3CNA v4.00.5%2026-01-08Fix
CVE-2026-21859Mailpit Proxy endpoint is vulnerable to server-side request forgery (SSRF)5.8CNA v3.10.8%2026-01-08Reported exploitedNucleiFix
CVE-2026-21858n8n vulnerable to Unauthenticated File Access via Improper Webhook Request Handling10.0CNA v3.178.2%2026-01-08Reported exploitedNucleiExploit codeKCVFix
CVE-2026-21695Titra API Contains mass assignment4.3CNA v3.10.3%2026-01-08Fix
CVE-2026-21694Titra APIs have improper access control6.8CNA v3.10.3%2026-01-08Fix
CVE-2026-21639Ubiquiti airMAX AC buffer overflow5.4CISA ADP v3.10.4%2026-01-08Fix
CVE-2026-21638Ubiquiti UBB-XG command injection8.8CNA v3.10.4%2026-01-08Fix
CVE-2026-21427PIONEER USB DAC Amplifier APS-DA101JS uncontrolled search path8.5CNA v4.00.2%2026-01-08
CVE-2026-0747Devolutions Remote Desktop Manager TeamViewer entry dashboard component information disclosure3.3CISA ADP v3.10.2%2026-01-08
CVE-2026-0731TOTOLINK WA1200 HTTP request cstecgi.cgi null pointer dereference7.5v3.10.7%2026-01-08
CVE-2026-0730PHPGurukul Staff Leave Management System SVG file adminviews.py UPDATE_STAFF cross-site scripting4.8v3.10.3%2026-01-08
CVE-2026-0729code-projects Intern Membership Management System add_activity.php SQL injection7.2v3.10.4%2026-01-08
CVE-2026-0728code-projects Intern Membership Management System delete_admin.php SQL injection7.2v3.10.4%2026-01-08
CVE-2026-0719libsoup NTLM authentication stack-based buffer overflow8.6CNA v3.10.6%2026-01-08Fix
CVE-2026-0707Keycloak: Keycloak authorization header parsing leading to potential security control bypass5.3CNA v3.10.4%2026-01-08Fix
CVE-2026-0701code-projects Intern Membership Management System add_admin.php SQL injection7.2v3.10.4%2026-01-08
CVE-2026-0700code-projects Intern Membership Management System check_admin.php SQL injection9.8v3.10.4%2026-01-08
CVE-2026-0699code-projects Intern Membership Management System edit_activity.php SQL injection7.2v3.10.4%2026-01-08
CVE-2026-0698code-projects Intern Membership Management System edit_students.php SQL injection7.2v3.10.4%2026-01-08
CVE-2026-0697code-projects Intern Membership Management System edit_admin.php SQL injection7.2v3.10.4%2026-01-08
CVE-2026-0676Zorka WordPress theme broken access control5.3CNA v3.10.3%2026-01-08
CVE-2026-0674Campaign Monitor for WordPress plugin broken access control4.3CNA v3.10.2%2026-01-08Fix
CVE-2026-0671Wikimedia Foundation MediaWiki multiple stored i18n/message-key XSSes in UploadWizard6.1CISA ADP v3.10.2%2026-01-08Fix
CVE-2026-22544EFACEC QC 60/90/120 EXCHANGE OF CREDENTIALS IN CLEAR TEXT8.7CNA v4.00.2%2026-01-07
CVE-2026-22543EFACEC QC 60/90/120 WEEK ENCODING FOR PASSWORDS6.9CNA v4.00.2%2026-01-07
CVE-2026-22542EFACEC QC 60/90/120 denial OF service FOR CONCURRENT CONNECTIONS ON TELNET9.2CNA v4.00.4%2026-01-07
CVE-2026-22541EFACEC QC 60/90/120 denial OF service VIA ICMP PACKETS8.2CNA v4.00.3%2026-01-07
CVE-2026-22540EFACEC QC 60/90/120 denial OF service VIA ARP PACKETS9.2CNA v4.00.4%2026-01-07
CVE-2026-22539EFACEC QC 60/90/120 information disclosure VIA CURL REQUESTS (OCPP)5.3CNA v4.00.2%2026-01-07
CVE-2026-22537EFACEC QC 60/90/120 information disclosure WITHIN THE OPERATING SYSTEM6.8CNA v4.00.1%2026-01-07
CVE-2026-22536EFACEC QC 60/90/120 privilege escalation VIA SUDO command8.6CNA v4.00.1%2026-01-07
CVE-2026-22535EFACEC QC 60/90/120 FRAIL security IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY critical PARAMETERS8.9CNA v4.00.1%2026-01-07
CVE-2026-22190Panda3D egg-mkfont format string information disclosure7.5v3.10.4%2026-01-07
CVE-2026-22189Panda3D egg-mkfont stack buffer overflow9.8v3.10.5%2026-01-07
CVE-2026-22188Panda3D Deploy-Stub stack exhaustion via Unbounded alloca5.5v3.10.2%2026-01-07
CVE-2026-22187Bio-Formats Memoizer unsafe deserialization via .bfmemo Cache files7.8NVD v3.10.5%2026-01-07Exploit codeFix
CVE-2026-22186Bio-Formats XXE in Leica XLEF Metadata parser7.1NVD v3.10.2%2026-01-07Fix
CVE-2026-22185OpenLDAP LMDB mdb_load heap buffer underflow in readline4.6CNA v4.00.2%2026-01-07Fix
CVE-2026-22184zlib untgz global buffer overflow in TGZfname7.8v3.10.4%2026-01-07Fix
CVE-2026-22047iccDEV has heap-buffer-overflow in SIccCalcOp::Describe at IccProfLib/IccMpeCalc.cpp8.8CNA v3.10.4%2026-01-07Fix
CVE-2026-22046iccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic at IccXML/IccLibXML/IccProfileXml.cpp8.8CNA v3.10.3%2026-01-07Fix
CVE-2026-21857Redaxo has path traversal in Backup Addon leading to arbitrary file read8.3CNA v4.00.5%2026-01-07Exploit codeFix
CVE-2026-21856Tarkov Data Manager has authenticated SQL injection7.2CNA v3.10.4%2026-01-07
CVE-2026-21855Tarkov Data Manager has unauthenticated reflected XSS9.3CNA v3.10.2%2026-01-07
CVE-2026-21854Tarkov Data Manager authentication bypass9.8CNA v3.10.5%2026-01-07Fix
CVE-2026-21851MONAI has path traversal (Zip Slip) in NGC Private Bundle Download5.3CNA v3.10.4%2026-01-07Fix
CVE-2026-21697Axios4go's race condition in Shared HTTP client allows Proxy Configuration leak8.2CNA v4.00.4%2026-01-07Fix
CVE-2026-21693iccDEV has type confusion in CIccSegmentedCurveXml::ToXml at IccXML/IccLibXML/IccMpeXml.cpp8.8CNA v3.10.4%2026-01-07Fix
CVE-2026-21692iccDEV has type confusion in ToXmlCurve at IccXML/IccLibXML/IccMpeXml.cpp8.8CNA v3.10.4%2026-01-07Fix
CVE-2026-21691iccDEV has type confusion in CIccTag:IsTypeCompressed5.4CNA v3.10.3%2026-01-07Fix
CVE-2026-21690iccDEV has type confusion in CIccTagXmlTagData::ToXml6.3CNA v3.10.2%2026-01-07Fix
CVE-2026-21689iccDEV has type confusion in CIccProfileXml::ParseBasic at IccXML/IccLibXML/IccProfileXml.cpp6.5CNA v3.10.3%2026-01-07Fix
CVE-2026-21688iccDEV has type confusion in SIccCalcOp::ArgsPushed at IccProfLib/IccMpeCalc.cpp8.8CNA v3.10.4%2026-01-07Fix
CVE-2026-21687iccDEV has undefined behavior in CIccTagCurve::CIccTagCurve7.1CNA v3.10.3%2026-01-07Fix
CVE-2026-21686iccDEV has undefined behavior in CIccTagLutAtoB::Validate7.1CNA v3.10.3%2026-01-07Fix
CVE-2026-21685iccDEV has undefined behavior in CIccTagLut16::Read7.1CNA v3.10.3%2026-01-07Fix
CVE-2026-21684iccDEV has undefined behavior in CIccTagSpectralViewingConditions7.1CNA v3.10.3%2026-01-07Fix
CVE-2026-21683iccDEV has type confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile8.8CNA v3.10.3%2026-01-07Fix
CVE-2026-21682iccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText8.8CNA v3.10.4%2026-01-07Fix
CVE-2026-21681iccDEV has undefined behavior runtime error: Nan is outside the range .. IccProfLib/IccTagBasic.cpp7.1CNA v3.10.2%2026-01-07Fix
CVE-2026-21680iccDEV has null pointer dereference in CIccProfile::CheckTagTypes6.5CNA v3.10.3%2026-01-07Fix
CVE-2026-21679iccDEV has heap-buffer-overflow vulnerability in CIccLocalizedUnicode::GetText8.8CNA v3.10.4%2026-01-07Fix
CVE-2026-21678InternationalColorConsortium iccDEV heap-based buffer overflow7.8CNA v3.10.2%2026-01-07Fix
CVE-2026-21506International Color Consortium iccDEV CIccProfileXml null pointer dereference5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21505iccDEV has undefined behavior (UB) Invalid Enum Value5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21504Heap buffer overflow in iccDEV ToneMap parser6.6CNA v3.10.2%2026-01-07Fix
CVE-2026-21503iccDEV has undefined behavior null pointer Passed to memcpy in CIccTagSparseMatrixArray6.1CNA v3.10.2%2026-01-07Fix
CVE-2026-21502Null pointer dereference in iccDEV XML Tag parser5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21501Stack overflow in iccDEV Calculator parser5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21500Stack overflow in iccDEV XML Calculator Macro Expansion5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21499Null pointer dereference in iccDEV XML parser5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21498Null pointer dereference in iccDEV XML Calculator parser5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21497Null pointer dereference in iccDEV Unknown Tag parser5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21496Null pointer dereference in iccDEV Signature parser5.5CNA v3.10.2%2026-01-07Fix
CVE-2026-21495Division by zero in iccDEV TIFF Image Reader5.5CNA v3.10.1%2026-01-07Fix
CVE-2026-21441urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects8.9CNA v4.02.9%2026-01-07Fix
CVE-2026-20893Fujitsu AuthConductor Client Basic origin validation error8.5CNA v4.00.1%2026-01-07
CVE-2026-20029Cisco Identity Services Engine XML external entity Processing information disclosure4.9CNA v3.16.2%2026-01-07Fix
CVE-2026-20027Cisco Snort DCERPC Stub Data out-of-bounds read5.3CNA v3.10.6%2026-01-07Fix
CVE-2026-20026Cisco Secure Firewall Threat Defense Software Snort 3 DCE/RPC inspector use-after-free5.8CNA v3.10.7%2026-01-07Fix
CVE-2026-0670Stored XSS through a system message and a user-provided parameter in ProofreadPage6.1CISA ADP v3.10.2%2026-01-07Fix
CVE-2026-0669Path traversal vulnerability in CSS extension on certain web servers7.5CISA ADP v3.10.4%2026-01-07Fix
CVE-2026-0668VisualData extension: Regular expression denial of service (ReDoS) via crafted user input5.3CISA ADP v3.10.5%2026-01-07Fix
CVE-2026-0656iPaymu Payment Gateway for WooCommerce WordPress plugin missing authentication8.2CNA v3.10.3%2026-01-07Fix
CVE-2026-0650OpenFlagr authentication bypass via Prefix Whitelist Path Normalization9.3CNA v4.01.5%2026-01-07NucleiFix
CVE-2026-0649invoiceninja Migration Import Import.php copy server-side request forgery5.1CNA v4.00.3%2026-01-07
CVE-2026-0643Projectworlds House Rental and Property Listing Signup register.php unrestricted upload9.8v3.10.4%2026-01-07
CVE-2026-0642Projectworlds House Rental and Property Listing complaint.php cross-site scripting6.1v3.10.2%2026-01-07
CVE-2026-0628Google Chrome WebView tag insufficient policy enforcement8.8CISA ADP v3.120.9%2026-01-07Exploit codeFix
CVE-2026-0618Devolutions PowerShell Universal cross-site scripting6.1CISA ADP v3.10.2%2026-01-07Fix
CVE-2026-21677iccDEV has undefined behavior in CIccCLUT::Init8.8CNA v3.10.4%2026-01-06Fix
CVE-2026-21676iccDEV has a heap-based buffer overflow in its CIccMBB::Validate function8.8CNA v3.10.4%2026-01-06Fix
CVE-2026-21675iccDEV has a use-after-free vulnerability in CIccCmm class via improper hint manager object deletion9.8CNA v3.10.5%2026-01-06Fix
CVE-2026-21674iccDEV has a memory leak in its CIccProfileXml::ParseTag Error Path3.3CNA v3.10.2%2026-01-06Fix
CVE-2026-21673iccDEV has integer overflow/Underflow in CIccXmlArrayType::ParseTextCountNum7.8CNA v3.10.2%2026-01-06Fix
CVE-2026-21507iccDEV is vulnerable to denial of service via infinite loop in CalcProfileID7.5CNA v3.10.4%2026-01-06Fix
CVE-2026-21494iccDEV has heap buffer overflow in CIccTagLut8::Validate6.1CNA v3.10.2%2026-01-06Fix
CVE-2026-21493iccDEV has type confusion during XML Curve Serialization6.6CNA v3.10.2%2026-01-06Fix
CVE-2026-21492iccDEV ToneMap Writer has null pointer Member Call5.5CNA v3.10.2%2026-01-06Fix
CVE-2026-21491iccDEV has unicode buffer overflow in CIccTagTextDescription6.1CNA v3.10.2%2026-01-06Fix
CVE-2026-21490iccDEV has heap buffer overflow in CIccTagLut16::Validate6.1CNA v3.10.2%2026-01-06Fix
CVE-2026-21489iccDEV has out-of-bounds read and integer underflow (wrap or wraparound)6.1CNA v3.10.1%2026-01-06Fix
CVE-2026-21488iccDEV has out-of-bounds read, heap-based buffer overflow and improper null termination6.1CNA v3.10.2%2026-01-06Fix
CVE-2026-21487iccDEV has out-of-bounds read, use of out-of-range pointer offset and improper input validation6.1CNA v3.10.2%2026-01-06Fix
CVE-2026-21486International Color Consortium iccDEV CIccSparseMatrix out-of-bounds write7.8CNA v3.10.2%2026-01-06Fix
CVE-2026-21485iccDEV undefined behavior (UB) and Out of Memory in CIccProfile::LoadTag8.8CNA v3.10.4%2026-01-06Fix
CVE-2026-21439badkeys vulnerable to ASCII control character injection on console via malformed input2.0CNA v4.00.3%2026-01-06Fix
CVE-2026-21411Plat'Home OpenBlocks IoT DX1 (FW5.0.x) OpenBlocks series versions authentication bypass8.7CNA v4.00.4%2026-01-06
CVE-2026-0641TOTOLINK WA300 cstecgi.cgi sub_401510 command injection8.8v3.12.6%2026-01-06
CVE-2026-0640Tenda AC23 PowerSaveSet sscanf buffer overflow9.8v3.13.5%2026-01-06
CVE-2026-0607code-projects Online Music Site AdminViewSongs.php SQL injection9.8v3.10.4%2026-01-06
CVE-2026-0604FastDup WordPress plugin authenticated (Contributor+) path traversal via dir_path REST parameter6.5CNA v3.10.4%2026-01-06Fix
CVE-2026-21635Ubiquiti UniFi Connect EV Station Lite improper access control6.5v3.10.1%2026-01-05Fix
CVE-2026-21634Ubiquiti UniFi Protect Application memory corruption6.5CNA v3.10.4%2026-01-05Fix
CVE-2026-21633Ubiquiti UniFi Protect Application improper authentication8.8CNA v3.10.5%2026-01-05Fix
CVE-2026-0625D-Link DSL/DIR/DNS authentication bypass via DNS Configuration endpoint9.3CNA v4.01.0%2026-01-05
CVE-2026-0621MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS7.5NVD v3.10.4%2026-01-05Fix
CVE-2026-0606code-projects Online Music Site Albums.php SQL injection9.8v3.10.5%2026-01-05
CVE-2026-0605code-projects Online Music Site login.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0597Campcodes Supplier Management System edit_profile.php SQL injection9.8v3.10.3%2026-01-05
CVE-2026-0592code-projects Online Product Reservation System User Registration register_code.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0591code-projects Online Product Reservation System Cart Update update.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0590code-projects Online Product Reservation System POST parameter delete.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0589code-projects Online Product Reservation System Administration Backend improper authentication6.9CNA v4.00.6%2026-01-05
CVE-2026-0588Xinhu Rainrock RockOA API rockfun.php cross-site scripting6.1v3.10.2%2026-01-05
CVE-2026-0587Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross-site scripting5.4v3.10.2%2026-01-05
CVE-2026-0586code-projects Online Product Reservation System prod.php cross-site scripting6.1v3.10.4%2026-01-05
CVE-2026-0585code-projects Online Product Reservation System GET parameter order_view.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0584code-projects Online Product Reservation System left_cart.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0583code-projects Online Product Reservation System User Login login.php SQL injection9.8v3.10.4%2026-01-05
CVE-2026-0582itsourcecode Society Management System edit_activity_query.php SQL injection9.8v3.10.3%2026-01-05
CVE-2026-0581Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection9.8v3.19.4%2026-01-05
CVE-2026-0580SourceCodester API Key Manager App Import Key cross-site scripting6.1v3.10.2%2026-01-05
CVE-2026-0579code-projects Online Product Reservation System POST parameter edit.php SQL injection9.8v3.10.4%2026-01-04
CVE-2026-0578code-projects Online Product Reservation System delete.php SQL injection9.8v3.10.5%2026-01-04
CVE-2026-0577code-projects Online Product Reservation System prod.php unrestricted upload9.8v3.10.4%2026-01-04
CVE-2026-0576code-projects Online Product Reservation System parameter prod.php SQL injection9.8v3.10.4%2026-01-04
CVE-2026-0575code-projects Online Product Reservation System Administrator Login adminlogin.php SQL injection9.8v3.10.4%2026-01-04
CVE-2026-0574yeqifu warehouse Request UserController.java saveUserRole improper authorization8.8v3.10.3%2026-01-04
CVE-2026-21484mintplex-labs anything-llm AnythingLLM vulnerable to Username Enumeration w/ Password Recovery5.3CNA v3.10.8%2026-01-03Nuclei
CVE-2026-21483listmonk vulnerable to stored XSS leading to admin account takeover5.4CNA v4.00.2%2026-01-02Fix
CVE-2026-21452MessagePack for Java vulnerable to remote DoS via Malicious EXT Payload Allocation7.5CNA v3.10.6%2026-01-02Fix
CVE-2026-21451Bagisto has HTML Filter Bypass that enables stored XSS5.2CNA v4.00.6%2026-01-02Fix
CVE-2026-21450Bagisto has SSTI in parameter that can lead to RCE7.3CNA v4.01.4%2026-01-02Fix
CVE-2026-21449Bagisto has SSTI via first and last name from low-privilege user (not admin)7.4CNA v4.00.5%2026-01-02Fix
CVE-2026-21448Bagisto has Normal and blind SSTI from low-privilege user when ordering product8.9CNA v4.00.9%2026-01-02Fix
CVE-2026-21447Webkul Bagisto order reorder function insecure direct object reference7.1CNA v3.10.3%2026-01-02Fix
CVE-2026-21446Bagisto missing authentication on Installer API endpoints8.8CNA v4.00.6%2026-01-02Fix
CVE-2026-21445Langflow missing authentication on Critical API endpoints8.8CNA v4.033.3%2026-01-02NucleiExploit codeFix
CVE-2026-21444libtpms returns wrong initialization vector when certain symmetric ciphers are used5.5CNA v3.10.1%2026-01-02Fix
CVE-2026-21440AdonisJS path traversal in Multipart File Handling9.2CNA v4.01.0%2026-01-02Exploit codeFix
CVE-2026-21433Emlog vulnerable to server-side request forgery (SSRF)7.7CNA v3.10.3%2026-01-02
CVE-2026-21432Emlog has stored cross-site scripting issue that can lead to admin or another account ATO6.8CNA v4.00.2%2026-01-02
CVE-2026-21431Emlog vulnerable to stored cross-site scripting via image name2.0CNA v4.00.2%2026-01-02
CVE-2026-21430Emlog: CSRF chained with stored XSS leads to ATO7.0CNA v4.00.2%2026-01-02
CVE-2026-21429Emlog has broken access control (BAC)2.0CNA v4.00.2%2026-01-02
CVE-2026-0571yeqifu warehouse AppFileUtils.java createResponseEntity path traversal6.5v3.10.5%2026-01-02
CVE-2026-0570code-projects Online Music Site Feedback.php SQL injection9.8v3.10.4%2026-01-02
CVE-2026-0569code-projects Online Music Site AlbumByCategory.php SQL injection9.8v3.10.4%2026-01-02
CVE-2026-0568code-projects Online Music Site ViewSongs.php SQL injection9.8v3.10.4%2026-01-02
CVE-2026-0567code-projects Content Management System pages.php SQL injection9.8v3.10.4%2026-01-02
CVE-2026-0566code-projects Content Management System edit_posts.php unrestricted upload9.8v3.10.4%2026-01-02
CVE-2026-0565code-projects Content Management System delete.php SQL injection9.8v3.10.4%2026-01-02
CVE-2026-0547PHPGurukul Online Course Registration student registration page unrestricted file upload8.8v3.10.4%2026-01-02
CVE-2026-0546code-projects Content Management System search.php SQL injection9.8v3.10.4%2026-01-02
CVE-2026-21437eopkg vulnerable to package file list integrity bypass2.0CNA v4.00.2%2026-01-01Fix
CVE-2026-21436eopkg has path traversal: ../filedir5.8CNA v4.00.3%2026-01-01Fix
CVE-2026-21428cpp-httplib has CRLF injection in HTTP headers7.7CNA v4.00.4%2026-01-01Fix
CVE-2026-0544itsourcecode School Management System index.php SQL injection9.8v3.10.4%2026-01-01