# CVEs published 2026-01-21

121 CVEs were published on January 21, 2026: 12 critical, 64 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-23887](https://cve.now/CVE-2026-23887.md): Group-Office has stored XSS vulnerability via unsanitized filenames (CVSS 5.1, Intermesh groupoffice)
- [CVE-2026-23873](https://cve.now/CVE-2026-23873.md): HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export (CVSS 5.2, zhblue hustoj)
- [CVE-2026-1036](https://cve.now/CVE-2026-1036.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion (CVSS 5.3, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2026-23737](https://cve.now/CVE-2026-23737.md): seroval Affected by Remote Code Execution via JSON Deserialization (CVSS 7.5, lxsmnsyc seroval · seroval)
- [CVE-2026-23736](https://cve.now/CVE-2026-23736.md): seroval Affected by Prototype Pollution via JSON Deserialization (CVSS 7.3, lxsmnsyc seroval · seroval)
- [CVE-2026-24048](https://cve.now/CVE-2026-24048.md): Backstage has a Possible SSRF when reading from allowed URL's in \`backend.reading.allow\` (CVSS 3.5, backstage · @backstage/backend-defaults)
- [CVE-2026-23630](https://cve.now/CVE-2026-23630.md): Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering (CVSS 6.3, docmost)
- [CVE-2026-24047](https://cve.now/CVE-2026-24047.md): @backstage/cli-common has a possible \`resolveSafeChildPath\` Symlink Chain Bypass (CVSS 6.3, backstage · @backstage/cli-common)
- [CVE-2026-24046](https://cve.now/CVE-2026-24046.md): Backstage has a Possible Symlink Path Traversal in Scaffolder Actions (CVSS 7.1, backstage · @backstage/backend-defaults +2)
- [CVE-2026-23996](https://cve.now/CVE-2026-23996.md): FastAPI Api Key has a timing side-channel in verify\_key that allows statistical key validity detection (CVSS 3.7, Athroniaeth fastapi-api-key · fastapi-api-key)
- [CVE-2026-23990](https://cve.now/CVE-2026-23990.md): Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims (CVSS 5.3, controlplaneio-fluxcd flux-operator · github.com/controlpla…)
- [CVE-2026-23986](https://cve.now/CVE-2026-23986.md): Copier safe template has arbitrary filesystem write access via directory symlinks when \_preserve\_symlinks: true (CVSS 6.9, copier-org copier · copier)
- [CVE-2026-23968](https://cve.now/CVE-2026-23968.md): Copier safe template has arbitrary filesystem read access via symlinks when \_preserve\_symlinks: false (CVSS 6.8, copier-org copier · copier)
- [CVE-2026-23524](https://cve.now/CVE-2026-23524.md): Laravel Redis Horizontal Scaling Insecure Deserialization (CVSS 9.8, laravel reverb · laravel/reverb)
- [CVE-2026-23960](https://cve.now/CVE-2026-23960.md): Argo Workflows affected by stored XSS in the artifact directory listing (CVSS 7.3, argoproj argo-workflows · github.com/argoproj/argo-workf… +2)
- [CVE-2026-23518](https://cve.now/CVE-2026-23518.md): Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment (CVSS 9.3, fleetdm fleet · github.com/fleetdm/fleet/v4 +1)
- [CVE-2026-23517](https://cve.now/CVE-2026-23517.md): Fleet has an Access Control vulnerability in debug/pprof endpoints (CVSS 6.3, fleetdm fleet · github.com/fleetdm/fleet/v4 +1)
- [CVE-2026-23526](https://cve.now/CVE-2026-23526.md): CVAT vulnerable to privilege escalation of users with staff status (CVSS 8.5, cvat-ai cvat)
- [CVE-2026-23516](https://cve.now/CVE-2026-23516.md): CVAT vulnerable to XSS via skeleton SVG images (CVSS 8.6, cvat-ai cvat)
- [CVE-2026-23499](https://cve.now/CVE-2026-23499.md): Saleor vulnerable to stored XSS via Unrestricted File Upload (CVSS 8.5, saleor)
- [CVE-2026-22849](https://cve.now/CVE-2026-22849.md): Saleor lacks proper HTML sanitization in rich text fields (CVSS 7.2, saleor)
- [CVE-2026-22822](https://cve.now/CVE-2026-22822.md): External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function (CVSS 9.3, external-secrets · github.com/external-secrets/external-sec…)
- [CVE-2026-22808](https://cve.now/CVE-2026-22808.md): Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability (CVSS 5.5, fleetdm fleet · github.com/fleetdm/fleet +1)
- [CVE-2026-22807](https://cve.now/CVE-2026-22807.md): vLLM affected by RCE via auto\_map dynamic module loading during model initialization (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2026-22793](https://cve.now/CVE-2026-22793.md): 5ire vulnerable to Remote Code Execution (RCE) via ECharts (CVSS 9.7, nanbingxyz 5ire)
- [CVE-2026-22792](https://cve.now/CVE-2026-22792.md): 5ire vulnerable to Remote Code Execution (RCE) (CVSS 9.7, nanbingxyz 5ire)
- [CVE-2026-22598](https://cve.now/CVE-2026-22598.md): ManageIQ vulnerable to DoS Attack when creating TimeProfiles (CVSS 7.1, manageiq)
- [CVE-2026-21852](https://cve.now/CVE-2026-21852.md): Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation (CVSS 5.3, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-69285](https://cve.now/CVE-2025-69285.md): SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability (CVSS 7.7, dataease SQLBot)
- [CVE-2025-69209](https://cve.now/CVE-2025-69209.md): ArduinoCore-avr has Stack-Based Buffer Overflow in WString Float/Double Constructors (CVSS 6.9, ArduinoCore-avr)
- [CVE-2025-68141](https://cve.now/CVE-2025-68141.md): EVerest vulnerable to null pointer dereference during DC\_ChargeLoopRes document deserialization (CVSS 7.4, everest-core)
- [CVE-2025-68140](https://cve.now/CVE-2025-68140.md): EVerest allows null session ID to bypass session ID verification (CVSS 4.3, everest-core)
- [CVE-2025-68139](https://cve.now/CVE-2025-68139.md): In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing (CVSS 4.3, everest-core)
- [CVE-2025-12781](https://cve.now/CVE-2025-12781.md): base64.b64decode() always accepts "+/" characters, despite setting altchars (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2025-68138](https://cve.now/CVE-2025-68138.md): EVerest affected by memory exhaustion in libocpp (CVSS 4.7, everest-core)
- [CVE-2026-23955](https://cve.now/CVE-2026-23955.md): EVerest vulnerable to concatenation of strings literal and integers (CVSS 4.2, everest-core)
- [CVE-2025-68137](https://cve.now/CVE-2025-68137.md): EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop (CVSS 8.4, everest-core)
- [CVE-2025-68136](https://cve.now/CVE-2025-68136.md): EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service (CVSS 7.4, everest-core)
- [CVE-2025-13465](https://cve.now/CVE-2025-13465.md): Prototype Pollution Vulnerability in Lodash \_.unset and \_.omit functions (CVSS 6.9, lodash · lodash-amd +3)
- [CVE-2025-68135](https://cve.now/CVE-2025-68135.md): EVerest's inadequate exception handling leads to denial of service (CVSS 6.5, everest-core)
- [CVE-2025-68134](https://cve.now/CVE-2025-68134.md): EVerest's use of assert functions can potentially lead to denial of service (CVSS 7.4, everest-core)
- [CVE-2025-68132](https://cve.now/CVE-2025-68132.md): EVerest has out-of-bounds read in DZG\_GSH01 SLIP CRC parser that can crash powermeter driver (CVSS 2.4, everest-core)
- [CVE-2026-23754](https://cve.now/CVE-2026-23754.md): D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover (CVSS 8.7, D-Link D-View)
- [CVE-2026-23755](https://cve.now/CVE-2026-23755.md): D-Link D-View 8 Installer DLL Preloading via Uncontrolled Search Path (CVSS 8.4, D-Link D-View)
- [CVE-2021-47870](https://cve.now/CVE-2021-47870.md): GetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSS (CVSS 4.8, GetSimple CMS My SMTP Contact Plugin)
- [CVE-2021-47860](https://cve.now/CVE-2021-47860.md): GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE (CVSS 8.5, GetSimple CMS Custom JS Plugin)
- [CVE-2021-47778](https://cve.now/CVE-2021-47778.md): GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection (CVSS 8.6, Get-Simple My SMTP Contact Plugin)
- [CVE-2021-47887](https://cve.now/CVE-2021-47887.md): Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path (CVSS 8.5, OKI Print Job Accounting)
- [CVE-2021-47886](https://cve.now/CVE-2021-47886.md): Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path (CVSS 8.5, Fyrolabs LLC. Pingzapper)
- [CVE-2021-47884](https://cve.now/CVE-2021-47884.md): Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path (CVSS 8.5, OKI Configuration Tool)
- [CVE-2021-47883](https://cve.now/CVE-2021-47883.md): Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path (CVSS 8.5, Sandboxie-Plus Sandboxie Plus)
- [CVE-2021-47882](https://cve.now/CVE-2021-47882.md): FreeLAN 2.2 - 'FreeLAN Service' Unquoted Service Path (CVSS 8.5, FreeLAN)
- [CVE-2021-47880](https://cve.now/CVE-2021-47880.md): Realtek Wireless LAN Utility 700.1631 - 'Realtek11nSU' Unquoted Service Path (CVSS 8.5, Realtek Semiconductor Realtek Wireless LAN Utility)
- [CVE-2021-47879](https://cve.now/CVE-2021-47879.md): eBeam Interactive Suite 3.6 - 'eBeam Stylus Driver' Unquoted Service Path (CVSS 8.5, Luidia eBeam Interactive Suite)
- [CVE-2021-47878](https://cve.now/CVE-2021-47878.md): eBeam Education Suite 2.5.0.9 - 'eBeam Device Service' Unquoted Service Path (CVSS 8.5, Luidia eBeam Education Suite)
- [CVE-2021-47877](https://cve.now/CVE-2021-47877.md): GeoGebra Graphing Calculato‪r‬ 6.0.631.0 - Denial Of Service (CVSS 6.7, GeoGebra Graphing Calculato‪r‬)
- [CVE-2021-47876](https://cve.now/CVE-2021-47876.md): GeoGebra Classic 5.0.631.0-d - Denial of Service (CVSS 6.7, GeoGebra Classic)
- [CVE-2021-47875](https://cve.now/CVE-2021-47875.md): GeoGebra CAS Calculator 6.0.631.0 - Denial of Service (CVSS 4.6, GeoGebra CAS Calculator)
- [CVE-2021-47874](https://cve.now/CVE-2021-47874.md): VFS for Git 1.0.21014.1 - 'GVFS.Service' Unquoted Service Path (CVSS 8.5, Vfsforgit VFS for Git)
- [CVE-2021-47873](https://cve.now/CVE-2021-47873.md): VestaCP \< 0.9.8-25 - Stored Cross-Site Scripting (CVSS 5.1, VestaCP)
- [CVE-2021-47872](https://cve.now/CVE-2021-47872.md): SEO Panel \< 4.9.0 - 'order\_col' Blind SQL Injection (CVSS 7.0, SEO Panel)
- [CVE-2021-47871](https://cve.now/CVE-2021-47871.md): Hestia Control Panel 1.3.2 - Arbitrary File Write (CVSS 8.6, Hestia Control Panel)
- [CVE-2021-47869](https://cve.now/CVE-2021-47869.md): BRAdmin Professional 3.75 - 'BRA\_Scheduler' Unquoted Service Path (CVSS 8.5, Brother Industries BRAdmin Professional)
- [CVE-2021-47868](https://cve.now/CVE-2021-47868.md): WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path (CVSS 8.5, Honeywell WIN-PACK PRO)
- [CVE-2021-47867](https://cve.now/CVE-2021-47867.md): WIN-PACK PRO 4.8 - 'ScheduleService' Unquoted Service Path (CVSS 8.5, Security Winpakpro)
- [CVE-2021-47866](https://cve.now/CVE-2021-47866.md): WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path (CVSS 8.5, Honeywell WIN-PACK PRO)
- [CVE-2021-47865](https://cve.now/CVE-2021-47865.md): ProFTPD 1.3.7a - Remote Denial of Service (CVSS 8.7, ProFTPD)
- [CVE-2021-47864](https://cve.now/CVE-2021-47864.md): OSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service Path (CVSS 8.5, OSAS Traverse Extension)
- [CVE-2021-47863](https://cve.now/CVE-2021-47863.md): MacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service Path (CVSS 8.5, MacPaw Way Encrypto)
- [CVE-2021-47862](https://cve.now/CVE-2021-47862.md): Hi-Rez Studios 5.1.6.3 - 'HiPatchService' Unquoted Service Path (CVSS 8.5, HI-REZ STUDIOS HiPatchService)
- [CVE-2021-47861](https://cve.now/CVE-2021-47861.md): Event Log Explorer 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service Path (CVSS 8.5, FSPro Labs Event Log Explorer)
- [CVE-2021-47859](https://cve.now/CVE-2021-47859.md): ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path (CVSS 8.5, HID Global ActivIdentity)
- [CVE-2021-47858](https://cve.now/CVE-2021-47858.md): Genexis Platinum-4410 P4410-V2-1.31A - 'start\_addr' Persistent Cross-Site Scripting (CVSS 5.1, Genexis Platinum-4410)
- [CVE-2021-47857](https://cve.now/CVE-2021-47857.md): Moodle 3.10.3 - 'label' Persistent Cross Site Scripting (CVSS 5.1, Moodle)
- [CVE-2021-47855](https://cve.now/CVE-2021-47855.md): Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting (CVSS 5.1, LiteSpeed Technologies OpenLiteSpeed)
- [CVE-2021-47854](https://cve.now/CVE-2021-47854.md): DD-WRT 45723 - UPNP Buffer Overflow (CVSS 8.7, embeDD DD-WRT)
- [CVE-2021-47852](https://cve.now/CVE-2021-47852.md): Rockstar Service - Insecure File Permissions (CVSS 8.5, Rockstar Games Launcher)
- [CVE-2021-47851](https://cve.now/CVE-2021-47851.md): Mini Mouse 9.2.0 - Remote Code Execution (CVSS 9.3, Yodinfo Mini Mouse)
- [CVE-2021-47850](https://cve.now/CVE-2021-47850.md): Mini Mouse 9.2.0 - Path Traversal (CVSS 8.7, Yodinfo Mini Mouse)
- [CVE-2021-47849](https://cve.now/CVE-2021-47849.md): Mini Mouse 9.3.0 - Local File inclusion / Path Traversal (CVSS 8.7, Yodinfo Mini Mouse)
- [CVE-2021-47848](https://cve.now/CVE-2021-47848.md): Blitar Tourism 1.0 - Authentication Bypass SQLi (CVSS 8.8, satndy Aplikasi-Biro-Travel)
- [CVE-2021-47846](https://cve.now/CVE-2021-47846.md): Digital Crime Report Management System 1.0 - SQL Injection (CVSS 8.8, I Want Source Codes Digital Crime Report Management System)
- [CVE-2021-47830](https://cve.now/CVE-2021-47830.md): GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF (CVSS 5.1, GetSimple CMS My SMTP Contact Plugin)
- [CVE-2021-47817](https://cve.now/CVE-2021-47817.md): OpenEMR 5.0.2.1 - Remote Code Execution (CVSS 4.8, OpenEMR Foundation OpenEMR)
- [CVE-2021-47802](https://cve.now/CVE-2021-47802.md): Tenda D151 & D301 - Configuration Download (CVSS 8.7, Shenzhen Tenda Technology Co. Tenda D151 & D301)
- [CVE-2021-47770](https://cve.now/CVE-2021-47770.md): OpenPLC 3 - Remote Code Execution (CVSS 8.6, Autonomy OpenPLC)
- [CVE-2021-47748](https://cve.now/CVE-2021-47748.md): Hasura GraphQL 1.3.3 - Remote Code Execution (CVSS 9.3, Hasura GraphQL)
- [CVE-2021-47746](https://cve.now/CVE-2021-47746.md): NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write (CVSS 8.6, NodeBB Plugin Emoji)
- [CVE-2026-0834](https://cve.now/CVE-2026-0834.md): Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13 (CVSS 7.2, TP-Link Systems Archer C20 v6.0, Archer AX53 · TP-Link S… +1)
- [CVE-2026-20045](https://cve.now/CVE-2026-20045.md): Cisco Unified Communications Products Remote Code Execution Vulnerability (CVSS 8.2, KEV, Cisco Unified Communications Manager · Cisco Unity Connecti…)
- [CVE-2026-20109](https://cve.now/CVE-2026-20109.md): Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Packaged Contact Center Enterprise · Cisco Unified Co…)
- [CVE-2026-20080](https://cve.now/CVE-2026-20080.md): Cisco IEC6400 Edge Compute Appliance SSH Denial of Service Vulnerability (CVSS 5.3, Cisco Ultra-Reliable Wireless Backhaul)
- [CVE-2026-20055](https://cve.now/CVE-2026-20055.md): Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Packaged Contact Center Enterprise · Cisco Unified Co…)
- [CVE-2026-20092](https://cve.now/CVE-2026-20092.md): Cisco Intersight Virtual Appliance Privilege Escalation Vulnerability (CVSS 6.0, Cisco Intersight Virtual Appliance)
- [CVE-2026-1290](https://cve.now/CVE-2026-1290.md): \[PI141230\] Fixed A broken access control issue. (CVSS 5.3, Jamf Pro)
- [CVE-2025-13878](https://cve.now/CVE-2025-13878.md): Malformed BRID/HHIT records can cause named to terminate unexpectedly (CVSS 7.5, ISC BIND)
- [CVE-2026-22022](https://cve.now/CVE-2026-22022.md): Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin (CVSS 8.2, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2026-22444](https://cve.now/CVE-2026-22444.md): Apache Solr: Insufficient file-access checking in standalone core-creation requests (CVSS 7.1, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2026-22977](https://cve.now/CVE-2026-22977.md): net: sock: fix hardened usercopy panic in sock\_recv\_errqueue (no CVSS, Linux)
- [CVE-2025-14083](https://cve.now/CVE-2025-14083.md): Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure (CVSS 2.7, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-0988](https://cve.now/CVE-2026-0988.md): Glib: glib: denial of service via integer overflow in g\_buffered\_input\_stream\_peek() (CVSS 3.7, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-0663](https://cve.now/CVE-2026-0663.md): Denial of Service condition in M-Files Server (CVSS 6.9, M-Files Server)
- [CVE-2026-24016](https://cve.now/CVE-2026-24016.md): The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. (CVSS 7.8, Fsas Technologies ServerView Agents for Windows)
- [CVE-2026-22976](https://cve.now/CVE-2026-22976.md): net/sched: sch\_qfq: Fix NULL deref when deactivating inactive aggregate in qfq\_reset (no CVSS, Linux)
- [CVE-2026-24061](https://cve.now/CVE-2026-24061.md): telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. (CVSS 9.8, KEV, GNU Inetutils)
- [CVE-2025-14559](https://cve.now/CVE-2025-14559.md): Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users (CVSS 6.5, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-1035](https://cve.now/CVE-2026-1035.md): Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition (CVSS 3.1, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2025-68133](https://cve.now/CVE-2025-68133.md): EVerest's unlimited connections can lead to DoS through operating system resource exhaustion (CVSS 7.4, everest-core)
- [CVE-2025-15521](https://cve.now/CVE-2025-15521.md): Academy LMS – WordPress LMS Plugin for Complete eLearning Solution \<= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, kodezen Academy LMS – WordPress LMS Plugin for Complete eLe…)
- [CVE-2025-57681](https://cve.now/CVE-2025-57681.md): The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users an (CVSS 5.4)
- [CVE-2025-66959](https://cve.now/CVE-2025-66959.md): An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder (CVSS 7.5)
- [CVE-2025-66960](https://cve.now/CVE-2025-66960.md): An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads (CVSS 7.5)
- [CVE-2025-69762](https://cve.now/CVE-2025-69762.md): Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enabl (CVSS 9.8)
- [CVE-2025-69763](https://cve.now/CVE-2025-69763.md): Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memory corruption and ena (CVSS 9.8)
- [CVE-2025-69766](https://cve.now/CVE-2025-69766.md): Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag s (CVSS 9.8)
- [CVE-2025-70644](https://cve.now/CVE-2025-70644.md): Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub\_60CFC function. (CVSS 7.5)
- [CVE-2025-70645](https://cve.now/CVE-2025-70645.md): Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. (CVSS 7.5)
- [CVE-2025-70646](https://cve.now/CVE-2025-70646.md): Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub\_72290 function. (CVSS 7.5)
- [CVE-2025-70648](https://cve.now/CVE-2025-70648.md): Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security\_5g parameter of the sub\_727F4 function. (CVSS 7.5)
- [CVE-2025-70650](https://cve.now/CVE-2025-70650.md): Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. (CVSS 7.5)
- [CVE-2025-70651](https://cve.now/CVE-2025-70651.md): Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form\_fast\_setting\_wifi\_set function. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.