CVEs published January 25, 2026
32 CVEs were published on January 25, 2026: 0 critical, 14 high.
- Published
- 32
- Critical
- 0
- High
- 14
- Medium
- 4
- Low
- 3
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Linux
- 20
- Beetel 777VR1
- 3
- Click2Magic
- 1
- cubewp1211 CubeWP Framework
- 1
- Deepinstinct Deep Instinct Windows Agent
- 1
- HTC IPTInstaller
- 1
- KMSpico Service KMSELDI
- 1
- lcg0124 BootDo
- 1
- Magic Utilities Magic Mouse 2 utilities
- 1
- Microvirt MEMU PLAY
- 1
High 14
- CVE-2026-23013net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollbackLinux
- CVE-2026-23010ipv6: Fix use-after-free in inet6_addr_del().Linux
- CVE-2026-23004dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()Linux
- CVE-2026-23003ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()Linux
- CVE-2026-23001macvlan: fix possible UAF in macvlan_forward_source()Linux
- CVE-2026-22999net/sched: sch_qfq: do not free existing class in qfq_change_class()Linux
- CVE-2026-22998nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovecLinux
- CVE-2026-22997net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rtsLinux
- CVE-2025-71162dmaengine: tegra-adma: Fix use-after-freeLinux
- CVE-2020-36937MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service PathMicrovirt MEMU PLAY
- CVE-2020-36936Magic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service PathMagic Utilities Magic Mouse 2 utilities
- CVE-2020-36935KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service PathKMSpico Service KMSELDI
- CVE-2020-36934Deep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service PathDeepinstinct Deep Instinct Windows Agent
- CVE-2020-36933IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service PathHTC IPTInstaller
Medium, low and unrated 18
- CVE-2026-1409Beetel 777VR1 UART excessive authenticationBeetel 777VR1
- CVE-2026-1408Beetel 777VR1 UART weak passwordBeetel 777VR1
- CVE-2026-1407Beetel 777VR1 UART information disclosureBeetel 777VR1
- CVE-2026-23012mm/damon/core: remove call_control in inactive contextsLinux
- CVE-2026-23011ipv4: ip_gre: make ipgre_header() robustLinux
- CVE-2026-23009xhci: sideband: don't dereference freed ring when removing sideband endpointLinux
- CVE-2026-23008drm/vmwgfx: Fix KMS with 3D on HW version 10Linux
- CVE-2026-23007block: zero non-PI portion of auto integrity bufferLinux
- CVE-2026-23006ASoC: tlv320adcx140: fix null pointerLinux
- CVE-2026-23005x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1Linux
- CVE-2026-23002lib/buildid: use __kernel_read() for sleepable contextLinux
- CVE-2026-23000net/mlx5e: Fix crash on profile change rollback failureLinux
- CVE-2026-22996net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink privLinux
- CVE-2025-71163dmaengine: idxd: fix device leaks on compat bind and unbindLinux
- CVE-2020-36932Seacms 11.1 - 'checkuser' Stored XSSSeacms
- CVE-2020-36931Click2Magic 1.1.5 - Stored Cross-Site ScriptingClick2Magic
- CVE-2026-1406lcg0124 BootDo Host Header AccessControlFilter.java redirectToLoginlcg0124 BootDo
- CVE-2025-6461CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.phpcubewp1211 CubeWP Framework