# CVEs published 2026-01-25

32 CVEs were published on January 25, 2026: 0 critical, 14 high. Days are UTC.

- [CVE-2026-1409](https://cve.now/CVE-2026-1409.md): Beetel 777VR1 UART excessive authentication (CVSS 1.0, Beetel 777VR1)
- [CVE-2026-1408](https://cve.now/CVE-2026-1408.md): Beetel 777VR1 UART weak password (CVSS 1.0, Beetel 777VR1)
- [CVE-2026-1407](https://cve.now/CVE-2026-1407.md): Beetel 777VR1 UART information disclosure (CVSS 1.0, Beetel 777VR1)
- [CVE-2026-23013](https://cve.now/CVE-2026-23013.md): net: octeon\_ep\_vf: fix free\_irq dev\_id mismatch in IRQ rollback (CVSS 7.0, Linux)
- [CVE-2026-23012](https://cve.now/CVE-2026-23012.md): mm/damon/core: remove call\_control in inactive contexts (no CVSS, Linux)
- [CVE-2026-23011](https://cve.now/CVE-2026-23011.md): ipv4: ip\_gre: make ipgre\_header() robust (no CVSS, Linux)
- [CVE-2026-23010](https://cve.now/CVE-2026-23010.md): ipv6: Fix use-after-free in inet6\_addr\_del(). (CVSS 7.8, Linux)
- [CVE-2026-23009](https://cve.now/CVE-2026-23009.md): xhci: sideband: don't dereference freed ring when removing sideband endpoint (no CVSS, Linux)
- [CVE-2026-23008](https://cve.now/CVE-2026-23008.md): drm/vmwgfx: Fix KMS with 3D on HW version 10 (no CVSS, Linux)
- [CVE-2026-23007](https://cve.now/CVE-2026-23007.md): block: zero non-PI portion of auto integrity buffer (no CVSS, Linux)
- [CVE-2026-23006](https://cve.now/CVE-2026-23006.md): ASoC: tlv320adcx140: fix null pointer (no CVSS, Linux)
- [CVE-2026-23005](https://cve.now/CVE-2026-23005.md): x86/fpu: Clear XSTATE\_BV\[i\] in guest XSAVE state whenever XFD\[i\]=1 (no CVSS, Linux)
- [CVE-2026-23004](https://cve.now/CVE-2026-23004.md): dst: fix races in rt6\_uncached\_list\_del() and rt\_del\_uncached\_list() (CVSS 7.8, Linux)
- [CVE-2026-23003](https://cve.now/CVE-2026-23003.md): ip6\_tunnel: use skb\_vlan\_inet\_prepare() in \_\_ip6\_tnl\_rcv() (CVSS 7.5, Linux)
- [CVE-2026-23002](https://cve.now/CVE-2026-23002.md): lib/buildid: use \_\_kernel\_read() for sleepable context (no CVSS, Linux)
- [CVE-2026-23001](https://cve.now/CVE-2026-23001.md): macvlan: fix possible UAF in macvlan\_forward\_source() (CVSS 7.8, Linux)
- [CVE-2026-23000](https://cve.now/CVE-2026-23000.md): net/mlx5e: Fix crash on profile change rollback failure (no CVSS, Linux)
- [CVE-2026-22999](https://cve.now/CVE-2026-22999.md): net/sched: sch\_qfq: do not free existing class in qfq\_change\_class() (CVSS 7.8, Linux)
- [CVE-2026-22998](https://cve.now/CVE-2026-22998.md): nvme-tcp: fix NULL pointer dereferences in nvmet\_tcp\_build\_pdu\_iovec (CVSS 7.5, Linux)
- [CVE-2026-22997](https://cve.now/CVE-2026-22997.md): net: can: j1939: j1939\_xtp\_rx\_rts\_session\_active(): deactivate session upon receiving the second rts (CVSS 7.5, Linux)
- [CVE-2026-22996](https://cve.now/CVE-2026-22996.md): net/mlx5e: Don't store mlx5e\_priv in mlx5e\_dev devlink priv (no CVSS, Linux)
- [CVE-2025-71163](https://cve.now/CVE-2025-71163.md): dmaengine: idxd: fix device leaks on compat bind and unbind (no CVSS, Linux)
- [CVE-2025-71162](https://cve.now/CVE-2025-71162.md): dmaengine: tegra-adma: Fix use-after-free (CVSS 7.8, Linux)
- [CVE-2020-36937](https://cve.now/CVE-2020-36937.md): MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path (CVSS 8.5, Microvirt MEMU PLAY)
- [CVE-2020-36936](https://cve.now/CVE-2020-36936.md): Magic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service Path (CVSS 8.5, Magic Utilities Magic Mouse 2 utilities)
- [CVE-2020-36935](https://cve.now/CVE-2020-36935.md): KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path (CVSS 8.5, KMSpico Service KMSELDI)
- [CVE-2020-36934](https://cve.now/CVE-2020-36934.md): Deep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service Path (CVSS 8.5, Deepinstinct Deep Instinct Windows Agent)
- [CVE-2020-36933](https://cve.now/CVE-2020-36933.md): IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path (CVSS 8.5, HTC IPTInstaller)
- [CVE-2020-36932](https://cve.now/CVE-2020-36932.md): Seacms 11.1 - 'checkuser' Stored XSS (CVSS 5.1, Seacms)
- [CVE-2020-36931](https://cve.now/CVE-2020-36931.md): Click2Magic 1.1.5 - Stored Cross-Site Scripting (CVSS 5.1, Click2Magic)
- [CVE-2026-1406](https://cve.now/CVE-2026-1406.md): lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin (CVSS 5.1, lcg0124 BootDo)
- [CVE-2025-6461](https://cve.now/CVE-2025-6461.md): CubeWP – All-in-One Dynamic Content Framework \<= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php (CVSS 4.3, cubewp1211 CubeWP Framework)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.