CVEs published January 26, 2026
118 CVEs were published on January 26, 2026: 11 critical, 42 high. 1 is now in CISA KEV.
- Published
- 118
- Critical
- 11
- High
- 42
- Medium
- 58
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 45
Most affected products
- Shenzhen Tenda Technology Co. W30E
- 11
- dormakaba Kaba exos
- 7
- dormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- 6
- pnpm
- 5
- dormakaba Access Manager 92xx-k5
- 4
- GPAC
- 4
- code-projects Online Examination System
- 3
- Hiawatha Web server
- 3
- Sangfor Operation and Maintenance Security Management System
- 3
- TP-Link Systems Omada Controller
- 3
Critical 11
- CVE-2026-22709vm2 has a Sandbox Escapepatriksimek vm2 · vm2
- CVE-2026-22696dcap-qvl has Missing Verification for QE IdentityPhala-Network dcap-qvl · dcap-qvl +3
- CVE-2026-24436Tenda W30E V2 Lacks Rate Limiting on AuthenticationShenzhen Tenda Technology Co. W30E
- CVE-2026-24429Tenda W30E V2 Hardcoded Default Password for Built-in AccountShenzhen Tenda Technology Co. W30E
- CVE-2016-15057Apache Continuum: Command injection leading to RCEApache Software Foundation Apache Continuum · org.apache.co…
- CVE-2025-59108Weak Default Passwords in dormakaba access managerdormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- CVE-2025-59103Weak Default Passwords for SSH Access in dormakaba access managerdormakaba Access Manager 92xx-k5
- CVE-2025-59097Unauthenticated SOAP API in dormakaba access managerdormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- CVE-2025-59091Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300dormakaba Kaba exos
- CVE-2025-59090Unauthenticated SOAP API in dormakaba Kaba exos 9300dormakaba Kaba exos
- CVE-2025-70982Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import s
High 42
- CVE-2026-1448D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injectionD-Link DIR-615
- CVE-2026-24478AnythingLLM vulnerable to Path TraversalMintplex-Labs anything-llm
- CVE-2026-24477AnythingLLM has key leak in `systemSettings.js`Mintplex-Labs anything-llm
- CVE-2025-30248DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary Western Digital WD Discovery
- CVE-2026-24470Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalNamezalando skipper · github.com/zalando/skipper
- CVE-2026-24400AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertionassertj · org.assertj:assertj-core
- CVE-2026-24123BentoML has a Path Traversal via Bentofile ConfigurationBentoML
- CVE-2026-0810Gix-date: gix-date: undefined behavior due to invalid string generationGitoxideLabs gitoxide · Logging Subsystem for Red Hat Op… +2
- CVE-2025-14459Virt-cdi-controller: unauthorized pvc cloning via dataimportcronRed Hat RHEL-9-CNV-4.19 · Red Hat OpenShift Virtualization
- CVE-2025-9520IDOR Leading to Owner Account Hijacking in Omada ControllerTP-Link Systems Omada Controller
- CVE-2026-23864Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reacMeta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-14756Authenticated Command Injection Vulnerability in Archer MR600TP-Link Systems Archer MR600
- CVE-2025-71178Crucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPEMicron Technology Crucial Storage Executive
- CVE-2026-24435Tenda W30E V2 Permissive CORS Allows Cross-origin Data AccessShenzhen Tenda Technology Co. W30E
- CVE-2020-36959IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service PathIDT PC Audio
- CVE-2020-36958Kite 1.2020.1119.0 - 'KiteService' Unquoted Service PathKite
- CVE-2020-36957PDF Complete 3.5.310.2002 - 'pdfsvc.exe' Unquoted Service PathPdf-Complete PDF Complete
- CVE-2020-36953MiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service PathMiniTool ShadowMaker
- CVE-2026-24431Tenda W30E V2 Web UI Reveals Passwords in CleartextShenzhen Tenda Technology Co. W30E
- CVE-2026-24428Tenda W30E V2 Incorrect Authorization Allows Administrator Password ChangeShenzhen Tenda Technology Co. W30E
- CVE-2026-24430Tenda W30E V2 HTTP Responses Expose Plaintext CredentialsShenzhen Tenda Technology Co. W30E
- CVE-2026-24440Tenda W30E V2 Allows Password Changes Without Verifying Current PasswordShenzhen Tenda Technology Co. W30E
- CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2020-36952IObit Uninstaller 10 Pro - Unquoted Service PathIObit Uninstaller
- CVE-2026-1284Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2026-1283Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2025-59107Static Firmware Encryption Password in dormakaba access managerdormakaba Access Manager 92xx-k5
- CVE-2025-59106Web Server Running with Root Privileges in dormakaba access managerdormakaba Access Manager 92xx-k7
- CVE-2025-59105Unencrypted Flash Storage in dormakaba access managerdormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- CVE-2025-59104Unlocked Bootloader in dormakaba access managerdormakaba Access Manager 92xx-k7
- CVE-2025-59101Insufficient Session Management in dormakaba access managerdormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- CVE-2025-59099Unauthenticated Path Traversal in dormakaba access managerdormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- CVE-2025-59098Trace Functionality Leaking Sensitive Data in dormakaba access managerdormakaba Access Manager 92xx-k5 · dormakaba Access Manager…
- CVE-2025-59094Local Privilege Escalation in dormakaba Kaba exos 9300 System managementdormakaba Kaba exos
- CVE-2025-59093Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300dormakaba Kaba exos
- CVE-2025-59092Unauthenticated RPC Service in dormakaba Kaba exos 9300dormakaba Kaba exos
- CVE-2025-27821HDFS native client: Out of bounds write in URI parser of native HDFS clientApache Software Foundation HDFS native client · org.apache.…
- CVE-2026-1428WellChoose｜Single Sign-On Portal System - OS Command InjectionWellChoose Single Sign-On Portal System
- CVE-2026-1427WellChoose｜Single Sign-On Portal System - OS Command InjectionWellChoose Single Sign-On Portal System
- CVE-2025-14316AhaChat Messenger Marketing <= 1.1 - Reflected XSSAhaChat Messenger Marketing
- CVE-2026-1420Tenda AC23 WifiExtraSet buffer overflowTenda AC23
- CVE-2025-67274An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service
Medium, low and unrated 65
- CVE-2026-1449Hisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injectionHisense TransTech Smart Bus Management System
- CVE-2026-24476Shaarli vulnerable to stored XSS via Suggested TagsShaarli
- CVE-2026-24408sigstore has CSRF possibility in OIDC authentication during signingsigstore-python · sigstore
- CVE-2026-24003EvseV2G has sequence state validation bypasseverest-core
- CVE-2026-24131pnpm has Path Traversal via arbitrary file permission modificationpnpm
- CVE-2026-1445iJason-Liu Books_Manager upload_bookCover.php unrestricted uploadiJason-Liu Books_Manager
- CVE-2026-24056pnpm has symlink traversal in file:/git dependenciespnpm
- CVE-2026-23890pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.binpnpm
- CVE-2026-23889pnpm has Windows-specific tarball Path Traversalpnpm
- CVE-2025-59472A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.vercel next · next
- CVE-2025-59471A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.vercel next · next
- CVE-2025-59473SQL Injection vulnerability in the Structure for Admin authenticated userExpressionEngine
- CVE-2026-23888pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)pnpm
- CVE-2026-1444iJason-Liu Books_Manager add_book_check.php cross site scriptingiJason-Liu Books_Manager
- CVE-2026-1443code-projects Online Music Site AdminDeleteUser.php sql injectioncode-projects Online Music Site
- CVE-2025-9820Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() functiongnutls · Red Hat Enterprise Linux +8
- CVE-2025-9615Networkmanager: networkmanager file accessRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-1190Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2025-14525Kubevirt: kubevirt: vm administration denial of service via guest agentRed Hat OpenShift Virtualization · kubevirt.io/kubevirt
- CVE-2025-14969Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectRed Hat build of Quarkus 3.27.2.redhat · Red Hat JBoss E… +2
- CVE-2025-11687Gi-docgen: reflected dom xss in gi-docgengi-docgen
- CVE-2025-11065Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructuregithub.com/go-viper/mapstructure/v2 · Red Hat OpenShift… +14
- CVE-2025-9522Blind Server-Side Request Forgery (SSRF) in Omada ControllerTP-Link Systems Omada Controller
- CVE-2025-9521Password Confirmation Bypass in Omada ControllerTP-Link Systems Omada Controller
- CVE-2026-0925Tanium addressed an improper input validation vulnerability in Discover.Tanium Discover
- CVE-2026-24439Tenda W30E V2 Lacks X-Content-Type-Options HeaderShenzhen Tenda Technology Co. W30E
- CVE-2025-57784Tomahawk authentication timing attack due to usage of 'strcmp'Hiawatha Web server
- CVE-2026-24432Tenda W30E V2 Missing CSRF Protections for Administrative ActionsShenzhen Tenda Technology Co. W30E
- CVE-2025-57785Double free in XSLT in 'show_index'Hiawatha Web server
- CVE-2025-57783Improper header parsing may lead to request smugglingHiawatha Web server
- CVE-2020-36960Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site ScriptingFormalms Forma LMS
- CVE-2020-36956Openfire 4.6.0 - 'path' Stored XSSigniterealtime Openfire
- CVE-2020-36955Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site ScriptingGetgrav Grav CMS Admin Plugin
- CVE-2020-36954Xeroneit Library Management System 3.1 - "Add Book Category " Stored XSSXeroneit Library Management System
- CVE-2026-24433Tenda W30E V2 Stored XSS via Username FieldShenzhen Tenda Technology Co. W30E
- CVE-2026-24437Tenda W30E V2 Missing Cache Controls for Credential-bearing PagesShenzhen Tenda Technology Co. W30E
- CVE-2026-1224Tanium addressed an uncontrolled resource consumption vulnerability in Discover.Tanium Discover
- CVE-2026-1446XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlierEsri ArcGIS Pro
- CVE-2025-59109UART Leaking Sensitive Data in dormakaba registration unit 9002dormakaba registration unit
- CVE-2025-59102Secrets Stored in Plaintext in Database in dormakaba access managerdormakaba Access Manager 92xx-k5
- CVE-2025-59100Unauthenticated Access to the SQLite Database in dormakaba access managerdormakaba Access Manager 92xx-k5
- CVE-2025-59096Weak Default Password in dormakaba Kaba exos 9300dormakaba Kaba exos
- CVE-2025-59095Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300dormakaba Kaba exos
- CVE-2025-41083Improper Neutralization in Altitude Communication ServerAltitude Communication Server
- CVE-2026-24656Apache Karaf: Decanter log-socket collector has deserialization vulnerabilityApache Software Foundation Apache Karaf · org.apache.karaf.…
- CVE-2025-41082HTTP Request/Response Smuggling in Altitude Communication ServerAltitude Communication Server
- CVE-2026-1429WellChoose｜Single Sign-On Portal System - Reflected Cross-site ScriptingWellChoose Single Sign-On Portal System
- CVE-2026-1425pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflowpymumu SmartDNS
- CVE-2026-1424PHPGurukul News Portal Profile Pic unrestricted uploadPHPGurukul News Portal
- CVE-2026-1423code-projects Online Examination System admin_pic.php unrestricted uploadcode-projects Online Examination System
- CVE-2026-1422code-projects Online Examination System Login Page index.php sql injectioncode-projects Online Examination System
- CVE-2025-14973Recipe Card Blocks < 3.4.13 - Contributor+ SQLiRecipe Card Blocks Lite
- CVE-2026-1421code-projects Online Examination System Add Pages cross site scriptingcode-projects Online Examination System
- CVE-2026-1419D-Link DCS700l Web Form setDayNightMode command injectionD-Link DCS700l
- CVE-2026-1418GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds writeGPAC
- CVE-2026-1417GPAC filedump.c dump_isom_rtp null pointer dereferenceGPAC
- CVE-2026-1416GPAC filedump.c DumpMovieInfo null pointer dereferenceGPAC
- CVE-2026-1415GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereferenceGPAC
- CVE-2026-1414Sangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injectionSangfor Operation and Maintenance Security Management System
- CVE-2026-1413Sangfor Operation and Maintenance Security Management System HTTP POST Request port_validate portValidate command injectionSangfor Operation and Maintenance Security Management System
- CVE-2026-1412Sangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injectionSangfor Operation and Maintenance Security Management System
- CVE-2026-1411Beetel 777VR1 UART access controlBeetel 777VR1
- CVE-2026-1410Beetel 777VR1 UART missing authenticationBeetel 777VR1
- CVE-2025-50537Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js
- CVE-2025-70368Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature.