CVEs published January 31, 2026
45 CVEs were published on January 31, 2026: 2 critical, 1 high.
- Published
- 45
- Critical
- 2
- High
- 1
- Medium
- 6
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Linux
- 37
- psmplugins SupportCandy – Helpdesk & Customer Support Ticke…
- 2
- ays-pro Popup Box – Create Countdown, Coupon, Video, Contac…
- 1
- dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- 1
- hayyatapps Sell BTC – Cryptocurrency Selling Calculator
- 1
- SunFounder Pironman Dashboard
- 1
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- 1
- wpdevelop Booking Calendar
- 1
Critical 2
High 1
Medium, low and unrated 42
- CVE-2026-1165Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Changeays-pro Popup Box – Create Countdown, Coupon, Video, Contac…
- CVE-2026-23039drm/gud: fix NULL fb and crtc dereferences on USB disconnectLinux
- CVE-2026-23038pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()Linux
- CVE-2026-23037can: etas_es58x: allow partial RX URB allocation to succeedLinux
- CVE-2026-23036btrfs: release path before iget_failed() in btrfs_read_locked_inode()Linux
- CVE-2026-23035net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of privLinux
- CVE-2026-23034drm/amdgpu/userq: Fix fence reference leak on queue teardown v2Linux
- CVE-2026-23033dmaengine: omap-dma: fix dma_pool resource leak in error pathsLinux
- CVE-2026-23032null_blk: fix kmemleak by releasing references to fault configfs itemsLinux
- CVE-2026-23031can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leakLinux
- CVE-2026-23030phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()Linux
- CVE-2026-23029LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()Linux
- CVE-2026-23028LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()Linux
- CVE-2026-23027LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()Linux
- CVE-2026-23026dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()Linux
- CVE-2026-23025mm/page_alloc: prevent pcp corruption with SMP=nLinux
- CVE-2025-71191dmaengine: at_hdmac: fix device leak on of_dma_xlate()Linux
- CVE-2025-71190dmaengine: bcm-sba-raid: fix device leak on probeLinux
- CVE-2025-71189dmaengine: dw: dmamux: fix OF node leak on route allocation failureLinux
- CVE-2025-71188dmaengine: lpc18xx-dmamux: fix device leak on route allocationLinux
- CVE-2025-71187dmaengine: sh: rz-dmac: fix device leak on probe failureLinux
- CVE-2025-71186dmaengine: stm32: dmamux: fix device leak on route allocationLinux
- CVE-2025-71185dmaengine: ti: dma-crossbar: fix device leak on am335x route allocationLinux
- CVE-2026-23024idpf: fix memory leak of flow steer list on rmmodLinux
- CVE-2026-23023idpf: fix memory leak in idpf_vport_rel()Linux
- CVE-2026-23022idpf: fix memory leak in idpf_vc_core_deinit()Linux
- CVE-2026-23021net: usb: pegasus: fix memory leak in update_eth_regs_async()Linux
- CVE-2026-23020net: 3com: 3c59x: fix possible null dereference in vortex_probe1()Linux
- CVE-2026-23019net: marvell: prestera: fix NULL dereference on devlink_alloc() failureLinux
- CVE-2026-23018btrfs: release path before initializing extent tree in btrfs_read_locked_inode()Linux
- CVE-2026-23017idpf: fix error handling in the init_task on loadLinux
- CVE-2026-23016inet: frags: drop fraglist conntrack referencesLinux
- CVE-2026-23015gpio: mpsse: fix reference leak in gpio_mpsse_probe() error pathsLinux
- CVE-2025-71184btrfs: fix NULL dereference on root when tracing inode evictionLinux
- CVE-2025-71182can: j1939: make j1939_session_activate() fail if device is no longer registeredLinux
- CVE-2025-71181rust_binder: remove spin_lock() in rust_shrink_free_page()Linux
- CVE-2025-71180counter: interrupt-cnt: Drop IRQF_NO_THREAD flagLinux
- CVE-2026-1251SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Referencepsmplugins SupportCandy – Helpdesk & Customer Support Ticke…
- CVE-2026-0683SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filterpsmplugins SupportCandy – Helpdesk & Customer Support Ticke…
- CVE-2025-15525Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposuredcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2026-1431Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposurewpdevelop Booking Calendar
- CVE-2025-15510NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposurewebaways NEX-Forms – Ultimate Forms Plugin for WordPress