# CVEs published 2026-01-31

45 CVEs were published on January 31, 2026: 2 critical, 1 high. Days are UTC.

- [CVE-2026-25069](https://cve.now/CVE-2026-25069.md): SunFounder Pironman Dashboard \<= 1.3.13 Path Traversal Arbitrary File Read/Deletion (CVSS 9.3, SunFounder Pironman Dashboard)
- [CVE-2026-1165](https://cve.now/CVE-2026-1165.md): Popup Box \<= 6.1.1 - Cross-Site Request Forgery to Popup Status Change (CVSS 4.3, ays-pro Popup Box – Create Countdown, Coupon, Video, Contac…)
- [CVE-2025-14554](https://cve.now/CVE-2025-14554.md): Sell BTC - Cryptocurrency Selling Calculator \<= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform\_data' AJAX Action (CVSS 7.2, hayyatapps Sell BTC – Cryptocurrency Selling Calculator)
- [CVE-2026-23039](https://cve.now/CVE-2026-23039.md): drm/gud: fix NULL fb and crtc dereferences on USB disconnect (no CVSS, Linux)
- [CVE-2026-23038](https://cve.now/CVE-2026-23038.md): pnfs/flexfiles: Fix memory leak in nfs4\_ff\_alloc\_deviceid\_node() (no CVSS, Linux)
- [CVE-2026-23037](https://cve.now/CVE-2026-23037.md): can: etas\_es58x: allow partial RX URB allocation to succeed (no CVSS, Linux)
- [CVE-2026-23036](https://cve.now/CVE-2026-23036.md): btrfs: release path before iget\_failed() in btrfs\_read\_locked\_inode() (no CVSS, Linux)
- [CVE-2026-23035](https://cve.now/CVE-2026-23035.md): net/mlx5e: Pass netdev to mlx5e\_destroy\_netdev instead of priv (no CVSS, Linux)
- [CVE-2026-23034](https://cve.now/CVE-2026-23034.md): drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 (no CVSS, Linux)
- [CVE-2026-23033](https://cve.now/CVE-2026-23033.md): dmaengine: omap-dma: fix dma\_pool resource leak in error paths (no CVSS, Linux)
- [CVE-2026-23032](https://cve.now/CVE-2026-23032.md): null\_blk: fix kmemleak by releasing references to fault configfs items (no CVSS, Linux)
- [CVE-2026-23031](https://cve.now/CVE-2026-23031.md): can: gs\_usb: gs\_usb\_receive\_bulk\_callback(): fix URB memory leak (no CVSS, Linux)
- [CVE-2026-23030](https://cve.now/CVE-2026-23030.md): phy: rockchip: inno-usb2: Fix a double free bug in rockchip\_usb2phy\_probe() (no CVSS, Linux)
- [CVE-2026-23029](https://cve.now/CVE-2026-23029.md): LoongArch: KVM: Fix kvm\_device leak in kvm\_eiointc\_destroy() (no CVSS, Linux)
- [CVE-2026-23028](https://cve.now/CVE-2026-23028.md): LoongArch: KVM: Fix kvm\_device leak in kvm\_ipi\_destroy() (no CVSS, Linux)
- [CVE-2026-23027](https://cve.now/CVE-2026-23027.md): LoongArch: KVM: Fix kvm\_device leak in kvm\_pch\_pic\_destroy() (no CVSS, Linux)
- [CVE-2026-23026](https://cve.now/CVE-2026-23026.md): dmaengine: qcom: gpi: Fix memory leak in gpi\_peripheral\_config() (no CVSS, Linux)
- [CVE-2026-23025](https://cve.now/CVE-2026-23025.md): mm/page\_alloc: prevent pcp corruption with SMP=n (no CVSS, Linux)
- [CVE-2025-71191](https://cve.now/CVE-2025-71191.md): dmaengine: at\_hdmac: fix device leak on of\_dma\_xlate() (no CVSS, Linux)
- [CVE-2025-71190](https://cve.now/CVE-2025-71190.md): dmaengine: bcm-sba-raid: fix device leak on probe (no CVSS, Linux)
- [CVE-2025-71189](https://cve.now/CVE-2025-71189.md): dmaengine: dw: dmamux: fix OF node leak on route allocation failure (no CVSS, Linux)
- [CVE-2025-71188](https://cve.now/CVE-2025-71188.md): dmaengine: lpc18xx-dmamux: fix device leak on route allocation (no CVSS, Linux)
- [CVE-2025-71187](https://cve.now/CVE-2025-71187.md): dmaengine: sh: rz-dmac: fix device leak on probe failure (no CVSS, Linux)
- [CVE-2025-71186](https://cve.now/CVE-2025-71186.md): dmaengine: stm32: dmamux: fix device leak on route allocation (no CVSS, Linux)
- [CVE-2025-71185](https://cve.now/CVE-2025-71185.md): dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (no CVSS, Linux)
- [CVE-2026-23024](https://cve.now/CVE-2026-23024.md): idpf: fix memory leak of flow steer list on rmmod (no CVSS, Linux)
- [CVE-2026-23023](https://cve.now/CVE-2026-23023.md): idpf: fix memory leak in idpf\_vport\_rel() (no CVSS, Linux)
- [CVE-2026-23022](https://cve.now/CVE-2026-23022.md): idpf: fix memory leak in idpf\_vc\_core\_deinit() (no CVSS, Linux)
- [CVE-2026-23021](https://cve.now/CVE-2026-23021.md): net: usb: pegasus: fix memory leak in update\_eth\_regs\_async() (no CVSS, Linux)
- [CVE-2026-23020](https://cve.now/CVE-2026-23020.md): net: 3com: 3c59x: fix possible null dereference in vortex\_probe1() (no CVSS, Linux)
- [CVE-2026-23019](https://cve.now/CVE-2026-23019.md): net: marvell: prestera: fix NULL dereference on devlink\_alloc() failure (no CVSS, Linux)
- [CVE-2026-23018](https://cve.now/CVE-2026-23018.md): btrfs: release path before initializing extent tree in btrfs\_read\_locked\_inode() (no CVSS, Linux)
- [CVE-2026-23017](https://cve.now/CVE-2026-23017.md): idpf: fix error handling in the init\_task on load (no CVSS, Linux)
- [CVE-2026-23016](https://cve.now/CVE-2026-23016.md): inet: frags: drop fraglist conntrack references (no CVSS, Linux)
- [CVE-2026-23015](https://cve.now/CVE-2026-23015.md): gpio: mpsse: fix reference leak in gpio\_mpsse\_probe() error paths (no CVSS, Linux)
- [CVE-2025-71184](https://cve.now/CVE-2025-71184.md): btrfs: fix NULL dereference on root when tracing inode eviction (no CVSS, Linux)
- [CVE-2025-71183](https://cve.now/CVE-2025-71183.md): btrfs: always detect conflicting inodes when logging inode refs (CVSS 9.1, Linux)
- [CVE-2025-71182](https://cve.now/CVE-2025-71182.md): can: j1939: make j1939\_session\_activate() fail if device is no longer registered (no CVSS, Linux)
- [CVE-2025-71181](https://cve.now/CVE-2025-71181.md): rust\_binder: remove spin\_lock() in rust\_shrink\_free\_page() (no CVSS, Linux)
- [CVE-2025-71180](https://cve.now/CVE-2025-71180.md): counter: interrupt-cnt: Drop IRQF\_NO\_THREAD flag (no CVSS, Linux)
- [CVE-2026-1251](https://cve.now/CVE-2026-1251.md): SupportCandy – Helpdesk & Customer Support Ticket System \<= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 5.4, psmplugins SupportCandy – Helpdesk & Customer Support Ticke…)
- [CVE-2026-0683](https://cve.now/CVE-2026-0683.md): SupportCandy – Helpdesk & Customer Support Ticket System \<= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter (CVSS 6.5, psmplugins SupportCandy – Helpdesk & Customer Support Ticke…)
- [CVE-2025-15525](https://cve.now/CVE-2025-15525.md): Ajax Load More – Infinite Scroll, Lazy Load & Load More \<= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure (CVSS 5.3, dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…)
- [CVE-2026-1431](https://cve.now/CVE-2026-1431.md): Booking Calendar \<= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure (CVSS 5.3, wpdevelop Booking Calendar)
- [CVE-2025-15510](https://cve.now/CVE-2025-15510.md): NEX-Forms – Ultimate Forms Plugin for WordPress \<= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.