Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2026

271 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2026-21436
    23Monitor

    eopkg has Path Traversal: '../filedir' vulnerability

    MediumCVSS 5.8Proof of conceptEPSS 0%

    getsol · eopkgJan 1, 2026

  • CVE-2026-21437
    8Monitor

    eopkg vulnerable to package file list integrity bypass

    LowCVSS 2.0Proof of conceptEPSS 0%

    getsol · eopkgJan 1, 2026

  • CVE-2025-47411
    37Monitor

    Apache StreamPipes: Leverage of User ID for Privilege Escalation

    HighCVSS 8.1No exploitEPSS 15%

    apache · streampipesJan 1, 2026

  • CVE-2025-66398
    41Plan

    Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

    HighCVSS 8.8Proof of conceptEPSS 19%

    signalk · signal k serverJan 1, 2026

  • CVE-2025-68273
    21Monitor

    Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

    MediumCVSS 5.3Proof of conceptEPSS 0%

    signalk · signal k serverJan 1, 2026

  • CVE-2025-14047
    21Monitor

    WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

    MediumCVSS 5.3Proof of conceptEPSS 0%

    wedevs · user frontend: ai powered frontend posting, user directory, profile, membership & user registrationJan 1, 2026

  • CVE-2025-14998
    40Plan

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    wpmudev · branda – white label & branding, free login page customizerJan 1, 2026

  • CVE-2024-55374
    21Monitor

    REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    vanderbilt · redcapJan 2, 2026

  • CVE-2025-67158
    30Monitor

    An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitiv

    HighCVSS 7.5Proof of conceptEPSS 0%

    revotech · i6032w-fhw firmwareJan 2, 2026

  • CVE-2025-67159
    30Monitor

    Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.

    HighCVSS 7.5Proof of conceptEPSS 0%

    vatilon · pa4 firmwareJan 2, 2026

  • CVE-2025-67160
    30Monitor

    An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.

    HighCVSS 7.5Proof of conceptEPSS 0%

    vatilon · pa4 firmwareJan 2, 2026

  • CVE-2026-21440
    36Monitor

    AdonisJS Path Traversal in Multipart File Handling

    CriticalCVSS 9.2Proof of conceptEPSS 1%

    adonisjs · coreJan 2, 2026

  • CVE-2026-21445
    45Plan

    Langflow Missing Authentication on Critical API Endpoints

    HighCVSS 8.8Proof of conceptEPSS 33%

    langflow · langflowJan 2, 2026

  • CVE-2025-34171
    27Monitor

    CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure

    MediumCVSS 6.9Proof of conceptEPSS 0%

    icewhale · casaosJan 2, 2026

  • CVE-2026-21484
    21Monitor

    AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery

    MediumCVSS 5.3Proof of conceptEPSS 0%

    mintplexlabs · anythingllmJan 2, 2026

  • CVE-2025-14124
    34Monitor

    Team < 5.0.11 - Unauthenticated SQLi

    HighCVSS 8.6Proof of conceptEPSS 1%

    unknown · teamJan 5, 2026

  • CVE-2025-5965
    36Monitor

    RCE via the backup feature available only to user with high privilege

    HighCVSS 7.2No exploitEPSS 28%

    centreon · centreon webJan 5, 2026

  • CVE-2025-67303
    30Monitor

    An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.

    HighCVSS 7.5Proof of conceptEPSS 1%

    comfy · comfyui-managerJan 5, 2026

  • CVE-2025-15029
    43Plan

    An unauthenticated user is able to introduce SQL Injection using the Awie export module

    CriticalCVSS 9.8No exploitEPSS 12%

    centreon · awieJan 5, 2026

  • CVE-2025-66376
    60This week

    Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d

    MediumCVSS 6.1KEVWeaponizedEPSS 20%

    synacor · zimbra collaboration suiteJan 5, 2026

  • CVE-2025-64424
    38Monitor

    Colify has command injection vulnerability in project git source

    CriticalCVSS 9.4Proof of conceptEPSS 2%

    coollabs · coolifyJan 5, 2026

  • CVE-2025-64425
    34Monitor

    Coolify has host header injection in forgot password

    HighCVSS 8.5No exploitEPSS 0%

    coollabs · coolifyJan 5, 2026

  • CVE-2025-68428
    37Monitor

    jsPDF has Local File Inclusion/Path Traversal vulnerability

    CriticalCVSS 9.2Proof of conceptEPSS 2%

    parall · jspdfJan 5, 2026

  • CVE-2025-68455
    34Monitor

    Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

    HighCVSS 8.6No exploitEPSS 0%

    craftcms · craft cmsJan 5, 2026

  • CVE-2025-13652
    26Monitor

    CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter

    MediumCVSS 6.5Proof of conceptEPSS 1%

    manchumahara · cbx bookmark & favoriteJan 6, 2026

  • CVE-2025-15001
    39Monitor

    FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    fsylum · fs registration passwordJan 6, 2026

  • CVE-2025-69336
    17Monitor

    WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability

    MediumCVSS 4.3No exploitEPSS 0%

    bdthemes · ultimate store kit elementor addonsJan 6, 2026

  • CVE-2025-15471
    39Monitor

    TRENDnet TEW-713RE formFSrvX os command injection

    HighCVSS 8.9No exploitEPSS 13%

    trendnet · tew-713re firmwareJan 7, 2026

  • CVE-2025-12030
    17Monitor

    ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification

    MediumCVSS 4.3Proof of conceptEPSS 0%

    airesvsg · acf to rest apiJan 7, 2026

  • CVE-2025-13418
    25Monitor

    Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting

    MediumCVSS 6.4Proof of conceptEPSS 0%

    spwebguy · responsive pricing tableJan 7, 2026

  • CVE-2025-13801
    31Monitor

    Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read

    HighCVSS 7.5Proof of conceptEPSS 1%

    yocoadmin · yoco paymentsJan 7, 2026

  • CVE-2026-0628
    41Plan

    Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install

    HighCVSS 8.8Proof of conceptEPSS 20%

    google · chromeJan 7, 2026

  • CVE-2025-66838
    26Monitor

    In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upl

    MediumCVSS 6.5Proof of conceptEPSS 0%

    softwareag · arisJan 7, 2026

  • CVE-2025-15472
    36Monitor

    TRENDnet TEW-811DRU httpd  uapply.cgi setDeviceURL  os command injection

    HighCVSS 7.3No exploitEPSS 22%

    trendnet · tew-811dru firmwareJan 7, 2026

  • CVE-2025-15474
    21Monitor

    AuntyFey Smart Combination Lock BLE Connection Flood DoS

    MediumCVSS 5.3Proof of conceptEPSS 0%

    auntyfey · auntyfey smart combination lockJan 7, 2026

  • CVE-2025-69080
    32Monitor

    WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability

    HighCVSS 8.1Proof of conceptEPSS 0%

    janstudio · geckoJan 7, 2026

  • CVE-2026-0650
    37Monitor

    OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    openflagr · flagrJan 7, 2026

  • CVE-2025-66837
    27Monitor

    A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware

    MediumCVSS 6.8Proof of conceptEPSS 0%

    softwareag · arisJan 7, 2026

  • CVE-2025-12543
    38Monitor

    Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

    CriticalCVSS 9.6Proof of conceptEPSS 1%

    redhat · build of apache camelJan 7, 2026

  • CVE-2026-21851
    21Monitor

    MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

    MediumCVSS 5.3No exploitEPSS 0%

    project-monai · monaiJan 7, 2026

  • CVE-2026-21857
    33Monitor

    Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

    HighCVSS 8.3Proof of conceptEPSS 0%

    redaxo · redaxoJan 7, 2026

  • CVE-2017-20215
    39Monitor

    FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection

    HighCVSS 8.7No exploitEPSS 15%

    flir systems, inc. · flir thermal camera fc-s/ptJan 7, 2026

  • CVE-2017-20216
    41Plan

    FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection

    CriticalCVSS 9.3No exploitEPSS 12%

    flir systems, inc. · flir thermal camera pt-seriesJan 7, 2026

  • CVE-2026-21858
    63This week

    n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

    CriticalCVSS 10.0Proof of conceptEPSS 78%

    n8n · n8nJan 7, 2026

  • CVE-2026-21859
    21Monitor

    Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)

    MediumCVSS 5.3Proof of conceptEPSS 0%

    axllent · mailpitJan 7, 2026

  • CVE-2026-21869
    39Monitor

    llama.cpp has Out-of-bounds Write in llama-server

    CriticalCVSS 9.8No exploitEPSS 0%

    ggml · llama.cppJan 7, 2026

  • CVE-2026-21875
    40Plan

    ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    oxygenz · clipbucketJan 7, 2026

  • CVE-2026-21877
    41Plan

    n8n is vulnerable to Remote Code Execution via Arbitrary File Write

    CriticalCVSS 9.9Proof of conceptEPSS 5%

    n8n · n8nJan 7, 2026

  • CVE-2025-68705
    37Monitor

    RustFS Path Traversal Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 7%

    rustfs · rustfsJan 7, 2026

  • CVE-2026-22187
    27Monitor

    Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

    MediumCVSS 6.8Proof of conceptEPSS 0%

    openmicroscopy · bio-formatsJan 7, 2026

  • CVE-2026-21876
    26Monitor

    OWASP CRS has multipart bypass using multiple content-type parts

    MediumCVSS 5.3Proof of conceptEPSS 17%

    owasp · owasp modsecurity core rule setJan 8, 2026

  • CVE-2026-21891
    40Plan

    ZimaOS has Authentication Bypass via System-Level Username

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    zimaspace · zimaosJan 8, 2026

  • CVE-2026-22241
    30Monitor

    Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

    HighCVSS 7.3Proof of conceptEPSS 3%

    openeclass · openeclassJan 8, 2026

  • CVE-2025-61246
    39Monitor

    indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    indieka900 · online shopping systemJan 8, 2026

  • CVE-2025-65518
    30Monitor

    Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition.

    HighCVSS 7.5Proof of conceptEPSS 0%

    webpros · plesk obsidianJan 8, 2026

  • CVE-2025-65731
    27Monitor

    An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical acce

    MediumCVSS 6.8Proof of conceptEPSS 0%

    dlink · dir-605l firmwareJan 8, 2026

  • CVE-2025-67325
    39Monitor

    Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achiev

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    webkul · qloappsJan 8, 2026

  • CVE-2025-59470
    36Monitor

    This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or o

    CriticalCVSS 9.0Proof of conceptEPSS 1%

    veeam · veeam backup & replicationJan 8, 2026

  • CVE-2026-0732
    11Monitor

    D-Link DI-8200G upgrade_filter.asp command injection

    LowCVSS 2.1No exploitEPSS 11%

    dlink · di-8200g firmwareJan 8, 2026

  • CVE-2025-14736
    39Monitor

    Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    shabti · frontend admin by dynamiappsJan 9, 2026

  • CVE-2025-14893
    25Monitor

    IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter

    MediumCVSS 6.4Proof of conceptEPSS 0%

    indieweb · indiewebJan 9, 2026

  • CVE-2025-69194
    39Monitor

    Wget2: arbitrary file write via metalink path traversal in gnu wget2

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    gnu · wget2Jan 9, 2026

  • CVE-2025-14172
    26Monitor

    WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush

    MediumCVSS 6.5Proof of conceptEPSS 0%

    infosatech · wp page permalink extensionJan 9, 2026

  • CVE-2025-14598
    39Monitor

    BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    cloudilyaerp · bet e-portalJan 9, 2026

  • CVE-2025-15495
    8Monitor

    BiggiDroid Simple PHP CMS editsite.php unrestricted upload

    LowCVSS 2.0Proof of conceptEPSS 0%

    biggidroid · simple php cmsJan 9, 2026

  • CVE-2025-66744
    30Monitor

    In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, all

    HighCVSS 7.5Proof of conceptEPSS 1%

    Jan 9, 2026

  • CVE-2025-70161
    47Plan

    EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection.

    CriticalCVSS 9.8No exploitEPSS 27%

    edimax · br-6208ac firmwareJan 9, 2026

  • CVE-2025-67070
    32Monitor

    A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-

    HighCVSS 8.2Proof of conceptEPSS 0%

    Jan 9, 2026

  • CVE-2026-22024
    25Monitor

    CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion

    MediumCVSS 6.3Proof of conceptEPSS 0%

    nasa · cryptolibJan 9, 2026

  • CVE-2025-59057
    30Monitor

    React Router has XSS Vulnerability

    HighCVSS 7.6Proof of conceptEPSS 0%

    shopify · react-routerJan 9, 2026

  • CVE-2025-61686
    41Plan

    React Router has Path Traversal in File Session Storage

    CriticalCVSS 9.1Proof of conceptEPSS 17%

    shopify · react-router\/nodeJan 9, 2026

  • CVE-2026-22594
    32Monitor

    Ghost has Staff 2FA bypass

    HighCVSS 8.1WeaponizedEPSS 1%

    ghost · ghostJan 9, 2026

  • CVE-2026-22610
    34Monitor

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    HighCVSS 8.5Proof of conceptEPSS 0%

    angular · angularJan 10, 2026

  • CVE-2026-22704
    21Monitor

    HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

    MediumCVSS 5.4Proof of conceptEPSS 1%

    psu · haxcms-nodejsJan 10, 2026

  • CVE-2026-22777
    30Monitor

    ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

    HighCVSS 7.5Proof of conceptEPSS 0%

    comfy · comfyui-managerJan 10, 2026

  • CVE-2025-15503
    23Monitor

    Sangfor Operation and Maintenance Management System common.jsp unrestricted upload

    MediumCVSS 5.5Proof of conceptEPSS 2%

    sangfor · operation and maintenance security management systemJan 10, 2026

  • CVE-2026-0842
    8Monitor

    Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication

    LowCVSS 2.1Proof of conceptEPSS 0%

    flycatcher toys · smart sketcherJan 11, 2026

  • CVE-2025-68493
    46Plan

    Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    HighCVSS 8.1Proof of conceptEPSS 45%

    apache · strutsJan 11, 2026

  • CVE-2025-52694
    51Plan

    Execution of arbitrary SQL commands

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    advantech · iot edge linux dockerJan 11, 2026

  • CVE-2025-63314
    40Plan

    A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    ddsn · cm3 acora cmsJan 12, 2026

  • CVE-2025-68472
    42Plan

    MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

    CriticalCVSS 9.1Proof of conceptEPSS 20%

    mindsdb · mindsdbJan 12, 2026

  • CVE-2026-22200
    56Plan

    osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read

    HighCVSS 8.7WeaponizedEPSS 73%

    enhancesoft · osticketJan 12, 2026

  • CVE-2026-22252
    40Plan

    LibreChat MCP Stdio Remote Command Execution

    CriticalCVSS 9.9No exploitEPSS 4%

    librechat · librechatJan 12, 2026

  • CVE-2026-22785
    37Monitor

    orval MCP client is vulnerable to a code injection attack.

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    orval · orvalJan 12, 2026

  • CVE-2025-66802
    39Monitor

    Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution).

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    covid-19 contact tracing system project · covid-19 contact tracing systemJan 12, 2026

  • CVE-2021-41074
    21Monitor

    A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML documen

    MediumCVSS 5.4Proof of conceptEPSS 0%

    webkul · qloappsJan 12, 2026

  • CVE-2025-12420
    53Plan

    Unauthenticated Privilege Escalation in ServiceNow AI Platform

    CriticalCVSS 9.3Proof of conceptEPSS 53%

    servicenow · now assist ai agentsJan 12, 2026

  • CVE-2025-67146
    37Monitor

    Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php,

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    abhishekmali21 · gym management systemJan 12, 2026

  • CVE-2026-22794
    35Monitor

    Account Takeover Vulnerability in Appsmith

    HighCVSS 8.8Proof of conceptEPSS 0%

    appsmith · appsmithJan 12, 2026

  • CVE-2026-22804
    18Monitor

    Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser

    MediumCVSS 4.7Proof of conceptEPSS 0%

    termix · termixJan 12, 2026

  • CVE-2026-22812
    40Plan

    OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

    HighCVSS 8.8Proof of conceptEPSS 16%

    anoma · opencodeJan 12, 2026

  • CVE-2025-66177
    35Monitor

    There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.

    HighCVSS 8.8Proof of conceptEPSS 0%

    hikvision · ds-96xxxni-hxJan 12, 2026

  • CVE-2025-14001
    21Monitor

    WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication

    MediumCVSS 5.4Proof of conceptEPSS 0%

    ninjateam · wp duplicate pageJan 13, 2026

  • CVE-2025-9435
    22Monitor

    Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

    MediumCVSS 5.5Proof of conceptEPSS 0%

    zohocorp · manageengine admanager plusJan 13, 2026

  • CVE-2025-13444
    35Monitor

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster

    MediumCVSS 6.8No exploitEPSS 27%

    progress · connection manager for objectscaleJan 13, 2026

  • CVE-2025-13447
    35Monitor

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster

    MediumCVSS 6.8No exploitEPSS 27%

    progress · connection manager for objectscale*Jan 13, 2026

  • CVE-2025-55462
    26Monitor

    A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in t

    MediumCVSS 6.5Proof of conceptEPSS 0%

    eramba · erambaJan 13, 2026

  • CVE-2026-22755
    43Plan

    Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi

    CriticalCVSS 9.3No exploitEPSS 20%

    vivotek · affected device model numbers are fd8365, fd8365v2, fd9165, fd9171, fd9187, fd9189, fd9365, fd9371, fd9381, fd9387, fd9389, fd9391,fe9180,fe9181, fe9191, fe9381, fe9382, fe9391, fe9582, ib9365, ib9358Jan 13, 2026

  • CVE-2025-12548
    36Monitor

    Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

    CriticalCVSS 9.0WeaponizedEPSS 1%

    red hat · red hat openshift dev spaces (rhosds) 3.22Jan 13, 2026

  • CVE-2025-66698
    34Monitor

    An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.

    HighCVSS 8.6Proof of conceptEPSS 0%

    semantic-machines · vedaJan 13, 2026