Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2026

271 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

  • CVE-2025-64155
    52Plan

    An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, For

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    fortinet · fortisiemJan 13, 2026

  • CVE-2026-20805
    54Plan

    Desktop Window Manager Information Disclosure Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 7%

    microsoft · windows 10 1607Jan 13, 2026

  • CVE-2026-20817
    33Monitor

    Windows Error Reporting Service Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 5%

    microsoft · windows 10 21h2Jan 13, 2026

  • CVE-2026-20820
    32Monitor

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 2%

    microsoft · windows 10 1607Jan 13, 2026

  • CVE-2026-20833
    22Monitor

    Windows Kerberos Information Disclosure Vulnerability

    MediumCVSS 5.5Proof of conceptEPSS 0%

    microsoft · windows server 2008Jan 13, 2026

  • CVE-2026-20872
    32Monitor

    NTLM Hash Disclosure Spoofing Vulnerability

    MediumCVSS 6.5No exploitEPSS 19%

    microsoft · windows 10 1607Jan 13, 2026

  • CVE-2026-20925
    31Monitor

    NTLM Hash Disclosure Spoofing Vulnerability

    MediumCVSS 6.5No exploitEPSS 17%

    microsoft · windows 10 1607Jan 13, 2026

  • CVE-2026-20929
    40Plan

    Windows HTTP.sys Elevation of Privilege Vulnerability

    HighCVSS 7.5WeaponizedEPSS 2%

    microsoft · windows 10 1607Jan 13, 2026

  • CVE-2026-20947
    41Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 18%

    microsoft · sharepoint serverJan 13, 2026

  • CVE-2026-20963
    78This week

    Microsoft SharePoint Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 29%

    microsoft · sharepoint serverJan 13, 2026

  • CVE-2026-22862
    28Monitor

    go-ethereum has a DoS via malicious p2p message

    HighCVSS 7.1Proof of conceptEPSS 0%

    ethereum · go ethereumJan 13, 2026

  • CVE-2026-22869
    35Monitor

    Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow

    HighCVSS 8.9Proof of conceptEPSS 0%

    eigent · eigentJan 13, 2026

  • CVE-2025-25249
    70This week

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.1

    CriticalCVSS 9.8KEVWeaponizedEPSS 3%

    fortinet · fortiosJan 13, 2026

  • CVE-2020-36911
    41Plan

    Covenant 0.5 - Remote Code Execution (RCE)

    CriticalCVSS 9.3No exploitEPSS 12%

    cobbr · covenantJan 13, 2026

  • CVE-2026-22686
    40Plan

    Sandbox Escape via Host Error Prototype Chain in enclave-vm

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    agentfront · enclaveJan 13, 2026

  • CVE-2025-14502
    39Monitor

    News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    vaghasia3 · news and blog designer bundleJan 14, 2026

  • CVE-2026-0594
    24Monitor

    List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha

    MediumCVSS 6.1Proof of conceptEPSS 0%

    mallsop · list site contributorsJan 14, 2026

  • CVE-2026-0717
    21Monitor

    LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    lottiefile · lottiefilesJan 14, 2026

  • CVE-2026-23550
    45Plan

    WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    modular ds · modular dsJan 14, 2026

  • CVE-2025-67399
    18Monitor

    An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the U

    MediumCVSS 4.6Proof of conceptEPSS 0%

    airth · smart home aqi monitor bootloaderJan 14, 2026

  • CVE-2026-23498
    28Monitor

    Shopware Improper Control of Generation of Code in Twig rendered views

    HighCVSS 7.2Proof of conceptEPSS 0%

    shopware · shopwareJan 14, 2026

  • CVE-2026-0897
    28Monitor

    Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

    HighCVSS 7.1Proof of conceptEPSS 0%

    keras · kerasJan 15, 2026

  • CVE-2025-64516
    30Monitor

    GLPI incorrectly authorizes access to documents

    HighCVSS 7.5Proof of conceptEPSS 0%

    glpi-project · glpiJan 15, 2026

  • CVE-2025-67246
    29Monitor

    A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler

    HighCVSS 7.3Proof of conceptEPSS 0%

    ludashi · ludashi driverJan 15, 2026

  • CVE-2025-66417
    39Monitor

    GLPI has an unauthenticated SQL injection through the inventory endpoint

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    glpi-project · glpiJan 15, 2026

  • CVE-2025-36911
    31Monitor

    In key-based pairing, there is a possible ID due to a logic error in the code.

    HighCVSS 7.1Proof of conceptEPSS 8%

    google · androidJan 15, 2026

  • CVE-2025-67647
    33Monitor

    SvelteKit Denial of service and possible SSRF when using prerendering

    HighCVSS 8.4No exploitEPSS 0%

    svelte · adapter-nodeJan 15, 2026

  • CVE-2026-23520
    33Monitor

    Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE

    HighCVSS 8.0Proof of conceptEPSS 1%

    arcane · arcaneJan 15, 2026

  • CVE-2026-0915
    30Monitor

    getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler

    HighCVSS 7.5Proof of conceptEPSS 0%

    gnu · glibcJan 15, 2026

  • CVE-2026-1010
    21Monitor

    Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation

    MediumCVSS 5.4Proof of conceptEPSS 0%

    altium · on-prem enterprise serverJan 15, 2026

  • CVE-2021-47795
    35Monitor

    GeoVision Geowebserver 5.3.3 - Local FIle Inclusion

    HighCVSS 8.7Proof of conceptEPSS 2%

    geovision · geovision geowebserverJan 15, 2026

  • CVE-2025-60021
    47Plan

    Apache bRPC: Remote command injection vulnerability in heap builtin service

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    apache · brpcJan 16, 2026

  • CVE-2025-68921
    31Monitor

    SteelSeries Nahimic 3 1.10.7 allows Directory traversal.

    HighCVSS 7.8Proof of conceptEPSS 0%

    steelseries · nahimicJan 16, 2026

  • CVE-2025-29943
    18Monitor

    Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially

    MediumCVSS 4.6Proof of conceptEPSS 0%

    amd · amd epyc™ 9004 series processorsJan 16, 2026

  • CVE-2025-69581
    22Monitor

    An issue was discovered in Chamillo LMS 1.11.2.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    chamilo · chamilo lmsJan 16, 2026

  • CVE-2026-23723
    28Monitor

    WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

    HighCVSS 7.2Proof of conceptEPSS 0%

    wegia · wegiaJan 16, 2026

  • CVE-2026-23744
    60This week

    REC in MCPJam inspector due to HTTP Endpoint exposes

    CriticalCVSS 9.8WeaponizedEPSS 67%

    mcpjam · inspectorJan 16, 2026

  • CVE-2026-23745
    32Monitor

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    HighCVSS 8.2Proof of conceptEPSS 0%

    isaacs · tarJan 16, 2026

  • CVE-2025-15403
    39Monitor

    RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    metagauss · registrationmagic – custom registration forms, user registration, payment, and user loginJan 16, 2026

  • CVE-2026-1111
    8Monitor

    Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal

    LowCVSS 2.0Proof of conceptEPSS 0%

    publiccms · publiccmsJan 18, 2026

  • CVE-2026-1122
    22Monitor

    Yonyou KSOA HTTP GET Parameter work_info.jsp sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    yonyou · ksoaJan 18, 2026

  • CVE-2026-1125
    27Monitor

    D-Link DIR-823X set_wifidog_settings sub_412E7C command injection

    MediumCVSS 5.5No exploitEPSS 15%

    dlink · dir-823x firmwareJan 18, 2026

  • CVE-2026-23829
    21Monitor

    Mailpit has SMTP Header Injection via Regex Bypass

    MediumCVSS 5.3Proof of conceptEPSS 1%

    axllent · mailpitJan 18, 2026

  • CVE-2025-68616
    30Monitor

    WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

    HighCVSS 7.5Proof of conceptEPSS 0%

    kozea · weasyprintJan 19, 2026

  • CVE-2026-23842
    30Monitor

    ChatterBot has Denial of Service via Database Connection Pool Exhaustion

    HighCVSS 7.5Proof of conceptEPSS 0%

    chatterbot · chatterbotJan 19, 2026

  • CVE-2026-23885
    39Monitor

    AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    alchemy-cms · alchemy cmsJan 19, 2026

  • CVE-2026-23947
    37Monitor

    Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    orval · orvalJan 19, 2026

  • CVE-2026-0905
    39Monitor

    Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to pote

    CriticalCVSS 9.8No exploitEPSS 0%

    google · chromeJan 20, 2026

  • CVE-2026-22844
    43Plan

    Zoom Node Deployments - Command Injection

    CriticalCVSS 9.9No exploitEPSS 13%

    zoom communications inc. · zoom nodeJan 20, 2026

  • CVE-2025-64087
    39Monitor

    A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    opensagres · xdocreportJan 20, 2026

  • CVE-2025-65482
    39Monitor

    An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadin

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    opensagres · xdocreportJan 20, 2026

  • CVE-2025-55423
    40Plan

    A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    iptime · n104s-r1 firmwareJan 20, 2026

  • CVE-2025-67261
    26Monitor

    Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    abacre · retail point of saleJan 20, 2026

  • CVE-2025-67263
    24Monitor

    Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    abacre · retail point of saleJan 20, 2026

  • CVE-2025-56005
    45Plan

    An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` paramet

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    dabeaz · plyJan 20, 2026

  • CVE-2026-0622
    26Monitor

    Open 5GS WebUI uses a hard-coded JWT signing key

    MediumCVSS 6.5Proof of conceptEPSS 0%

    open5gs · open5gsJan 20, 2026

  • CVE-2025-55130
    37Monitor

    A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativ

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    nodejs · node.jsJan 20, 2026

  • CVE-2026-21636
    40Plan

    A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabl

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    nodejs · node.jsJan 20, 2026

  • CVE-2026-21955
    32Monitor

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

    HighCVSS 8.2Proof of conceptEPSS 0%

    oracle · vm virtualboxJan 20, 2026

  • CVE-2026-21962
    92Now

    Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Serve

    CriticalCVSS 10.0KEVWeaponizedEPSS 73%

    oracle · http serverJan 20, 2026

  • CVE-2026-21978
    26Monitor

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing).

    MediumCVSS 6.5Proof of conceptEPSS 0%

    oracle · flexcube universal bankingJan 20, 2026

  • CVE-2026-21986
    28Monitor

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

    HighCVSS 7.1Proof of conceptEPSS 0%

    oracle · vm virtualboxJan 20, 2026

  • CVE-2025-15521
    39Monitor

    Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    kodezen · academy lms – wordpress lms plugin for complete elearning solutionJan 20, 2026

  • CVE-2026-24061
    99Now

    telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    gnu · inetutilsJan 21, 2026

  • CVE-2026-22444
    28Monitor

    Apache Solr: Insufficient file-access checking in standalone core-creation requests

    HighCVSS 7.1Proof of conceptEPSS 0%

    apache · solrJan 21, 2026

  • CVE-2026-20045
    70This week

    Cisco Unified Communications Products Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 4%

    cisco · unified communications managerJan 21, 2026

  • CVE-2026-0834
    28Monitor

    Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13

    HighCVSS 7.2Proof of conceptEPSS 0%

    tp-link · archer ax53 firmwareJan 21, 2026

  • CVE-2025-68137
    33Monitor

    EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop

    HighCVSS 8.3Proof of conceptEPSS 1%

    linuxfoundation · everestJan 21, 2026

  • CVE-2026-21852
    29Monitor

    Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

    MediumCVSS 5.3Proof of conceptEPSS 27%

    anthropic · claude codeJan 21, 2026

  • CVE-2026-22807
    39Monitor

    vLLM affected by RCE via auto_map dynamic module loading during model initialization

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    vllm · vllmJan 21, 2026

  • CVE-2026-22849
    28Monitor

    Saleor lacks proper HTML sanitization in rich text fields

    HighCVSS 7.2Proof of conceptEPSS 0%

    saleor · saleorJan 21, 2026

  • CVE-2026-23499
    34Monitor

    Saleor vulnerable to stored XSS via Unrestricted File Upload

    HighCVSS 8.5Proof of conceptEPSS 0%

    saleor · saleorJan 21, 2026

  • CVE-2026-23524
    39Monitor

    Laravel Redis Horizontal Scaling Insecure Deserialization

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    laravel · reverbJan 21, 2026

  • CVE-2026-24046
    28Monitor

    Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

    HighCVSS 7.1Proof of conceptEPSS 0%

    backstage · backstageJan 21, 2026

  • CVE-2025-13465
    28Monitor

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    MediumCVSS 6.9Proof of conceptEPSS 1%

    lodash · lodashJan 21, 2026

  • CVE-2026-24055
    25Monitor

    Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

    MediumCVSS 6.3Proof of conceptEPSS 0%

    langfuse · langfuseJan 22, 2026

  • CVE-2026-24049
    22Monitor

    wheel Allows Arbitrary File Permission Modification via Path Traversal

    MediumCVSS 5.5Proof of conceptEPSS 0%

    wheel project · wheelJan 22, 2026

  • CVE-2026-0920
    39Monitor

    LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    choijun · la-studio element kit for elementorJan 22, 2026

  • CVE-2026-24332
    17Monitor

    Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because

    MediumCVSS 4.3Proof of conceptEPSS 0%

    discord · websocket api serviceJan 22, 2026

  • CVE-2026-23760
    96Now

    SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

    CriticalCVSS 9.3KEVWeaponizedEPSS 96%

    smartertools · smartermailJan 22, 2026

  • CVE-2025-69612
    26Monitor

    A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    tmsglobalsoft · tms management consoleJan 22, 2026

  • CVE-2025-69821
    29Monitor

    An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connecti

    HighCVSS 7.4Proof of conceptEPSS 0%

    beatxp · vega smartwatch firmwareJan 22, 2026

  • CVE-2025-69822
    29Monitor

    An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate priv

    HighCVSS 7.4Proof of conceptEPSS 0%

    atomberg · erica smart fan firmwareJan 22, 2026

  • CVE-2026-24009
    39Monitor

    Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    docling · docling-coreJan 22, 2026

  • CVE-2025-67221
    30Monitor

    The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

    HighCVSS 7.5Proof of conceptEPSS 0%

    ijl · orjsonJan 22, 2026

  • CVE-2025-67923
    28Monitor

    WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    crocoblock · jetengineJan 22, 2026

  • CVE-2025-68001
    40Plan

    WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    garidium · g-ffl checkoutJan 22, 2026

  • CVE-2025-68999
    34Monitor

    WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability

    HighCVSS 8.5Proof of conceptEPSS 0%

    happymonster · happy addons for elementorJan 22, 2026

  • CVE-2025-70899
    26Monitor

    PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    phpgurukul · online course registrationJan 22, 2026

  • CVE-2026-24306
    39Monitor

    Azure Front Door Elevation of Privilege Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    microsoft · azure front doorJan 22, 2026

  • CVE-2026-0768
    60This week

    Langflow code Code Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 22%

    langflow · langflowJan 23, 2026

  • CVE-2026-0769
    60This week

    Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 41%

    langflow · langflowJan 23, 2026

  • CVE-2026-0770
    88Now

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 62%

    langflow · langflowJan 23, 2026

  • CVE-2026-0776
    29Monitor

    Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

    HighCVSS 7.3Proof of conceptEPSS 0%

    discord · clientJan 23, 2026

  • CVE-2025-67847
    35Monitor

    Moodle: moodle: remote code execution via insufficient restore input validation

    HighCVSS 8.8No exploitEPSS 0%

    moodle · moodleJan 23, 2026

  • CVE-2026-0603
    33Monitor

    Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

    HighCVSS 8.3Proof of conceptEPSS 1%

    red hat · red hat jboss enterprise application platform 7.1 eus for rhel 7Jan 23, 2026

  • CVE-2026-0994
    32Monitor

    Denial of Service in Python Protobuf

    HighCVSS 8.2Proof of conceptEPSS 0%

    google · protobufJan 23, 2026

  • CVE-2021-47881
    26Monitor

    dataSIMS Avionics ARINC 664-1 - Local Buffer Overflow

    MediumCVSS 6.7Proof of conceptEPSS 0%

    data device corporation · datasims avionics arincJan 23, 2026

  • CVE-2022-25369
    51Plan

    An issue was discovered in Dynamicweb before 9.12.8.

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    Jan 23, 2026

  • CVE-2026-24423
    93Now

    SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

    CriticalCVSS 9.3KEVWeaponizedEPSS 88%

    smartertools · smartermailJan 23, 2026