Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2026

272 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 3

  • CVE-2026-24423
    93Now

    SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

    CriticalCVSS 9.3KEVWeaponizedEPSS 88%

    smartertools · smartermailJan 23, 2026

  • CVE-2026-24128
    26Monitor

    XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

    MediumCVSS 6.5Proof of conceptEPSS 0%

    xwiki · xwikiJan 23, 2026

  • CVE-2026-24136
    34Monitor

    Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

    HighCVSS 8.7Proof of conceptEPSS 0%

    saleor · saleorJan 23, 2026

  • CVE-2026-24421
    27Monitor

    phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

    MediumCVSS 6.5Proof of conceptEPSS 1%

    phpmyfaq · phpmyfaqJan 23, 2026

  • CVE-2025-13374
    39Monitor

    Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    irisideatechsolutions · kalrav ai agentJan 24, 2026

  • CVE-2026-1208
    17Monitor

    Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update

    MediumCVSS 4.3Proof of conceptEPSS 0%

    mainichiweb · friendly functions for welcartJan 24, 2026

  • CVE-2025-13920
    21Monitor

    WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

    MediumCVSS 5.3Proof of conceptEPSS 0%

    wpdirectorykit · wp directory kitJan 24, 2026

  • CVE-2026-0911
    30Monitor

    Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import

    HighCVSS 7.5Proof of conceptEPSS 0%

    wpmudev · hustle – email marketing, lead generation, optins, popupsJan 24, 2026

  • CVE-2026-23002
    22Monitor

    lib/buildid: use __kernel_read() for sleepable context

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23006
    22Monitor

    ASoC: tlv320adcx140: fix null pointer

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23008
    22Monitor

    drm/vmwgfx: Fix KMS with 3D on HW version 10

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23009
    22Monitor

    xhci: sideband: don't dereference freed ring when removing sideband endpoint

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23001
    31Monitor

    macvlan: fix possible UAF in macvlan_forward_source()

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23003
    22Monitor

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23004
    18Monitor

    dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

    MediumCVSS 4.7Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23005
    22Monitor

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23007
    22Monitor

    block: zero non-PI portion of auto integrity buffer

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-23010
    31Monitor

    ipv6: Fix use-after-free in inet6_addr_del().

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelJan 25, 2026

  • CVE-2026-1419
    13Monitor

    D-Link DCS700l Web Form setDayNightMode command injection

    LowCVSS 2.0No exploitEPSS 17%

    dlink · dcs-700l firmwareJan 26, 2026

  • CVE-2016-15057
    40Plan

    Apache Continuum: Command injection leading to RCE

    CriticalCVSS 9.9WeaponizedEPSS 3%

    apache · continuumJan 26, 2026

  • CVE-2025-50537
    22Monitor

    Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js

    MediumCVSS 5.5No exploitEPSS 0%

    openjsf · eslintJan 26, 2026

  • CVE-2026-21509
    82Now

    Microsoft Office Security Feature Bypass Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 70%

    microsoft · 365 appsJan 26, 2026

  • CVE-2025-70368
    21Monitor

    Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    worklenz · worklenzJan 26, 2026

  • CVE-2026-23864
    31Monitor

    Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reac

    HighCVSS 7.5No exploitEPSS 2%

    facebook · reactJan 26, 2026

  • CVE-2026-24477
    35Monitor

    AnythingLLM has key leak in `systemSettings.js`

    HighCVSS 8.7Proof of conceptEPSS 1%

    mintplexlabs · anythingllmJan 26, 2026

  • CVE-2026-24479
    60This week

    HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE

    CriticalCVSS 9.3WeaponizedEPSS 8%

    hustoj · hustojJan 26, 2026

  • CVE-2026-24486
    31Monitor

    Python-Multipart has Arbitrary File Write via Non-Default Configuration

    HighCVSS 7.5Proof of conceptEPSS 2%

    fastapiexpert · python-multipartJan 26, 2026

  • CVE-2026-24480
    34Monitor

    QGIS had validated RCE and Repository Takeover via GitHub Actions

    HighCVSS 8.7Proof of conceptEPSS 0%

    qgis · qgisJan 27, 2026

  • CVE-2026-21721
    32Monitor

    Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

    HighCVSS 8.1Proof of conceptEPSS 0%

    grafana · grafanaJan 27, 2026

  • CVE-2026-24816
    40Plan

    Cookie Security Vulnerabilities in datavane/tis

    CriticalCVSS 10.0No exploitEPSS 0%

    datavane · tisJan 27, 2026

  • CVE-2026-1470
    45Plan

    Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.

    CriticalCVSS 9.9No exploitEPSS 20%

    n8n · n8nJan 27, 2026

  • CVE-2025-11187
    26Monitor

    Improper validation of PBMAC1 parameters in PKCS#12 MAC verification

    MediumCVSS 6.1Proof of conceptEPSS 5%

    openssl · opensslJan 27, 2026

  • CVE-2025-69419
    29Monitor

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    HighCVSS 7.4Proof of conceptEPSS 0%

    openssl · opensslJan 27, 2026

  • CVE-2025-69420
    30Monitor

    Missing ASN1_TYPE validation in TS_RESP_verify_response() function

    HighCVSS 7.5Proof of conceptEPSS 0%

    openssl · opensslJan 27, 2026

  • CVE-2025-69421
    30Monitor

    NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

    HighCVSS 7.5Proof of conceptEPSS 0%

    openssl · opensslJan 27, 2026

  • CVE-2025-65264
    22Monitor

    The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attack

    MediumCVSS 5.5Proof of conceptEPSS 0%

    cpuid · cpu-zJan 27, 2026

  • CVE-2020-36939
    60This week

    Cassandra Web 0.5.0 - Remote File Read

    HighCVSS 8.7WeaponizedEPSS 2%

    avalanche123 · cassandra webJan 27, 2026

  • CVE-2025-15467
    52Plan

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    HighCVSS 8.8Proof of conceptEPSS 55%

    openssl · opensslJan 27, 2026

  • CVE-2026-24688
    20Monitor

    pypdf has possible Infinite Loop when processing outlines/bookmarks

    MediumCVSS 5.1Proof of conceptEPSS 0%

    pypdf project · pypdfJan 27, 2026

  • CVE-2026-24858
    95Now

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.

    CriticalCVSS 9.8KEVWeaponizedEPSS 85%

    fortinet · fortianalyzerJan 27, 2026

  • CVE-2026-23830
    40Plan

    SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    nyariv · sandboxjsJan 27, 2026

  • CVE-2026-24134
    26Monitor

    StudioCMS has an Authorization Bypass Through User-Controlled Key

    MediumCVSS 6.5Proof of conceptEPSS 0%

    studiocms · studiocmsJan 27, 2026

  • CVE-2026-24841
    40Plan

    Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint

    CriticalCVSS 9.9Proof of conceptEPSS 2%

    dokploy · dokployJan 27, 2026

  • CVE-2025-40536
    91Now

    SolarWinds Web Help Desk Security Control Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 73%

    solarwinds · web help deskJan 28, 2026

  • CVE-2025-40551
    94Now

    SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    solarwinds · web help deskJan 28, 2026

  • CVE-2025-40552
    55Plan

    SolarWinds Web Help Desk Authentication Bypass Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    solarwinds · web help deskJan 28, 2026

  • CVE-2025-40553
    59Plan

    SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    solarwinds · web help deskJan 28, 2026

  • CVE-2025-40554
    57Plan

    SolarWinds Web Help Desk Authentication Bypass Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    solarwinds · web help deskJan 28, 2026

  • CVE-2026-0702
    30Monitor

    VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'

    HighCVSS 7.5Proof of conceptEPSS 1%

    wpcreatix · vidshop – shoppable videos for woocommerceJan 28, 2026

  • CVE-2026-1056
    43Plan

    Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    inc2734 · snow monkey formsJan 28, 2026

  • CVE-2025-70336
    19Monitor

    A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbi

    MediumCVSS 4.8Proof of conceptEPSS 0%

    podcastgenerator · podcast generatorJan 28, 2026

  • CVE-2026-22243
    34Monitor

    EGroupware has SQL Injection in Nextmatch Filter Processing

    HighCVSS 8.7Proof of conceptEPSS 0%

    egroupware · egroupwareJan 28, 2026

  • CVE-2020-36962
    25Monitor

    Tendenci 12.3.1 - CSV/ Formula Injection

    MediumCVSS 5.3No exploitEPSS 12%

    tendenci · tendenciJan 28, 2026

  • CVE-2026-24897
    36Monitor

    Authenticated Remote Code Execution via Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 3%

    erugo · erugoJan 28, 2026

  • CVE-2025-15545
    29Monitor

    Insufficient Backup File Upload Input Validation on TP-Link Archer RE605X

    HighCVSS 7.3Proof of conceptEPSS 0%

    tp-link · archer re605x firmwareJan 29, 2026

  • CVE-2026-1457
    36Monitor

    Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385

    HighCVSS 8.5Proof of conceptEPSS 7%

    tp-link · vigi c385 firmwareJan 29, 2026

  • CVE-2025-69516
    40Plan

    A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting ver

    HighCVSS 8.8WeaponizedEPSS 2%

    amidaware · tactical rmmJan 29, 2026

  • CVE-2025-69604
    31Monitor

    An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary p

    HighCVSS 7.8Proof of conceptEPSS 0%

    shirt-pocket · superduper\!Jan 29, 2026

  • CVE-2026-1281
    99Now

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    ivanti · endpoint manager mobileJan 29, 2026

  • CVE-2026-1340
    99Now

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    ivanti · endpoint manager mobileJan 29, 2026

  • CVE-2026-25047
    37Monitor

    deepHas vulnerable to Prototype Pollution via constructor.prototype

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    sharpred · deephasJan 29, 2026

  • CVE-2026-25126
    28Monitor

    PolarLearn's unvalidated vote direction allows vote count manipulation

    HighCVSS 7.1Proof of conceptEPSS 0%

    polarlearn · polarlearnJan 29, 2026

  • CVE-2026-25211
    12Monitor

    Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

    LowCVSS 3.2Proof of conceptEPSS 0%

    llamastack · llama stackJan 30, 2026

  • CVE-2026-1699
    35Monitor

    In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while ch

    HighCVSS 8.8Proof of conceptEPSS 0%

    eclipse · theia websiteJan 30, 2026

  • CVE-2026-0709
    28Monitor

    Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation.

    HighCVSS 7.2Proof of conceptEPSS 0%

    hikvision · ds-3wap521-siJan 30, 2026

  • CVE-2026-1498
    28Monitor

    WatchGuard Firebox LDAP Injection

    HighCVSS 7.0No exploitEPSS 0%

    watchguard · fireware osJan 30, 2026

  • CVE-2025-4686
    34Monitor

    Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment

    HighCVSS 8.6Proof of conceptEPSS 0%

    kodmatic computer software tourism construction industry and trade ltd. co. · online exam and assessmentJan 30, 2026

  • CVE-2026-24854
    35Monitor

    Church CRM has SQL injection in PaddleNumEditor.php

    HighCVSS 8.8Proof of conceptEPSS 0%

    churchcrm · churchcrmJan 30, 2026

  • CVE-2026-25050
    10Monitor

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    LowCVSS 2.7Proof of conceptEPSS 0%

    vendure · vendureJan 30, 2026

  • CVE-2025-24293
    60This week

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image

    CriticalCVSS 9.2WeaponizedEPSS 5%

    rails · activestorageJan 30, 2026

  • CVE-2026-25130
    38Monitor

    Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    aliasrobotics · caiJan 30, 2026

  • CVE-2025-36001
    26Monitor

    IBM Db2 Denial of Service

    MediumCVSS 6.5Proof of conceptEPSS 0%

    ibm · db2Jan 30, 2026