По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2026 г.
272 записей · 16 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
34Наблюдать | CVE-2025-66698Proof of concept | An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.semantic-machines · veda · CWE-287 | Высокая8,6 | — | 0,4 % | 13 янв. 2026 г. |
52В плане | CVE-2025-64155Proof of concept | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, Forfortinet · fortisiem · CWE-78 | Критическая9,8 | — | 42,5 % | 13 янв. 2026 г. |
54В плане | CVE-2026-20805Готовый эксплойт | Desktop Window Manager Information Disclosure Vulnerabilitymicrosoft · windows 10 1607 · CWE-200 | Средняя5,5 | KEV | 7,4 % | 13 янв. 2026 г. |
33Наблюдать | CVE-2026-20817Proof of concept | Windows Error Reporting Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-280 | Высокая7,8 | — | 5,4 % | 13 янв. 2026 г. |
32Наблюдать | CVE-2026-20820Proof of concept | Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 | Высокая7,8 | — | 2,5 % | 13 янв. 2026 г. |
22Наблюдать | CVE-2026-20833Proof of concept | Windows Kerberos Information Disclosure Vulnerabilitymicrosoft · windows server 2008 · CWE-327 | Средняя5,5 | — | 0,5 % | 13 янв. 2026 г. |
32Наблюдать | CVE-2026-20872Эксплойта нет | NTLM Hash Disclosure Spoofing Vulnerabilitymicrosoft · windows 10 1607 · CWE-73 | Средняя6,5 | — | 19,7 % | 13 янв. 2026 г. |
31Наблюдать | CVE-2026-20925Эксплойта нет | NTLM Hash Disclosure Spoofing Vulnerabilitymicrosoft · windows 10 1607 · CWE-73 | Средняя6,5 | — | 17,9 % | 13 янв. 2026 г. |
40В плане | CVE-2026-20929Готовый эксплойт | Windows HTTP.sys Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-284 | Высокая7,5 | — | 2,8 % | 13 янв. 2026 г. |
41В плане | CVE-2026-20947Эксплойта нет | Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-89 | Высокая8,8 | — | 18,4 % | 13 янв. 2026 г. |
78На этой неделе | CVE-2026-20963Готовый эксплойт | Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Критическая9,8 | KEV | 29,2 % | 13 янв. 2026 г. |
28Наблюдать | CVE-2026-22862Proof of concept | go-ethereum has a DoS via malicious p2p messageethereum · go ethereum · CWE-20 | Высокая7,1 | — | 0,7 % | 13 янв. 2026 г. |
35Наблюдать | CVE-2026-22869Proof of concept | Eigent Allows Arbitrary Code Execution via pull_request_target CI Workfloweigent · eigent · CWE-94 | Высокая8,9 | — | 0,6 % | 13 янв. 2026 г. |
70На этой неделе | CVE-2025-25249Готовый эксплойт | A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.1fortinet · fortios · CWE-122 | Критическая9,8 | KEV | 3,8 % | 13 янв. 2026 г. |
41В плане | CVE-2020-36911Эксплойта нет | Covenant 0.5 - Remote Code Execution (RCE)cobbr · covenant · CWE-798 | Критическая9,3 | — | 12,3 % | 13 янв. 2026 г. |
40В плане | CVE-2026-22686Proof of concept | Sandbox Escape via Host Error Prototype Chain in enclave-vmagentfront · enclave · CWE-94 | Критическая10,0 | — | 0,7 % | 13 янв. 2026 г. |
39Наблюдать | CVE-2025-14502Proof of concept | News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusionvaghasia3 · news and blog designer bundle · CWE-98 | Критическая9,8 | — | 1,5 % | 14 янв. 2026 г. |
24Наблюдать | CVE-2026-0594Proof of concept | List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alphamallsop · list site contributors · CWE-79 | Средняя6,1 | — | 0,7 % | 14 янв. 2026 г. |
21Наблюдать | CVE-2026-0717Proof of concept | LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposurelottiefile · lottiefiles · CWE-200 | Средняя5,3 | — | 0,9 % | 14 янв. 2026 г. |
45В плане | CVE-2026-23550Proof of concept | WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerabilitymodular ds · modular ds · CWE-266 | Критическая9,8 | — | 21,3 % | 14 янв. 2026 г. |
18Наблюдать | CVE-2025-67399Proof of concept | An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the Uairth · smart home aqi monitor bootloader · CWE-200 | Средняя4,6 | — | 0,1 % | 14 янв. 2026 г. |
28Наблюдать | CVE-2026-23498Proof of concept | Shopware Improper Control of Generation of Code in Twig rendered viewsshopware · shopware · CWE-94 | Высокая7,2 | — | 0,4 % | 14 янв. 2026 г. |
28Наблюдать | CVE-2026-0897Proof of concept | Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadatakeras · keras · CWE-770 | Высокая7,1 | — | 0,3 % | 15 янв. 2026 г. |
30Наблюдать | CVE-2025-64516Proof of concept | GLPI incorrectly authorizes access to documentsglpi-project · glpi · CWE-284 | Высокая7,5 | — | 0,3 % | 15 янв. 2026 г. |
29Наблюдать | CVE-2025-67246Proof of concept | A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handlerludashi · ludashi driver · CWE-269 | Высокая7,3 | — | 0,1 % | 15 янв. 2026 г. |
39Наблюдать | CVE-2025-66417Proof of concept | GLPI has an unauthenticated SQL injection through the inventory endpointglpi-project · glpi · CWE-89 | Критическая9,8 | — | 0,4 % | 15 янв. 2026 г. |
31Наблюдать | CVE-2025-36911Proof of concept | In key-based pairing, there is a possible ID due to a logic error in the code.google · android | Высокая7,1 | — | 8,4 % | 15 янв. 2026 г. |
33Наблюдать | CVE-2025-67647Эксплойта нет | SvelteKit Denial of service and possible SSRF when using prerenderingsvelte · adapter-node · CWE-248 | Высокая8,4 | — | 0,5 % | 15 янв. 2026 г. |
33Наблюдать | CVE-2026-23520Proof of concept | Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEarcane · arcane · CWE-78 | Высокая8,0 | — | 1,8 % | 15 янв. 2026 г. |
30Наблюдать | CVE-2026-0915Proof of concept | getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovlergnu · glibc · CWE-908 | Высокая7,5 | — | 0,6 % | 15 янв. 2026 г. |
21Наблюдать | CVE-2026-1010Proof of concept | Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalationaltium · on-prem enterprise server · CWE-79 | Средняя5,4 | — | 0,3 % | 15 янв. 2026 г. |
35Наблюдать | CVE-2021-47795Proof of concept | GeoVision Geowebserver 5.3.3 - Local FIle Inclusiongeovision · geovision geowebserver · CWE-22 | Высокая8,7 | — | 2,8 % | 15 янв. 2026 г. |
47В плане | CVE-2025-60021Proof of concept | Apache bRPC: Remote command injection vulnerability in heap builtin serviceapache · brpc · CWE-77 | Критическая9,8 | — | 25,5 % | 16 янв. 2026 г. |
31Наблюдать | CVE-2025-68921Proof of concept | SteelSeries Nahimic 3 1.10.7 allows Directory traversal.steelseries · nahimic · CWE-22 | Высокая7,8 | — | 0,3 % | 16 янв. 2026 г. |
18Наблюдать | CVE-2025-29943Proof of concept | Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentiallyamd · amd epyc™ 9004 series processors · CWE-123 | Средняя4,6 | — | 0,2 % | 16 янв. 2026 г. |
22Наблюдать | CVE-2025-69581Proof of concept | An issue was discovered in Chamillo LMS 1.11.2.chamilo · chamilo lms · CWE-524 | Средняя5,5 | — | 0,2 % | 16 янв. 2026 г. |
28Наблюдать | CVE-2026-23723Proof of concept | WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameterwegia · wegia · CWE-89 | Высокая7,2 | — | 0,4 % | 16 янв. 2026 г. |
60На этой неделе | CVE-2026-23744Готовый эксплойт | REC in MCPJam inspector due to HTTP Endpoint exposesmcpjam · inspector · CWE-306 | Критическая9,8 | — | 67,5 % | 16 янв. 2026 г. |
32Наблюдать | CVE-2026-23745Proof of concept | node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitizationisaacs · tar · CWE-22 | Высокая8,2 | — | 0,3 % | 16 янв. 2026 г. |
39Наблюдать | CVE-2025-15403Proof of concept | RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_ordermetagauss · registrationmagic – custom registration forms, user registration, payment, and user login · CWE-269 | Критическая9,8 | — | 1,6 % | 16 янв. 2026 г. |
8Наблюдать | CVE-2026-1111Proof of concept | Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalpubliccms · publiccms · CWE-22 | Низкая2,0 | — | 0,6 % | 18 янв. 2026 г. |
22Наблюдать | CVE-2026-1122Proof of concept | Yonyou KSOA HTTP GET Parameter work_info.jsp sql injectionyonyou · ksoa · CWE-74 | Средняя5,5 | — | 0,4 % | 18 янв. 2026 г. |
27Наблюдать | CVE-2026-1125Эксплойта нет | D-Link DIR-823X set_wifidog_settings sub_412E7C command injectiondlink · dir-823x firmware · CWE-74 | Средняя5,5 | — | 15,7 % | 18 янв. 2026 г. |
21Наблюдать | CVE-2026-23829Proof of concept | Mailpit has SMTP Header Injection via Regex Bypassaxllent · mailpit · CWE-93 | Средняя5,3 | — | 1,4 % | 18 янв. 2026 г. |
30Наблюдать | CVE-2025-68616Proof of concept | WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirectkozea · weasyprint · CWE-601 | Высокая7,5 | — | 0,7 % | 19 янв. 2026 г. |
30Наблюдать | CVE-2026-23842Proof of concept | ChatterBot has Denial of Service via Database Connection Pool Exhaustionchatterbot · chatterbot · CWE-400 | Высокая7,5 | — | 0,5 % | 19 янв. 2026 г. |
39Наблюдать | CVE-2026-23885Proof of concept | AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperalchemy-cms · alchemy cms · CWE-95 | Критическая9,9 | — | 0,4 % | 19 янв. 2026 г. |
37Наблюдать | CVE-2026-23947Proof of concept | Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationorval · orval · CWE-77 | Критическая9,3 | — | 0,8 % | 19 янв. 2026 г. |
39Наблюдать | CVE-2026-0905Эксплойта нет | Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potegoogle · chrome · CWE-200 | Критическая9,8 | — | 0,2 % | 20 янв. 2026 г. |
43В плане | CVE-2026-22844Эксплойта нет | Zoom Node Deployments - Command Injectionzoom communications inc. · zoom node · CWE-78 | Критическая9,9 | — | 13,4 % | 20 янв. 2026 г. |
39Наблюдать | CVE-2025-64087Proof of concept | A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackersopensagres · xdocreport · CWE-1336 | Критическая9,8 | — | 0,5 % | 20 янв. 2026 г. |
39Наблюдать | CVE-2025-65482Proof of concept | An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadinopensagres · xdocreport · CWE-611 | Критическая9,8 | — | 0,5 % | 20 янв. 2026 г. |
40В плане | CVE-2025-55423Proof of concept | A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to iptime · n104s-r1 firmware · CWE-94 | Критическая9,8 | — | 3,7 % | 20 янв. 2026 г. |
26Наблюдать | CVE-2025-67261Proof of concept | Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection.abacre · retail point of sale · CWE-89 | Средняя6,5 | — | 0,2 % | 20 янв. 2026 г. |
24Наблюдать | CVE-2025-67263Proof of concept | Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module.abacre · retail point of sale · CWE-79 | Средняя6,1 | — | 0,2 % | 20 янв. 2026 г. |
45В плане | CVE-2025-56005Proof of concept | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parametdabeaz · ply · CWE-502 | Критическая9,8 | — | 18,8 % | 20 янв. 2026 г. |
26Наблюдать | CVE-2026-0622Proof of concept | Open 5GS WebUI uses a hard-coded JWT signing keyopen5gs · open5gs · CWE-798 | Средняя6,5 | — | 0,4 % | 20 янв. 2026 г. |
37Наблюдать | CVE-2025-55130Proof of concept | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativnodejs · node.js · CWE-289 | Критическая9,1 | — | 1,6 % | 20 янв. 2026 г. |
40В плане | CVE-2026-21636Proof of concept | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enablnodejs · node.js · CWE-284 | Критическая10,0 | — | 0,8 % | 20 янв. 2026 г. |
32Наблюдать | CVE-2026-21955Proof of concept | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).oracle · vm virtualbox · CWE-400 | Высокая8,2 | — | 0,3 % | 20 янв. 2026 г. |
92Срочно | CVE-2026-21962Готовый эксплойт | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Serveoracle · http server · CWE-284 | Критическая10,0 | KEV | 73,1 % | 20 янв. 2026 г. |
26Наблюдать | CVE-2026-21978Proof of concept | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing).oracle · flexcube universal banking | Средняя6,5 | — | 0,2 % | 20 янв. 2026 г. |
28Наблюдать | CVE-2026-21986Proof of concept | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).oracle · vm virtualbox | Высокая7,1 | — | 0,2 % | 20 янв. 2026 г. |
39Наблюдать | CVE-2025-15521Proof of concept | Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeoverkodezen · academy lms – wordpress lms plugin for complete elearning solution · CWE-639 | Критическая9,8 | — | 0,4 % | 20 янв. 2026 г. |
99Срочно | CVE-2026-24061Готовый эксплойт | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.gnu · inetutils · CWE-88 | Критическая9,8 | KEV | 98,9 % | 21 янв. 2026 г. |
28Наблюдать | CVE-2026-22444Proof of concept | Apache Solr: Insufficient file-access checking in standalone core-creation requestsapache · solr · CWE-20 | Высокая7,1 | — | 0,6 % | 21 янв. 2026 г. |
70На этой неделе | CVE-2026-20045Готовый эксплойт | Cisco Unified Communications Products Remote Code Execution Vulnerabilitycisco · unified communications manager · CWE-94 | Критическая9,8 | KEV | 4,5 % | 21 янв. 2026 г. |
28Наблюдать | CVE-2026-0834Proof of concept | Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13tp-link · archer ax53 firmware · CWE-290 | Высокая7,2 | — | 0,4 % | 21 янв. 2026 г. |
33Наблюдать | CVE-2025-68137Proof of concept | EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite looplinuxfoundation · everest · CWE-120 | Высокая8,3 | — | 1,2 % | 21 янв. 2026 г. |
29Наблюдать | CVE-2026-21852Proof of concept | Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmationanthropic · claude code · CWE-522 | Средняя5,3 | — | 27,5 % | 21 янв. 2026 г. |
39Наблюдать | CVE-2026-22807Proof of concept | vLLM affected by RCE via auto_map dynamic module loading during model initializationvllm · vllm · CWE-94 | Критическая9,8 | — | 0,8 % | 21 янв. 2026 г. |
28Наблюдать | CVE-2026-22849Proof of concept | Saleor lacks proper HTML sanitization in rich text fieldssaleor · saleor · CWE-83 | Высокая7,2 | — | 0,2 % | 21 янв. 2026 г. |
34Наблюдать | CVE-2026-23499Proof of concept | Saleor vulnerable to stored XSS via Unrestricted File Uploadsaleor · saleor · CWE-79 | Высокая8,5 | — | 0,2 % | 21 янв. 2026 г. |
39Наблюдать | CVE-2026-23524Proof of concept | Laravel Redis Horizontal Scaling Insecure Deserializationlaravel · reverb · CWE-502 | Критическая9,8 | — | 0,9 % | 21 янв. 2026 г. |
28Наблюдать | CVE-2026-24046Proof of concept | Backstage has a Possible Symlink Path Traversal in Scaffolder Actionsbackstage · backstage · CWE-22 | Высокая7,1 | — | 0,5 % | 21 янв. 2026 г. |
28Наблюдать | CVE-2025-13465Proof of concept | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functionslodash · lodash · CWE-1321 | Средняя6,9 | — | 1,8 % | 21 янв. 2026 г. |
25Наблюдать | CVE-2026-24055Proof of concept | Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linkinglangfuse · langfuse · CWE-284 | Средняя6,3 | — | 0,4 % | 22 янв. 2026 г. |
22Наблюдать | CVE-2026-24049Proof of concept | wheel Allows Arbitrary File Permission Modification via Path Traversalwheel project · wheel · CWE-22 | Средняя5,5 | — | 0,3 % | 22 янв. 2026 г. |
39Наблюдать | CVE-2026-0920Proof of concept | LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameterchoijun · la-studio element kit for elementor · CWE-269 | Критическая9,8 | — | 1,1 % | 22 янв. 2026 г. |
17Наблюдать | CVE-2026-24332Proof of concept | Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because discord · websocket api service · CWE-204 | Средняя4,3 | — | 0,2 % | 22 янв. 2026 г. |
96Срочно | CVE-2026-23760Готовый эксплойт | SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APIsmartertools · smartermail · CWE-288 | Критическая9,3 | KEV | 96,4 % | 22 янв. 2026 г. |
26Наблюдать | CVE-2025-69612Proof of concept | A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.tmsglobalsoft · tms management console · CWE-22 | Средняя6,5 | — | 1,0 % | 22 янв. 2026 г. |
29Наблюдать | CVE-2025-69821Proof of concept | An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connectibeatxp · vega smartwatch firmware · CWE-404 | Высокая7,4 | — | 0,4 % | 22 янв. 2026 г. |
29Наблюдать | CVE-2025-69822Proof of concept | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privatomberg · erica smart fan firmware · CWE-200 | Высокая7,4 | — | 0,3 % | 22 янв. 2026 г. |
39Наблюдать | CVE-2026-24009Proof of concept | Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usagedocling · docling-core · CWE-502 | Критическая9,8 | — | 1,5 % | 22 янв. 2026 г. |
30Наблюдать | CVE-2025-67221Proof of concept | The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.ijl · orjson · CWE-770 | Высокая7,5 | — | 0,6 % | 22 янв. 2026 г. |
28Наблюдать | CVE-2025-67923Proof of concept | WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetengine · CWE-79 | Высокая7,1 | — | 0,2 % | 22 янв. 2026 г. |
40В плане | CVE-2025-68001Proof of concept | WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerabilitygaridium · g-ffl checkout · CWE-434 | Критическая10,0 | — | 0,6 % | 22 янв. 2026 г. |
34Наблюдать | CVE-2025-68999Proof of concept | WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerabilityhappymonster · happy addons for elementor · CWE-89 | Высокая8,5 | — | 0,3 % | 22 янв. 2026 г. |
26Наблюдать | CVE-2025-70899Proof of concept | PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms.phpgurukul · online course registration · CWE-352 | Средняя6,5 | — | 0,1 % | 22 янв. 2026 г. |
39Наблюдать | CVE-2026-24306Proof of concept | Azure Front Door Elevation of Privilege Vulnerabilitymicrosoft · azure front door · CWE-284 | Критическая9,8 | — | 0,8 % | 22 янв. 2026 г. |
60На этой неделе | CVE-2026-0768Готовый эксплойт | Langflow code Code Injection Remote Code Execution Vulnerabilitylangflow · langflow · CWE-94 | Критическая9,8 | — | 23,0 % | 23 янв. 2026 г. |
60На этой неделе | CVE-2026-0769Готовый эксплойт | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerabilitylangflow · langflow · CWE-95 | Критическая9,8 | — | 41,2 % | 23 янв. 2026 г. |
88Срочно | CVE-2026-0770Готовый эксплойт | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerabilitylangflow · langflow · CWE-829 | Критическая9,8 | KEV | 62,5 % | 23 янв. 2026 г. |
29Наблюдать | CVE-2026-0776Proof of concept | Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerabilitydiscord · client · CWE-427 | Высокая7,3 | — | 0,3 % | 23 янв. 2026 г. |
35Наблюдать | CVE-2025-67847Эксплойта нет | Moodle: moodle: remote code execution via insufficient restore input validationmoodle · moodle · CWE-94 | Высокая8,8 | — | 0,5 % | 23 янв. 2026 г. |
33Наблюдать | CVE-2026-0603Proof of concept | Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionred hat · red hat jboss enterprise application platform 7.1 eus for rhel 7 · CWE-89 | Высокая8,3 | — | 1,0 % | 23 янв. 2026 г. |
32Наблюдать | CVE-2026-0994Proof of concept | Denial of Service in Python Protobufgoogle · protobuf · CWE-674 | Высокая8,2 | — | 0,7 % | 23 янв. 2026 г. |
26Наблюдать | CVE-2021-47881Proof of concept | dataSIMS Avionics ARINC 664-1 - Local Buffer Overflowdata device corporation · datasims avionics arinc · CWE-121 | Средняя6,7 | — | 0,2 % | 23 янв. 2026 г. |
51В плане | CVE-2022-25369Proof of concept | An issue was discovered in Dynamicweb before 9.12.8.CWE-287 | Критическая9,8 | — | 39,8 % | 23 янв. 2026 г. |
- CVE-2025-6669834Наблюдать
An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %semantic-machines · veda13 янв. 2026 г.
- CVE-2025-6415552В плане
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, For
КритическаяCVSS 9,8Proof of conceptEPSS 42 %fortinet · fortisiem13 янв. 2026 г.
- CVE-2026-2080554В плане
Desktop Window Manager Information Disclosure Vulnerability
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 7 %microsoft · windows 10 160713 янв. 2026 г.
- CVE-2026-2081733Наблюдать
Windows Error Reporting Service Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 5 %microsoft · windows 10 21h213 янв. 2026 г.
- CVE-2026-2082032Наблюдать
Windows Common Log File System Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 2 %microsoft · windows 10 160713 янв. 2026 г.
- CVE-2026-2083322Наблюдать
Windows Kerberos Information Disclosure Vulnerability
СредняяCVSS 5,5Proof of conceptEPSS 0 %microsoft · windows server 200813 янв. 2026 г.
- CVE-2026-2087232Наблюдать
NTLM Hash Disclosure Spoofing Vulnerability
СредняяCVSS 6,5Эксплойта нетEPSS 19 %microsoft · windows 10 160713 янв. 2026 г.
- CVE-2026-2092531Наблюдать
NTLM Hash Disclosure Spoofing Vulnerability
СредняяCVSS 6,5Эксплойта нетEPSS 17 %microsoft · windows 10 160713 янв. 2026 г.
- CVE-2026-2092940В плане
Windows HTTP.sys Elevation of Privilege Vulnerability
ВысокаяCVSS 7,5Готовый эксплойтEPSS 2 %microsoft · windows 10 160713 янв. 2026 г.
- CVE-2026-2094741В плане
Microsoft SharePoint Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %microsoft · sharepoint server13 янв. 2026 г.
- CVE-2026-2096378На этой неделе
Microsoft SharePoint Remote Code Execution Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 29 %microsoft · sharepoint server13 янв. 2026 г.
- CVE-2026-2286228Наблюдать
go-ethereum has a DoS via malicious p2p message
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %ethereum · go ethereum13 янв. 2026 г.
- CVE-2026-2286935Наблюдать
Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow
ВысокаяCVSS 8,9Proof of conceptEPSS 0 %eigent · eigent13 янв. 2026 г.
- CVE-2025-2524970На этой неделе
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.1
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 3 %fortinet · fortios13 янв. 2026 г.
- CVE-2020-3691141В плане
Covenant 0.5 - Remote Code Execution (RCE)
КритическаяCVSS 9,3Эксплойта нетEPSS 12 %cobbr · covenant13 янв. 2026 г.
- CVE-2026-2268640В плане
Sandbox Escape via Host Error Prototype Chain in enclave-vm
КритическаяCVSS 10,0Proof of conceptEPSS 0 %agentfront · enclave13 янв. 2026 г.
- CVE-2025-1450239Наблюдать
News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion
КритическаяCVSS 9,8Proof of conceptEPSS 1 %vaghasia3 · news and blog designer bundle14 янв. 2026 г.
- CVE-2026-059424Наблюдать
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
СредняяCVSS 6,1Proof of conceptEPSS 0 %mallsop · list site contributors14 янв. 2026 г.
- CVE-2026-071721Наблюдать
LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
СредняяCVSS 5,3Proof of conceptEPSS 0 %lottiefile · lottiefiles14 янв. 2026 г.
- CVE-2026-2355045В плане
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 21 %modular ds · modular ds14 янв. 2026 г.
- CVE-2025-6739918Наблюдать
An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the U
СредняяCVSS 4,6Proof of conceptEPSS 0 %airth · smart home aqi monitor bootloader14 янв. 2026 г.
- CVE-2026-2349828Наблюдать
Shopware Improper Control of Generation of Code in Twig rendered views
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %shopware · shopware14 янв. 2026 г.
- CVE-2026-089728Наблюдать
Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %keras · keras15 янв. 2026 г.
- CVE-2025-6451630Наблюдать
GLPI incorrectly authorizes access to documents
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %glpi-project · glpi15 янв. 2026 г.
- CVE-2025-6724629Наблюдать
A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %ludashi · ludashi driver15 янв. 2026 г.
- CVE-2025-6641739Наблюдать
GLPI has an unauthenticated SQL injection through the inventory endpoint
КритическаяCVSS 9,8Proof of conceptEPSS 0 %glpi-project · glpi15 янв. 2026 г.
- CVE-2025-3691131Наблюдать
In key-based pairing, there is a possible ID due to a logic error in the code.
ВысокаяCVSS 7,1Proof of conceptEPSS 8 %google · android15 янв. 2026 г.
- CVE-2025-6764733Наблюдать
SvelteKit Denial of service and possible SSRF when using prerendering
ВысокаяCVSS 8,4Эксплойта нетEPSS 0 %svelte · adapter-node15 янв. 2026 г.
- CVE-2026-2352033Наблюдать
Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE
ВысокаяCVSS 8,0Proof of conceptEPSS 1 %arcane · arcane15 янв. 2026 г.
- CVE-2026-091530Наблюдать
getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %gnu · glibc15 янв. 2026 г.
- CVE-2026-101021Наблюдать
Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
СредняяCVSS 5,4Proof of conceptEPSS 0 %altium · on-prem enterprise server15 янв. 2026 г.
- CVE-2021-4779535Наблюдать
GeoVision Geowebserver 5.3.3 - Local FIle Inclusion
ВысокаяCVSS 8,7Proof of conceptEPSS 2 %geovision · geovision geowebserver15 янв. 2026 г.
- CVE-2025-6002147В плане
Apache bRPC: Remote command injection vulnerability in heap builtin service
КритическаяCVSS 9,8Proof of conceptEPSS 25 %apache · brpc16 янв. 2026 г.
- CVE-2025-6892131Наблюдать
SteelSeries Nahimic 3 1.10.7 allows Directory traversal.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %steelseries · nahimic16 янв. 2026 г.
- CVE-2025-2994318Наблюдать
Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially
СредняяCVSS 4,6Proof of conceptEPSS 0 %amd · amd epyc™ 9004 series processors16 янв. 2026 г.
- CVE-2025-6958122Наблюдать
An issue was discovered in Chamillo LMS 1.11.2.
СредняяCVSS 5,5Proof of conceptEPSS 0 %chamilo · chamilo lms16 янв. 2026 г.
- CVE-2026-2372328Наблюдать
WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %wegia · wegia16 янв. 2026 г.
- CVE-2026-2374460На этой неделе
REC in MCPJam inspector due to HTTP Endpoint exposes
КритическаяCVSS 9,8Готовый эксплойтEPSS 67 %mcpjam · inspector16 янв. 2026 г.
- CVE-2026-2374532Наблюдать
node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %isaacs · tar16 янв. 2026 г.
- CVE-2025-1540339Наблюдать
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
КритическаяCVSS 9,8Proof of conceptEPSS 1 %metagauss · registrationmagic – custom registration forms, user registration, payment, and user login16 янв. 2026 г.
- CVE-2026-11118Наблюдать
Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal
НизкаяCVSS 2,0Proof of conceptEPSS 0 %publiccms · publiccms18 янв. 2026 г.
- CVE-2026-112222Наблюдать
Yonyou KSOA HTTP GET Parameter work_info.jsp sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %yonyou · ksoa18 янв. 2026 г.
- CVE-2026-112527Наблюдать
D-Link DIR-823X set_wifidog_settings sub_412E7C command injection
СредняяCVSS 5,5Эксплойта нетEPSS 15 %dlink · dir-823x firmware18 янв. 2026 г.
- CVE-2026-2382921Наблюдать
Mailpit has SMTP Header Injection via Regex Bypass
СредняяCVSS 5,3Proof of conceptEPSS 1 %axllent · mailpit18 янв. 2026 г.
- CVE-2025-6861630Наблюдать
WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %kozea · weasyprint19 янв. 2026 г.
- CVE-2026-2384230Наблюдать
ChatterBot has Denial of Service via Database Connection Pool Exhaustion
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %chatterbot · chatterbot19 янв. 2026 г.
- CVE-2026-2388539Наблюдать
AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper
КритическаяCVSS 9,9Proof of conceptEPSS 0 %alchemy-cms · alchemy cms19 янв. 2026 г.
- CVE-2026-2394737Наблюдать
Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation
КритическаяCVSS 9,3Proof of conceptEPSS 0 %orval · orval19 янв. 2026 г.
- CVE-2026-090539Наблюдать
Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to pote
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %google · chrome20 янв. 2026 г.
- CVE-2026-2284443В плане
Zoom Node Deployments - Command Injection
КритическаяCVSS 9,9Эксплойта нетEPSS 13 %zoom communications inc. · zoom node20 янв. 2026 г.
- CVE-2025-6408739Наблюдать
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers
КритическаяCVSS 9,8Proof of conceptEPSS 0 %opensagres · xdocreport20 янв. 2026 г.
- CVE-2025-6548239Наблюдать
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadin
КритическаяCVSS 9,8Proof of conceptEPSS 0 %opensagres · xdocreport20 янв. 2026 г.
- CVE-2025-5542340В плане
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to
КритическаяCVSS 9,8Proof of conceptEPSS 3 %iptime · n104s-r1 firmware20 янв. 2026 г.
- CVE-2025-6726126Наблюдать
Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection.
СредняяCVSS 6,5Proof of conceptEPSS 0 %abacre · retail point of sale20 янв. 2026 г.
- CVE-2025-6726324Наблюдать
Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module.
СредняяCVSS 6,1Proof of conceptEPSS 0 %abacre · retail point of sale20 янв. 2026 г.
- CVE-2025-5600545В плане
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` paramet
КритическаяCVSS 9,8Proof of conceptEPSS 18 %dabeaz · ply20 янв. 2026 г.
- CVE-2026-062226Наблюдать
Open 5GS WebUI uses a hard-coded JWT signing key
СредняяCVSS 6,5Proof of conceptEPSS 0 %open5gs · open5gs20 янв. 2026 г.
- CVE-2025-5513037Наблюдать
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativ
КритическаяCVSS 9,1Proof of conceptEPSS 1 %nodejs · node.js20 янв. 2026 г.
- CVE-2026-2163640В плане
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabl
КритическаяCVSS 10,0Proof of conceptEPSS 0 %nodejs · node.js20 янв. 2026 г.
- CVE-2026-2195532Наблюдать
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %oracle · vm virtualbox20 янв. 2026 г.
- CVE-2026-2196292Срочно
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Serve
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 73 %oracle · http server20 янв. 2026 г.
- CVE-2026-2197826Наблюдать
Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing).
СредняяCVSS 6,5Proof of conceptEPSS 0 %oracle · flexcube universal banking20 янв. 2026 г.
- CVE-2026-2198628Наблюдать
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %oracle · vm virtualbox20 янв. 2026 г.
- CVE-2025-1552139Наблюдать
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
КритическаяCVSS 9,8Proof of conceptEPSS 0 %kodezen · academy lms – wordpress lms plugin for complete elearning solution20 янв. 2026 г.
- CVE-2026-2406199Срочно
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %gnu · inetutils21 янв. 2026 г.
- CVE-2026-2244428Наблюдать
Apache Solr: Insufficient file-access checking in standalone core-creation requests
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %apache · solr21 янв. 2026 г.
- CVE-2026-2004570На этой неделе
Cisco Unified Communications Products Remote Code Execution Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 4 %cisco · unified communications manager21 янв. 2026 г.
- CVE-2026-083428Наблюдать
Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %tp-link · archer ax53 firmware21 янв. 2026 г.
- CVE-2025-6813733Наблюдать
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
ВысокаяCVSS 8,3Proof of conceptEPSS 1 %linuxfoundation · everest21 янв. 2026 г.
- CVE-2026-2185229Наблюдать
Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation
СредняяCVSS 5,3Proof of conceptEPSS 27 %anthropic · claude code21 янв. 2026 г.
- CVE-2026-2280739Наблюдать
vLLM affected by RCE via auto_map dynamic module loading during model initialization
КритическаяCVSS 9,8Proof of conceptEPSS 0 %vllm · vllm21 янв. 2026 г.
- CVE-2026-2284928Наблюдать
Saleor lacks proper HTML sanitization in rich text fields
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %saleor · saleor21 янв. 2026 г.
- CVE-2026-2349934Наблюдать
Saleor vulnerable to stored XSS via Unrestricted File Upload
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %saleor · saleor21 янв. 2026 г.
- CVE-2026-2352439Наблюдать
Laravel Redis Horizontal Scaling Insecure Deserialization
КритическаяCVSS 9,8Proof of conceptEPSS 0 %laravel · reverb21 янв. 2026 г.
- CVE-2026-2404628Наблюдать
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %backstage · backstage21 янв. 2026 г.
- CVE-2025-1346528Наблюдать
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
СредняяCVSS 6,9Proof of conceptEPSS 1 %lodash · lodash21 янв. 2026 г.
- CVE-2026-2405525Наблюдать
Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking
СредняяCVSS 6,3Proof of conceptEPSS 0 %langfuse · langfuse22 янв. 2026 г.
- CVE-2026-2404922Наблюдать
wheel Allows Arbitrary File Permission Modification via Path Traversal
СредняяCVSS 5,5Proof of conceptEPSS 0 %wheel project · wheel22 янв. 2026 г.
- CVE-2026-092039Наблюдать
LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
КритическаяCVSS 9,8Proof of conceptEPSS 1 %choijun · la-studio element kit for elementor22 янв. 2026 г.
- CVE-2026-2433217Наблюдать
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because
СредняяCVSS 4,3Proof of conceptEPSS 0 %discord · websocket api service22 янв. 2026 г.
- CVE-2026-2376096Срочно
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 96 %smartertools · smartermail22 янв. 2026 г.
- CVE-2025-6961226Наблюдать
A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.
СредняяCVSS 6,5Proof of conceptEPSS 1 %tmsglobalsoft · tms management console22 янв. 2026 г.
- CVE-2025-6982129Наблюдать
An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connecti
ВысокаяCVSS 7,4Proof of conceptEPSS 0 %beatxp · vega smartwatch firmware22 янв. 2026 г.
- CVE-2025-6982229Наблюдать
An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate priv
ВысокаяCVSS 7,4Proof of conceptEPSS 0 %atomberg · erica smart fan firmware22 янв. 2026 г.
- CVE-2026-2400939Наблюдать
Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage
КритическаяCVSS 9,8Proof of conceptEPSS 1 %docling · docling-core22 янв. 2026 г.
- CVE-2025-6722130Наблюдать
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %ijl · orjson22 янв. 2026 г.
- CVE-2025-6792328Наблюдать
WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %crocoblock · jetengine22 янв. 2026 г.
- CVE-2025-6800140В плане
WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 0 %garidium · g-ffl checkout22 янв. 2026 г.
- CVE-2025-6899934Наблюдать
WordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %happymonster · happy addons for elementor22 янв. 2026 г.
- CVE-2025-7089926Наблюдать
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms.
СредняяCVSS 6,5Proof of conceptEPSS 0 %phpgurukul · online course registration22 янв. 2026 г.
- CVE-2026-2430639Наблюдать
Azure Front Door Elevation of Privilege Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %microsoft · azure front door22 янв. 2026 г.
- CVE-2026-076860На этой неделе
Langflow code Code Injection Remote Code Execution Vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 23 %langflow · langflow23 янв. 2026 г.
- CVE-2026-076960На этой неделе
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 41 %langflow · langflow23 янв. 2026 г.
- CVE-2026-077088Срочно
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 62 %langflow · langflow23 янв. 2026 г.
- CVE-2026-077629Наблюдать
Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %discord · client23 янв. 2026 г.
- CVE-2025-6784735Наблюдать
Moodle: moodle: remote code execution via insufficient restore input validation
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %moodle · moodle23 янв. 2026 г.
- CVE-2026-060333Наблюдать
Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
ВысокаяCVSS 8,3Proof of conceptEPSS 1 %red hat · red hat jboss enterprise application platform 7.1 eus for rhel 723 янв. 2026 г.
- CVE-2026-099432Наблюдать
Denial of Service in Python Protobuf
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %google · protobuf23 янв. 2026 г.
- CVE-2021-4788126Наблюдать
dataSIMS Avionics ARINC 664-1 - Local Buffer Overflow
СредняяCVSS 6,7Proof of conceptEPSS 0 %data device corporation · datasims avionics arinc23 янв. 2026 г.
- CVE-2022-2536951В плане
An issue was discovered in Dynamicweb before 9.12.8.
КритическаяCVSS 9,8Proof of conceptEPSS 39 %23 янв. 2026 г.