Vulnerebility JANUARY
H
ECV
KB
KEV
|
2026()
2025()
|
Vulnerebility Calendar
Top Vulnerebility
List of Attack
CWE
Anti-Debug
Tricks
2026 January February March April May June July August September October November December
|
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
| 30.1.26 | CVE-2026-24423 | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2026-1340 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2026-1281 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2025-40553 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2025-40554 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2025-40536 | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2025-40551 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2025-40537 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions. | VULNEREBILITY | VULNEREBILITY |
| 30.1.26 | CVE-2025-40552 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication. | VULNEREBILITY | VULNEREBILITY |
| 28.1.26 | CVE-2026-22709 |
In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch
callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. |
VULNEREBILITY | VULNEREBILITY |
| 28.1.26 | CVE-2026-1470 | (CVSS score: 9.9) - An eval injection vulnerability that could allow an authenticated user to bypass the Expression sandbox mechanism and achieve full remote code execution on n8n's main node by passing specially crafted JavaScript code | VULNEREBILITY | VULNEREBILITY |
| 28.1.26 | CVE-2026-0863 | (CVSS score: 8.5) - An eval injection vulnerability that could allow an authenticated user to bypass n8n's python-task-executor sandbox restrictions and run arbitrary Python code on the underlying operating system | VULNEREBILITY | VULNEREBILITY |
| 28.1.26 | CVE-2026-24858 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 | VULNEREBILITY | VULNEREBILITY |
| 28.1.26 | Cellbreak | Cellbreak: Grist’s Pyodide Sandbox Escape and the Data-at-Risk Blast Radius | VULNEREBILITY | VULNEREBILITY |
| 28.1.26 | CVE-2026-24002 | Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. | VULNEREBILITY | VULNEREBILITY |
| 27.1.26 | CVE-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | VULNEREBILITY | VULNEREBILITY |
| 27.1.26 | CVE-2025-69264 | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". | VULNEREBILITY | VULNEREBILITY |
| 27.1.26 | CVE-2025-69263 | pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. | VULNEREBILITY | VULNEREBILITY |
| 25.1.26 | HOUKEN | SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS | VULNEREBILITY | VULNEREBILITY |
| 25.1.26 | CVE-2023-27997 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 | VULNEREBILITY | VULNEREBILITY |
| 25.1.26 | CVE-2022-42475 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. | VULNEREBILITY | VULNEREBILITY |
| 24.1.26 | CVE-2024-37079 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. | VULNEREBILITY | VULNEREBILITY |
| 24.1.26 | CVE-2025-54313 | (CVSS score: 7.5) - An embedded malicious code vulnerability in eslint-config-prettier that could allow for execution of a malicious DLL dubbed Scavenger Loader that's designed to deliver an information stealer | VULNEREBILITY | VULNEREBILITY |
| 24.1.26 | CVE-2025-31125 | (CVSS score: 5.3) - An improper access control vulnerability in Vite Vitejs that could allow contents of arbitrary files to be returned to the browser using ?inline&import or ?raw?import (Fixed in March 2025 with versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11) | VULNEREBILITY | VULNEREBILITY |
| 24.1.26 | CVE-2025-34026 | (CVSS score: 9.2) - An authentication bypass in the Versa Concerto SD-WAN orchestration platform that could allow an attacker to access administrative endpoints (Fixed in April 2025 with version 12.2.1 GA) | VULNEREBILITY | VULNEREBILITY |
| 24.1.26 | CVE-2025-68645 | (CVSS score: 8.8) - A PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that could allow a remote attacker to craft requests to the "/h/rest" endpoint and allow inclusion of arbitrary files from the WebRoot directory without any authentication (Fixed in November 2025 with version 10.1.13) | VULNEREBILITY | VULNEREBILITY |
| 23.1.26 | CVE-2025-59719 | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message. | VULNEREBILITY | VULNEREBILITY |
| 23.1.26 | CVE-2025-59718 | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 | VULNEREBILITY | VULNEREBILITY |
| 23.1.26 | CVE-2026-24061 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | VULNEREBILITY | VULNEREBILITY |
| 22.1.26 | CVE-2026-20045 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & | VULNEREBILITY | VULNEREBILITY |
| 22.1.26 | CVE-2026-22844 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access. | VULNEREBILITY | VULNEREBILITY |
| 21.1.26 | ChainLeak | ChainLeak: Critical AI framework vulnerabilities expose data, enable cloud takeover | VULNEREBILITY | AI |
| 21.1.26 | CVE-2026-1245 | A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. | VULNEREBILITY | VULNEREBILITY |
| 19.1.26 | CVE-2025-29943 | Improper access control within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline, potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest. | VULNEREBILITY | VULNEREBILITY |
| 18.1.26 | CVE-2025-6965 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. | VULNEREBILITY | VULNEREBILITY |
| 18.1.26 | CVE-2025-36911 | In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation. | VULNEREBILITY | VULNEREBILITY |
| 17.1.26 | CVE-2025-22226 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process. | VULNEREBILITY | VULNEREBILITY |
| 17.1.26 | CVE-2025-22225 | VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. | VULNEREBILITY | VULNEREBILITY |
| 17.1.26 | CVE-2025-22224 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. | VULNEREBILITY | VULNEREBILITY |
| 17.1.26 | CVE-2025-68428 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. | VULNEREBILITY | VULNEREBILITY |
| 17.1.26 | CVE-2026-0625 | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality | VULNEREBILITY | VULNEREBILITY |
| 16.1.26 | CVE-2025-20393 | Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager | VULNEREBILITY | VULNEREBILITY |
| 16.1.26 | CodeBreach | CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild | VULNEREBILITY | VULNEREBILITY |
| 16.1.26 | CVE-2026-23550 | Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1. | VULNEREBILITY | VULNEREBILITY |
| 16.1.26 | CVE-2026-0227 | PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal | VULNEREBILITY | VULNEREBILITY |
| 14.1.26 | CVE-2025-12420 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. | VULNEREBILITY | VULNEREBILITY |
| 14.1.26 | CVE-2025-8110 | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | VULNEREBILITY | VULNEREBILITY |
| 14.1.26 | CVE-2025-64155 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests. | VULNEREBILITY | VULNEREBILITY |
| 10.1.26 | CVE-2025-69258 | A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations. | VULNEREBILITY | VULNEREBILITY |
| 10.1.26 | CVE-2025-69260 | (CVSS score: 7.5) - A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote, unauthenticated attacker to create a denial-of-service condition on affected installations | VULNEREBILITY | VULNEREBILITY |
| 10.1.26 | CVE-2025-69259 | (CVSS score: 7.5) - A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote, unauthenticated attacker to create a denial-of-service condition on affected installations | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-66209 | (CVSS score: 10.0) - A command injection vulnerability in the database backup functionality allows any authenticated user with database backup permissions to execute arbitrary commands on the host server, resulting in container escape and full server compromise | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-66210 | (CVSS score: 10.0) - An authenticated command injection vulnerability in the database import functionality allows attackers to execute arbitrary commands on managed servers, leading to full infrastructure compromise | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-66211 | (CVSS score: 10.0) - A command injection vulnerability in the PostgreSQL init script management allows authenticated users with database permissions to execute arbitrary commands as root on the server | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-66212 | (CVSS score: 10.0) - An authenticated command injection vulnerability in the Dynamic Proxy Configuration functionality allows users with server management permissions to execute arbitrary commands as root on managed servers | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-66213 | (CVSS score: 10.0) - An authenticated command injection vulnerability in the File Storage Directory Mount functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-64419 | (CVSS score: 9.7) - A command injection vulnerability via docker-compose.yaml that enables attackers to execute arbitrary system commands as root on the Coolify instance | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-64420 | (CVSS score: 10.0) - An information disclosure vulnerability that allows low-privileged users to view the private key of the root user on the Coolify instance, allowing them to gain unauthorized access to the server via SSH and authenticate as the root user using the key | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-64424 | (CVSS score: 9.4) - A command injection vulnerability was found in the git source input fields of a resource, allowing a low-privileged user (member) to execute system commands as root on the Coolify instance | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-59156 | (CVSS score: 9.4) - An operating system command injection vulnerability that allows a low-privileged user to inject arbitrary Docker Compose directives and achieve root-level command execution on the underlying host | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-59157 | (CVSS score: 10.0) - An operating system command injection vulnerability that allows a regular user to inject arbitrary shell commands that execute on the underlying server by using the Git Repository field during deployment | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-59158 | (CVSS score: 9.4) - An improper encoding or escaping of the data that allows an authenticated user with low privileges to conduct a stored cross-site scripting (XSS) attack during project creation that's automatically executed in the browser context when an administrator later attempts to delete the project or its associated resource | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | RedLeaves | VULNEREBILITY | VULNEREBILITY | |
| 8.1.26 | CVE-2026-20029 | A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information. This vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-37164 | (CVSS score: 10.0) - A code injection vulnerability in HPW OneView that allows a remote unauthenticated user to perform remote code execution | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2009-0556 | (CVSS score: 8.8) - A code injection vulnerability in Microsoft Office PowerPoint that allows remote attackers to execute arbitrary code by means of memory corruption | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2026-21858 | A vulnerability in n8n allows an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker. | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2026-21877 | Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n service. This could result in full compromise of the affected instance. | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-59469 | (CVSS score: 7.2) - A vulnerability that allows a Backup or Tape Operator to write files as root | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-59468 | (CVSS score: 6.7) - A vulnerability that allows a Backup Administrator to perform RCE as the postgres user by sending a malicious password parameter | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-55125 | (CVSS score: 7.2) - A vulnerability that allows a Backup or Tape Operator to perform RCE as root by creating a malicious backup configuration file | VULNEREBILITY | VULNEREBILITY |
| 8.1.26 | CVE-2025-59470 | Resolved in Veeam Backup & Replication 13.0.1.1071 | VULNEREBILITY | VULNEREBILITY |
| 7.1.26 | CVE-2026-0625 | Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. | VULNEREBILITY | VULNEREBILITY |
| 7.1.26 | CVE-2025-65606 | TOTOLINK EX200 firmware-upload error handling can activate an unauthenticated root telnet service | VULNEREBILITY | VULNEREBILITY |
| 7.1.26 | CVE-2025-68668 | n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide | VULNEREBILITY | VULNEREBILITY |
| 3.1.26 | CVE-2020-12812 | An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. | VULNEREBILITY | VULNEREBILITY |
| 2.1.26 | CVE-2025-59230 | An elevation-of-privilege (EoP) vulnerability in Windows’ Remote Access Connection Manager (RasMan) service. A locally authenticated attacker could exploit improper access control to escalate their privileges to SYSTEM level on affected Windows installations. | VULNEREBILITY | VULNEREBILITY |
| 2.1.26 | CVE-2025-10294 | A critical authentication bypass in the OwnID Passwordless Login plugin for WordPress. Due to improper validation of a shared secret, unauthenticated attackers could log in as arbitrary users, including administrators, without credentials. | VULNEREBILITY | VULNEREBILITY |
| 2.1.26 | CVE-2025-59295 | A heap-based buffer overflow in the Windows MSHTML/Internet Explorer component, enabling arbitrary code execution via specially crafted data sent over the network. | VULNEREBILITY | VULNEREBILITY |
| 2.1.26 | CVE-2025-14847 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions | VULNEREBILITY | VULNEREBILITY |