CVEs published January 7, 2026
77,396 CVEs in 2026
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input.
An authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property…
A reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of a victim's browser session by crafting a malicious…
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware.
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces.
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board…
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged…
An attacker with a network connection could detect credentials in clear text.
The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions
Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier.
The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces.
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function.
A race condition vulnerability exists in the shared HTTP client configuration.
Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing.
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability.
When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS…
A flaw has been found in projectworlds House Rental and Property Listing 1.0.
A time based blind SQL injection vulnerability in the webhook edit and scanner api endpoints that allow an authenticated attacker to execute arbitrary SQL queries against the MySQL database.
Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF).
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
The credentials required to access the device's web server are sent in base64 within the HTTP headers.
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This…
Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.
Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak…
The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles.
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
A Path Traversal (Zip Slip) vulnerability exists in MONAI's `_download_from_ngc_private()` function.
Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive…
Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects MediaWiki - VisualData…
A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative…
A security vulnerability has been detected in invoiceninja up to 5.12.38.
OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load.
A vulnerability was detected in projectworlds House Rental and Property Listing 1.0.