CVEs published January 29, 2026
77,396 CVEs in 2026
When a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs.
A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts.
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
An API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features.
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing.
deepHas provides a test for the existence of a nested object key and optionally returns that key.
A Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any role, including Admin, Creator, or App Viewer, and assign them to any group…
AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag.
A vulnerability was identified in Tenda AC21 16.03.08.16.
An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution.
Missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`.
A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn.
gradle-completion provides Bash and Zsh completion support for Gradle.
The `ig` binary provides a subcommand for image building, used to generate custom gadget OCI images.
An unauthenticated Path Traversal vulnerability in the `UserConfigController` allows any remote user to overwrite the system's `docker-compose.yml` configuration file.
Wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element.
The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters.
A vulnerability was detected in itsourcecode Society Management System 1.0.
A security vulnerability has been detected in itsourcecode Society Management System 1.0.
A weakness has been identified in itsourcecode Society Management System 1.0.
A vulnerability was identified in itsourcecode School Management System 1.0.
A vulnerability was determined in itsourcecode School Management System 1.0.
API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system.
The vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation.
SSRF protection for `allow_private_network_connections = false` was only applied in the `TcpDestination::HostName(peer)` path.
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction.
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA.
It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms.
A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network…
An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows a remote attacker to leak stack…
An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network…
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with,…
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause the…
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause normally…
A vulnerability was detected in D-Link DWR-M961 1.1.47.
A security vulnerability has been detected in D-Link DWR-M961 1.1.47.
A weakness has been identified in Totolink A7000R 4.1cu.4154.
A weakness has been identified in Totolink A7000R 4.1cu.4154.
A vulnerability has been found in Bdtask SalesERP up to 20260116.
A flaw has been found in D-Link DWR-M961 1.1.47.
A security vulnerability has been detected in SEMCMS 5.0.
A weakness has been identified in itsourcecode School Management System 1.0.
Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local…
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA.
The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments.
2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows.
An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network…
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below.
Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager.
SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint.
`TlsListener::listen()` peeks 1024 bytes and calls `extract_client_random(...)`.
A vulnerability has been found in Open5GS up to 2.7.6.
A flaw has been found in Open5GS up to 2.7.5.
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed…
alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder.
Dell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability.
A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116.
A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116.
A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116.
The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync() as shell command strings.
A vulnerability was found in jishenghua jshERP up to 3.6.