Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-1340 Exploited Public exploit Scanner template EPSS 99%

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    ivanti Endpoint Manager Mobile Network devices
    KEV Apr 8, 2026
  • Critical 9.8
    CVE-2026-1281 Exploited Public exploit Scanner template EPSS 99%

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    ivanti Endpoint Manager Mobile Network devices
    KEV Jan 29, 2026
  • Critical 9.8
    CVE-2025-40551 Exploited Public exploit Scanner template EPSS 84%

    SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

    SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

    SolarWinds Web Help Desk
    KEV Feb 3, 2026
  • High 8.1
    CVE-2025-40536 Exploited Public exploit Scanner template EPSS 74%

    SolarWinds Web Help Desk Security Control Bypass Vulnerability

    SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

    SolarWinds Web Help Desk
    KEV Feb 12, 2026
  • Critical 9.4
    CVE-2026-24858 Exploited Public exploit EPSS 87%

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnal…

    Fortinet FortiOS FortiManager FortiProxy Network devices
    KEV Jan 27, 2026
  • High 7.8
    CVE-2026-21509 Exploited Public exploit EPSS 71%

    Microsoft Office Security Feature Bypass Vulnerability

    Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC 2024
    KEV Jan 26, 2026
  • Critical 9.3
    CVE-2026-24423 Exploited · Ransomware Public exploit Scanner template EPSS 88%

    SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. …

    SmarterTools SmarterMail
    KEV Feb 5, 2026
  • Critical 9.8
    CVE-2026-0770 Exploited Public exploit Scanner template EPSS 63%

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to e…

    Langflow Langflow langflow PyPI
    KEV Jul 21, 2026
  • Critical 9.3
    CVE-2026-23760 Exploited · Ransomware Public exploit Scanner template EPSS 96%

    SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

    SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resett…

    SmarterTools SmarterMail
    KEV Jan 26, 2026
  • High 8.2
    CVE-2026-20045 Exploited Public exploit

    Cisco Unified Communications Products Remote Code Execution Vulnerability

    A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unity Connectio…

    Cisco Cisco Unified Communications Manager Cisco Unity Connection Cisco Unified Communications Manager IM and Presence Service Network devices
    KEV Jan 21, 2026
  • Critical 9.8
    CVE-2026-24061 Exploited Public exploit EPSS 99%

    telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment…

    GNU Inetutils inetutils inetutils Debian Ubuntu Alpine
    KEV Jan 26, 2026
  • Critical 10.0
    CVE-2026-21962 Exploited Public exploit EPSS 73%

    Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (comp…

    Oracle Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
    KEV Aug 24, 2026
  • Medium 5.5
    CVE-2026-20805 Exploited Public exploit

    Desktop Window Manager Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 13, 2026