Week 5, 2026

26 January – 1 February 2026

New CVEs: 844
Critical: 114
High: 315
Newly exploited: 9
Advisories: 449
Malicious pkgs: 113

Newly exploited 9

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2026-1340 KEV Apr 8, 2026 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
ivanti · Endpoint Manager Mobile

EPSS 99%
Critical 9.8
CVE-2026-1281 KEV Jan 29, 2026 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
ivanti · Endpoint Manager Mobile

EPSS 99%
Critical 9.4
CVE-2026-24858 KEV Jan 27, 2026 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer …
Fortinet · FortiOS · FortiProxy · FortiManager

EPSS 87%
Critical 9.1
CVE-2025-59719 ENISA Jan 27, 2026 An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may al…
Fortinet · FortiWeb

EPSS 29%
Critical 10.0
CVE-2025-52691 KEV Jan 26, 2026 · ransomware Upload Arbitrary Files
SmarterTools · SmarterMail

EPSS 86%
Critical 9.8
CVE-2026-24061 KEV Jan 26, 2026 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
GNU · Inetutils

EPSS 99%
Critical 9.3
CVE-2026-23760 KEV Jan 26, 2026 · ransomware SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
SmarterTools · SmarterMail

EPSS 96%
High 7.8
CVE-2026-21509 KEV Jan 26, 2026 Microsoft Office Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office 2019

EPSS 71%
High 7.8
CVE-2018-14634 KEV Jan 26, 2026 An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged)…
The Linux Foundation · Kernel

EPSS 15%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2026-1281 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
ivanti · Endpoint Manager Mobile

EPSS 99%
Critical 9.8
CVE-2026-1340 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
ivanti · Endpoint Manager Mobile

EPSS 99%
Critical 9.4
CVE-2026-24858 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer …
Fortinet · FortiOS · FortiProxy · FortiManager

EPSS 87%
Critical 9.8
CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds · Web Help Desk

EPSS 84%
Critical 9.8
CVE-2025-40553 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds · Web Help Desk

EPSS 68%
Critical 9.8
CVE-2025-40554 SolarWinds Web Help Desk Authentication Bypass Vulnerability
SolarWinds · Web Help Desk

EPSS 61%
Critical 9.8
CVE-2025-40552 SolarWinds Web Help Desk Authentication Bypass Vulnerability
SolarWinds · Web Help Desk

EPSS 52%
Critical 9.9
CVE-2026-1470 Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.
EPSS 20%
Critical 9.8
CVE-2026-1056 Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal
inc2734 · Snow Monkey Forms

EPSS 13%
Critical 9.8
CVE-2020-36962 Tendenci 12.3.1 - CSV/ Formula Injection
tendenci · tendenci

EPSS 12%
Critical 9.3
CVE-2026-24479 HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE
zhblue · hustoj

EPSS 8.1%
Critical 9.2
CVE-2025-24293 Active Storage allowed transformation methods that were potentially unsafe
rails · activestorage

EPSS 5.6%
Critical 9.9
CVE-2016-15057 Apache Continuum: Command injection leading to RCE
Apache Software Foundation · Apache Continuum

EPSS 3.9%
Critical 10.0
CVE-2026-24897 Authenticated Remote Code Execution via Arbitrary File Upload
ErugoOSS · Erugo

EPSS 3.3%
Critical 9.9
CVE-2026-24841 Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint
Dokploy · dokploy

EPSS 2.8%

All 114 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.8
CVE-2025-15467 Stack buffer overflow in CMS (Auth)EnvelopedData parsing
OpenSSL · OpenSSL

EPSS 75%
High 8.1
CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds · Web Help Desk

EPSS 74%
High 7.8
CVE-2026-21509 Microsoft Office Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office 2019

EPSS 71%
High 8.8
CVE-2026-25253 OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
OpenClaw · OpenClaw

EPSS 32%
Medium 4.7
CVE-2026-1419 D-Link DCS700l Web Form setDayNightMode command injection
D-Link · DCS700l

EPSS 17%
High 7.5
CVE-2025-63655 A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (Do…
EPSS 8.6%
High 8.5
CVE-2026-1457 Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385
TP-Link Systems · VIGI C485 V1

EPSS 7.6%
High 7.2
CVE-2026-1448 D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection
D-Link · DIR-615

EPSS 5.8%

Advisories

SUSE-SU-2026:0315-1 Security update for the Linux Kernel 395 CVEs
SUSE-SU-2026:0317-1 Security update for the Linux Kernel 392 CVEs
SUSE-SU-2026:0293-1 Security update for the Linux Kernel 334 CVEs
SUSE-SU-2026:0316-1 Security update for the Linux Kernel 143 CVEs
SUSE-SU-2026:0350-1 Security update for the Linux Kernel 68 CVEs
ICSA-26-043-06 Siemens SINEC OS 51 CVEs
SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 51 CVEs
SUSE-SU-2026:0298-1 Security update for go1.25-openssl 22 CVEs
SUSE-SU-2026:0297-1 Security update for go1.25-openssl 22 CVEs
SUSE-SU-2026:0308-1 Security update for go1.24-openssl 18 CVEs