CVEs published in January 2026

CVE-2026-20860High

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-20859High

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

CVE-2026-20858High

Windows Management Services Elevation of Privilege Vulnerability

CVE-2026-20857High

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2026-20856High

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

CVE-2026-20852High

Windows Hello Tampering Vulnerability

CVE-2026-20851Medium

Capability Access Management Service (camsvc) Information Disclosure Vulnerability

CVE-2026-20847Medium

Microsoft Windows File Explorer Spoofing Vulnerability

CVE-2026-20844High

Windows Clipboard Server Elevation of Privilege Vulnerability

CVE-2026-20842High

Microsoft DWM Core Library Elevation of Privilege Vulnerability

CVE-2026-20840High

Windows NTFS Remote Code Execution Vulnerability

CVE-2026-20839Medium

Windows Client-Side Caching (CSC) Service Information Disclosure Vulnerability

CVE-2026-20838Medium

Windows Kernel Information Disclosure Vulnerability

CVE-2026-20837High

Windows Media Remote Code Execution Vulnerability

CVE-2026-20836High

DirectX Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-20835Medium

Capability Access Management Service (camsvc) Information Disclosure Vulnerability

CVE-2026-20834Medium

Windows Spoofing Vulnerability

CVE-2026-20833Medium

Windows Kerberos Information Disclosure Vulnerability

CVE-2026-20832High

Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability

CVE-2026-20831High

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-20829Medium

TPM Trustlet Information Disclosure Vulnerability

CVE-2026-20828Medium

Windows rndismp6.sys Information Disclosure Vulnerability

CVE-2026-20827Medium

Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability

CVE-2026-20826High

Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability

CVE-2026-20825Medium

Windows Hyper-V Information Disclosure Vulnerability

CVE-2026-20824Medium

Windows Remote Assistance Security Feature Bypass Vulnerability

CVE-2026-20823Medium

Windows File Explorer Information Disclosure Vulnerability

CVE-2026-20822High

Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2026-20821Medium

Remote Procedure Call Information Disclosure Vulnerability

CVE-2026-20820High

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2026-20818Medium

Windows Kernel Information Disclosure Vulnerability

CVE-2026-20817High

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2026-20816High

Windows Installer Elevation of Privilege Vulnerability

CVE-2026-20815High

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

CVE-2026-20814High

DirectX Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-20812Medium

LDAP Tampering Vulnerability

CVE-2026-20811High

Win32k Elevation of Privilege Vulnerability

CVE-2026-20810High

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-20809High

Windows Kernel Memory Elevation of Privilege Vulnerability

CVE-2026-20808High

Windows File Explorer Elevation of Privilege Vulnerability

CVE-2026-20805MediumCISA KEV

Microsoft Windows Information Disclosure Vulnerability

CVE-2026-20804High

Windows Hello Tampering Vulnerability

CVE-2026-20803High

Microsoft SQL Server Elevation of Privilege Vulnerability

CVE-2026-0386High

Windows Deployment Services Remote Code Execution Vulnerability

CVE-2026-21265Medium

Secure Boot Certificate Expiration Security Feature Bypass Vulnerability

CVE-2026-20962Medium

Dynamic Root of Trust for Measurement (DRTM) Information Disclosure Vulnerability

CVE-2025-67685Low

Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4…

CVE-2025-64155Critical

FortiSIEM: improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…

CVE-2025-59922High

FortiClient: improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in…

CVE-2025-58693Medium

improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0…

CVE-2025-47855Critical

exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1…

CVE-2025-25249HighCISA KEV

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

CVE-2026-0403Low

Insufficient input validation in NETGEAR Orbi routers

CVE-2026-22801Medium

Information disclosure and denial of service via integer truncation in simplified write API

CVE-2026-22695Medium

Denial of service and information disclosure via heap buffer over-read in png_image_finish_read

CVE-2025-68493High

Information disclosure and denial of service via missing XML validation

CVE-2025-9222High

Stored Cross-Site Scripting via GitLab Flavored Markdown

CVE-2025-13772High

Unauthorized access to AI model settings via namespace identifier manipulation

CVE-2025-13761High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

CVE-2025-68615Critical

Net-SNMP Vulnerability in NetApp Products

CVE-2025-24296Medium

Intel Ethernet Controller Vulnerability in NetApp Products

CVE-2026-21639High

airMAX AC: malicious actor in Wi-Fi range of the affected product

CVE-2025-14017Critical

Security bypass due to global TLS option changes in multi-threaded LDAPS transfers

CVE-2026-21441High

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

CVE-2025-13151High

Denial of Service via stack-based buffer overflow in asn1_expend_octet_string

CVE-2026-20029Medium

Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability

CVE-2026-20027Medium

CVE-2026-20026Medium

CVE-2025-15224Medium

libssh key passphrase bypass without agent set

CVE-2025-15079High

Host verification bypass during SSH transfers

CVE-2025-14819Critical

Improper certificate validation due to cached TLS settings reuse

CVE-2025-14524Medium

Information disclosure via cross-protocol redirect with OAuth2 bearer token

CVE-2025-13034Medium

Public key pinning bypass via QUIC and GnuTLS allows server impersonation

CVE-2025-68428Critical

jsPDF Local File Inclusion/Path Traversal vulnerability

CVE-2025-9110High

QTS: exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several…

CVE-2025-62852Medium

QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-62842High

HBS: external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync.

CVE-2025-62840Low

generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync

CVE-2025-59389Critical

SQL injection vulnerability has been reported to affect Hyper Data Protector.

CVE-2025-59387Unrated

SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service).

CVE-2025-59384High

path traversal vulnerability has been reported to affect Qfiling.

CVE-2025-59381Medium

QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-59380Medium

QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53597Medium

License Center: buffer overflow vulnerability has been reported to affect License Center.

CVE-2025-53594Unrated

Qsync: path traversal vulnerability has been reported to affect several product versions.

CVE-2025-52871Medium

License Center: out-of-bounds read vulnerability has been reported to affect License Center.

CVE-2025-48721Medium

QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-11837Critical

Malware Remover: improper control of generation of code vulnerability has been reported to affect Malware Remover.

CVE-2025-62857Medium

QuMagie: cross-site scripting (XSS) vulnerability has been reported to affect QuMagie.

CVE-2025-57705Medium

QTS: allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system…

CVE-2025-54166Medium

QTS: out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-54165Medium

QTS: out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-54164Medium

QTS: out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53596Medium

QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53593Medium

QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53592Medium

QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53591Medium

QTS: use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions

CVE-2025-53590Medium

QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53589Medium

QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.

CVE-2025-53414Medium

QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.