CVEs.

Latest CVEs

1. 8.6High

   CVE-2026-0532 ↗ (opens in a new tab)

   External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

   ECElastic Cloud· Jan 14, 2026

2. 6.5Med

   CVE-2026-0529 ↗ (opens in a new tab)

   Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network traffic. This requires an attacker to send a malformed payload to a monitored network interface where MongoDB protocol parsing is enabled.

   ECElastic Cloud· Jan 14, 2026

3. 8.7High

   CVE-2026-22871 ↗ (opens in a new tab)

   GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.

   DADatadog· Jan 13, 2026

4. 7.1High

   CVE-2026-22870 ↗ (opens in a new tab)

   GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.

   DADatadog· Jan 13, 2026

5. 6.5Med

   CVE-2026-0543 ↗ (opens in a new tab)

   Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.

   ECElastic Cloud· Jan 13, 2026

6. 6.5Med

   CVE-2026-0531 ↗ (opens in a new tab)

   Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.

   ECElastic Cloud· Jan 13, 2026

7. 6.5Med

   CVE-2026-0530 ↗ (opens in a new tab)

   Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.

   ECElastic Cloud· Jan 13, 2026

8. 7.5High

   CVE-2026-0528 ↗ (opens in a new tab)

   Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

   ECElastic Cloud· Jan 13, 2026

9. 7.5High

   CVE-2026-21226 ↗ (opens in a new tab)

   Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.

   MAMicrosoft Azure· Jan 13, 2026

10. 7.8High

    CVE-2026-21224 ↗ (opens in a new tab)

    Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

    MAMicrosoft Azure· Jan 13, 2026

11. 9.8Crit

    CVE-2026-20963 ↗ (opens in a new tab)Known exploited

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

    M3Microsoft 365· Jan 13, 2026

12. 5.4Med

    CVE-2026-20959 ↗ (opens in a new tab)

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

    M3Microsoft 365· Jan 13, 2026

13. 5.4Med

    CVE-2026-20958 ↗ (opens in a new tab)

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

    M3Microsoft 365· Jan 13, 2026

14. 7.8High

    CVE-2026-20957 ↗ (opens in a new tab)

    Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

15. 7.8High

    CVE-2026-20956 ↗ (opens in a new tab)

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

16. 7.8High

    CVE-2026-20955 ↗ (opens in a new tab)

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

17. 8.4High

    CVE-2026-20953 ↗ (opens in a new tab)

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

18. 8.4High

    CVE-2026-20952 ↗ (opens in a new tab)

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

19. 7.8High

    CVE-2026-20951 ↗ (opens in a new tab)

    Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

20. 7.8High

    CVE-2026-20950 ↗ (opens in a new tab)

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

21. 7.8High

    CVE-2026-20949 ↗ (opens in a new tab)

    Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.

    M3Microsoft 365· Jan 13, 2026

22. 7.8High

    CVE-2026-20948 ↗ (opens in a new tab)

    Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

23. 8.8High

    CVE-2026-20947 ↗ (opens in a new tab)

    Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    M3Microsoft 365· Jan 13, 2026

24. 7.8High

    CVE-2026-20946 ↗ (opens in a new tab)

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

25. 8.4High

    CVE-2026-20944 ↗ (opens in a new tab)

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

26. 7.0High

    CVE-2026-20943 ↗ (opens in a new tab)

    Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Jan 13, 2026

27. 2.1Low

    CVE-2026-22805 ↗ (opens in a new tab)

    Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.

    MCMetabase Cloud· Jan 12, 2026

28. 8.7High

    CVE-2024-58340 ↗ (opens in a new tab)

    LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays

    L/LangChain / LangSmith· Jan 12, 2026

29. 5.1Med

    CVE-2026-22597 ↗ (opens in a new tab)

    Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.

    GHGhost(Pro)· Jan 10, 2026

30. 7.2High

    CVE-2026-22596 ↗ (opens in a new tab)

    Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

    GHGhost(Pro)· Jan 10, 2026

31. 8.1High

    CVE-2026-22595 ↗ (opens in a new tab)

    Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.

    GHGhost(Pro)· Jan 10, 2026

32. 8.1High

    CVE-2026-22594 ↗ (opens in a new tab)

    Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

    GHGhost(Pro)· Jan 10, 2026

33. 6.5Med

    CVE-2026-22030 ↗ (opens in a new tab)

    React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.

    SHShopify· Jan 10, 2026

34. 6.1Med

    CVE-2026-22029 ↗ (opens in a new tab)

    React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and r

    SHShopify· Jan 10, 2026

35. 8.2High

    CVE-2026-21884 ↗ (opens in a new tab)

    React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched

    SHShopify· Jan 10, 2026

36. 6.5Med

    CVE-2025-68470 ↗ (opens in a new tab)

    React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.

    SHShopify· Jan 10, 2026

37. 9.1Crit

    CVE-2025-61686 ↗ (opens in a new tab)

    React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to

    SHShopify· Jan 10, 2026

38. 7.6High

    CVE-2025-59057 ↗ (opens in a new tab)

    React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9

    SHShopify· Jan 10, 2026

39. 9.8Crit

    CVE-2026-22584 ↗ (opens in a new tab)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

    SASalesforce· Jan 9, 2026

40. 8.4High

    CVE-2026-0830 ↗ (opens in a new tab)

    Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

    AWAmazon Web Services· Jan 9, 2026

41. 5.4Med

    CVE-2025-9222 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.

    GIGitLab· Jan 9, 2026

42. 3.5Low

    CVE-2025-3950 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset proxy protection.

    GIGitLab· Jan 9, 2026

43. 6.5Med

    CVE-2025-13781 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations.

    GIGitLab· Jan 9, 2026

44. 4.3Med

    CVE-2025-13772 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.

    GIGitLab· Jan 9, 2026

45. 9.6Crit

    CVE-2025-13761 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.

    GIGitLab· Jan 9, 2026

46. 5.4Med

    CVE-2025-11246 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.

    GIGitLab· Jan 9, 2026

47. 6.5Med

    CVE-2025-10569 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to create a denial of service condition by providing crafted responses to external API calls.

    GIGitLab· Jan 9, 2026

48. 7.5High

    CVE-2025-69260 ↗ (opens in a new tab)

    A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.

    TMTrend Micro· Jan 8, 2026

49. 7.5High

    CVE-2025-69259 ↗ (opens in a new tab)

    A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability..

    TMTrend Micro· Jan 8, 2026

50. 9.8Crit

    CVE-2025-69258 ↗ (opens in a new tab)

    A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.

    TMTrend Micro· Jan 8, 2026