CVE Tools
Sign in
month report

January 2026

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

January 2026 closed with 5,244 published CVEs. 437 criticals, 17 added to CISA KEV (2 ransomware-linked). linux led volume, mostly via linux. Top weakness class — CWE-79 (627 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
5,244
— MoM— YoY
Severity mix
437 / 1,659
critical / high
KEV added
17
2 ransomware-linked
Nuclei coverage
18.6%
976 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
43.2
n=976
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
5
n=13
Detection gap

KEV pressure, no Nuclei coverage

January 2026 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in January 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS862Missing Authorization89SQL Injection74Injection20Improper Input Validation22Path Traversal787Out-of-bounds Write428CWE-428284CWE-28478OS Command Injectionlinux1сообщество свободного программного обеспечения349521ао «ивк»17npm1932611145microsoft21318microsoft corp5138ооо «ред софт»111115123red hat inc.215pypi731110131canonical ltd.11ооо «русбитех-астра»111101go631310101

Most discussed CVEs — January 2026

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1linux—
    246 CVE1 critCVSS 6.1
    linux (246) · linux kernel (60)
  • 2сообщество свободного программного обеспечения—
    206 CVE14 critCVSS 6.3
    Nuclei 5PoC 22
    linux (123) · debian gnu/linux (73) · gpac (10)
  • 3npm—
    142 CVE20 critCVSS 7.1
    Nuclei 4PoC 30
    pnpm (8) · hono (6) · renovate (6)
  • 4microsoft—
    134 CVE5 critCVSS 7.0
    KEV 3PoC 3
    windows 11 25h2 (84) · windows server 2025 (84) · windows 11 24h2 (84)
  • 5ао «ивк»—
    118 CVE16 critCVSS 6.4
    PoC 11
    альт сп 10 (118) · альт 8 сп (48)
  • 6redhat—
    111 CVE4 critCVSS 6.3
    PoC 3
    red hat enterprise linux (87) · red hat enterprise linux 9 (18) · red hat enterprise linux 10 (18)
  • 7pypi—
    98 CVE6 critCVSS 6.8
    Nuclei 2PoC 12
    aiohttp (8) · fickling (5) · vllm (4)
  • 8go—
    85 CVE11 critCVSS 6.8
    Nuclei 2PoC 11
    github.com/go-gitea/gitea (7) · github.com/siyuan-note/siyuan/kernel (4) · github.com/axllent/mailpit (4)
  • 9canonical—
    77 CVE2 critCVSS 5.9
    PoC 1
    ubuntu (76) · juju (1)
  • 10oracle—
    66 CVE2 critCVSS 6.2
    PoC 1
    vm virtualbox (14) · oracle vm virtualbox (14) · mysql server (11)
  • 11ооо «ред софт»—
    66 CVE4 critCVSS 6.3
    PoC 9
    ред ос (66)
  • 12color—
    59 CVE1 critCVSS 7.1
    NEWPoC 27
    iccdev (59)
  • 13internationalcolorconsortium—
    59 CVE1 critCVSS 7.1
    NEWPoC 27
    iccdev (59)
  • 14packagist—
    58 CVE6 critCVSS 6.9
    PoC 15
    bagisto/bagisto (6) · craftcms/cms (5) · mineadmin/mineadmin (4)
  • 15maven—
    53 CVE6 critCVSS 6.9
    Nuclei 1PoC 7
    net.gleske:jervis (7) · org.keycloak:keycloak-services (4) · org.apache.solr:solr-core (2)
  • 16ао «сбертех»—
    51 CVECVSS 5.9
    PoC 2
    platform v sberlinux os server (51)
  • 17tenda—
    49 CVE6 critCVSS 7.6
    PoC 16
    ax1806 firmware (11) · w30e firmware (11) · ax3 firmware (9)
  • 18google—
    45 CVE3 critCVSS 7.6
    PoC 2
    android (25) · chrome (12) · google chrome (12)
  • 19code-projects—
    44 CVECVSS 6.5
    PoC 44
    online product reservation system (13) · online music site (12) · intern membership management system (8)
  • 20shenzhen tenda technology co., ltd.—
    42 CVE3 critCVSS 7.5
    PoC 9
    w30e v2 (11) · tenda w30e (11) · tenda ax1806 (8)
  • 21ibm—
    39 CVECVSS 6.2
    db2 for linux, unix and windows (18) · db2 (18) · applinx (6)
  • 22qnap—
    35 CVE2 critCVSS 6.0
    quts hero (25) · qts (25) · hybrid backup sync (2)
  • 23crates.io—
    32 CVE4 critCVSS 7.3
    PoC 7
    rustfs (5) · sm2 (3) · gix-date (2)
  • 24fabian—
    32 CVE4 critCVSS 7.2
    PoC 31
    online product reservation system (13) · online music site (12) · mobile shop management system (4)
  • 25meddream—
    30 CVE1 critCVSS 6.3
    NEWPoC 23
    pacs server (29) · meddream pacs premium (29) · meddream pacs server (1)
  • 26mediatek, inc.—
    28 CVECVSS 7.0
    mediatek chipset (28)
  • 27adobe—
    25 CVECVSS 7.3
    substance3d - modeler (6) · adobe substance 3d modeler (6) · substance 3d modeler (6)
  • 28dell—
    24 CVECVSS 5.9
    elastic cloud storage (5) · objectscale (5) · powerscale onefs (4)
  • 29juniper networks—
    24 CVE1 critCVSS 7.1
    PoC 24
    junos os (20) · junos os evolved (9) · junos (7)
  • 30linuxfoundation—
    24 CVE1 critCVSS 6.3
    PoC 7
    everest (11) · rekor (2) · backstage (2)
  • 31e-plugins—
    23 CVECVSS 7.6
    NEWNuclei 23
    hospital doctor directory (3) · hotel listing (3) · institutions directory (3)
  • 32juniper—
    23 CVECVSS 6.6
    PoC 23
    junos (20) · junos os evolved (9) · junos space (1)
  • 33sick ag—
    23 CVE2 critCVSS 6.0
    NEW
    tdc-x401gl (13) · incoming goods suite (10) · sick tdc-x401gl (2)
  • 34apache—
    22 CVE3 critCVSS 7.3
    PoC 1
    nimble (4) · nuttx (2) · solr (2)
  • 35apache software foundation—
    22 CVE3 critCVSS 7.6
    PoC 1
    apache mynewt nimble (4) · apache airflow (2) · apache solr (2)
  • 36hpe—
    22 CVE1 critCVSS 7.1
    arubaos (aos) (12) · edgeconnect sd-wan orchestrator (5) · hpe aruba networking fabric composer (2)
  • 37qualcomm—
    22 CVECVSS 6.8
    wsa8845 firmware (20) · fastconnect 7800 firmware (20) · wsa8845h firmware (20)
  • 38qualcomm, inc.—
    22 CVECVSS 7.1
    snapdragon (22)
  • 39mikado-themes—
    21 CVECVSS 5.9
    NEWNuclei 21
    curly (2) · dolcino (1) · fiorello (1)
  • 40tp-link systems inc.—
    21 CVECVSS 7.2
    NEWPoC 2
    vx800v v1.0 (5) · tapo c220 v1 (3) · omada controller (3)
  • 41dormakaba—
    20 CVECVSS 8.8
    NEW
    access manager 92xx-k5 (10) · access manager 92xx-k7 (8) · kaba exos 9300 (7)
  • 42phpgurukul—
    20 CVE4 critCVSS 6.4
    PoC 18
    news portal (6) · cyber cafe management system (4) · online course registration (3)
  • 43sap_se—
    20 CVE4 critCVSS 6.5
    sap fiori app (intercompany balance reconciliation) (6) · nw as java ume user mapping (1) · sap application server for abap and sap netweaver rfcsdk (1)
  • 44yonyou—
    20 CVECVSS 7.3
    NEWPoC 14
    ksoa (20)
  • 45ancorathemes—
    19 CVECVSS 8.1
    NEWNuclei 19
    diveit (1) · hobo (1) · indoor plants (1)
  • 46free software foundation, inc.—
    19 CVE15 critCVSS 9.0
    KEV 1Nuclei 1PoC 11
    freerdp (17) · gnutls (1) · inetutils (1)
  • 47mozilla—
    19 CVE4 critCVSS 7.7
    firefox (18) · thunderbird (17) · firefox esr (6)
  • 48totolink—
    19 CVECVSS 7.4
    PoC 18
    lr350 firmware (6) · lr350 (6) · a7000r (4)
  • 49utt—
    19 CVE1 critCVSS 8.9
    NEWPoC 17
    进取 520w (14) · 520w firmware (14) · 512w firmware (4)
  • 50algo—
    18 CVE5 critCVSS 8.8
    NEW
    8180 ip audio alerter (18)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79627—
2CWE-862309—
3CWE-89242—
4CWE-74129—
5CWE-20124—
6CWE-22123—
7CWE-787119—
8CWE-428110—
9CWE-284104—
10CWE-352102—
11CWE-434102—
12CWE-78101—
13CWE-9496—
14CWE-9893—
15CWE-7787—
16CWE-47685—
17CWE-41683—
18CWE-12082—
19CWE-20082—
20CWE-77081—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins1,115 CVE
    108 crit605 vendorsCVSS 7.5
    tutor lms – elearning and online course solution (5) · quiz and survey master (4) · all-in-one video gallery (3)
  • OSS Libraries842 CVE
    131 crit2 KEV190 vendorsCVSS 7.6
    iccdev (118) · freerdp (34) · openssl (24)
  • Operating Systems636 CVE
    96 crit70 KEV42 vendorsCVSS 7.5
    linux (369) · альт сп 10 (118) · red hat enterprise linux (87)
  • Enterprise Software494 CVE
    180 crit6 KEV166 vendorsCVSS 8.8
    db2 (18) · db2 for linux, unix and windows (18) · aion (14)
  • Networking Infrastructure313 CVE
    48 crit15 KEV86 vendorsCVSS 8.0
    junos (27) · junos os evolved (21) · junos os (20)
  • ICS / OT / IoT241 CVE
    59 crit79 vendorsCVSS 8.5
    incoming goods suite (13) · tdc-x401gl (13) · tdc-x401gl firmware (13)
  • Hardware Firmware235 CVE
    442 crit57 vendorsCVSS 9.6
    fastconnect 7800 firmware (20) · wsa8840 firmware (20) · wsa8845 firmware (20)
  • Security Products149 CVE
    24 crit10 KEV72 vendorsCVSS 7.8
    wireshark (8) · suricata (7) · fickling (5)
  • Consumer Software147 CVE
    29 crit70 vendorsCVSS 8.8
    adobe substance 3d modeler (6) · substance 3d modeler (6) · substance3d - modeler (6)
  • Cloud & SaaS140 CVE
    40 crit81 vendorsCVSS 7.9
    n8n (10) · qoca aim ai medical cloud platform (6) · appsmith (4)
  • AI / ML113 CVE
    20 crit56 vendorsCVSS 9.8
    oneflow (18) · everest (11) · backstage (2)
  • Mobile Apps100 CVE
    27 crit12 vendorsCVSS 8.7
    android (33) · harmonyos (16) · chrome (12)
  • DevTools & CI100 CVE
    27 crit42 vendorsCVSS 8.3
    orval (8) · malcontent (4) · on-prem enterprise server (4)
  • Databases89 CVE
    10 crit16 vendorsCVSS 7.4
    mysql server (32) · vm virtualbox (28) · oracle vm virtualbox (14)
  • Communications70 CVE
    23 crit5 KEV38 vendorsCVSS 8.7
    mastodon (12) · librechat (8) · agora-project (4)
  • Unclassified487 CVE
    104 crit318 vendorsCVSS 7.2
    utt 520w (14) · cryptolib (10) · prime (8)
Weakness × Sector

Which weaknesses hit which solution categories in January 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS862Missing Authorization89SQL Injection74Injection20Improper Input Validation22Path Traversal787Out-of-bounds Write428CWE-428284CWE-28478OS Command InjectionWeb & CMS Plugins34023510748113426264OSS Libraries611423668453723013Operating Systems622110833163Enterprise Software832390561013392011ICS / OT / IoT475714655525Networking Infrastructure1716201411316516Hardware Firmware46572816421Consumer Software284128811222443Cloud & SaaS181445624712Security Products66454571328