Week 2, 2026
5 January to 11 January 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 963CVEs publishedin the whole week
- 96CriticalCVSS 9.0 and above
- 321HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-37164
A remote code execution issue exists in HPE OneView.
Hewlett Packard Enterprise (HPE) · HPE OneView
ExploitedCritical10.0 - CVE-2009-0556
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary…
Product not named
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
n8n-io · n8n
Critical10.0 - CVE-2026-21877
n8n is vulnerable to Remote Code Execution via Arbitrary File Write
n8n-io · n8n
Critical10.0 - CVE-2025-61492
A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted…
Product not named
Critical10.0 - CVE-2026-22688
WeKnora has Command Injection in MCP stdio test
Tencent · WeKnora
Critical10.0 - CVE-2025-59157
Coolify has Git Repository RCE
coollabsio · coolify
Critical10.0 - CVE-2025-69425
Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE
RUCKUS Networks · vRIoT IoT Controller
Critical10.0 - CVE-2025-64093
Unauthenticated Remote Code Execution via the device hostname
Zenitel · ICX500
Critical10.0 - CVE-2025-70974
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may…
Alibaba · Fastjson
Critical10.0 - CVE-2025-64420
Coolify members can see private key of root user
coollabsio · coolify
Critical10.0 - CVE-2025-64090
Authenticated Remote Code Execution in device hostname
Zenitel · TCIS-3+
Critical10.0