Week 5, 2026
26 January to 1 February 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 838CVEs publishedin the whole week
- 97CriticalCVSS 9.0 and above
- 309HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2026-1281
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Ivanti · Endpoint Manager Mobile
ExploitedCritical9.8 - CVE-2026-24858
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…
Fortinet · FortiWeb
ExploitedCritical9.4 - CVE-2025-52691
Upload Arbitrary Files
SmarterTools · SmarterMail
ExploitedCritical10.0 - CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
GNU · Inetutils
ExploitedCritical9.8 - CVE-2026-23760
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
SmarterTools · SmarterMail
ExploitedCritical9.3 - CVE-2026-21509
Microsoft Office Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
ExploitedHigh7.8 - CVE-2018-14634
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged)…
The Linux Foundation · kernel
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2026-24897
Authenticated Remote Code Execution via Arbitrary File Upload
ErugoOSS · Erugo
Critical10.0 - CVE-2026-23830
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
nyariv · SandboxJS
Critical10.0 - CVE-2026-22039
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
kyverno · kyverno
Critical10.0 - CVE-2026-1699
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and…
Eclipse Foundation · Eclipse Theia - Website
Critical10.0 - CVE-2025-14988
Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA
iba Systems · ibaPDA
Critical10.0 - CVE-2025-57792
SQL Injection Vulnerability in Explorance Blue
Explorance · Blue
Critical10.0 - CVE-2026-24823
A heap-based buffer over-read or buffer overflow vulnerability in FASTSHIFT/X-TRACK
FASTSHIFT · X-TRACK
Critical10.0 - CVE-2026-24822
a heap-based buffer overflow vulnerability in ttttupup/wxhelper via src/mongoose.
ttttupup · wxhelper
Critical10.0 - CVE-2026-24729
Interinfo DreamMaker - Unrestricted Upload of File with Dangerous Type
Internet Information Co., Ltd · DreamMaker
Critical10.0 - CVE-2026-24815
A XStream Security Vulnerability in XML Deserialization in datavane/tis
datavane · tis
Critical10.0