Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 2, 2026

5 January to 11 January 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
963
Critical
96
High
321
Added to KEV
2

Critical 96High 321Medium 501Low 32Not scored 13All 963 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2025-37164

    A remote code execution issue exists in HPE OneView.

    Hewlett Packard Enterprise (HPE) · HPE OneView

    ExploitedCritical10.0
  • CVE-2009-0556

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary…

    Product not named

    ExploitedHigh8.8

Most severe new CVEsBy CVSS score

  • CVE-2026-21858

    n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

    n8n-io · n8n

    Critical10.0
  • CVE-2026-21877

    n8n is vulnerable to Remote Code Execution via Arbitrary File Write

    n8n-io · n8n

    Critical10.0
  • CVE-2025-61492

    A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted…

    Product not named

    Critical10.0
  • CVE-2026-22688

    WeKnora has Command Injection in MCP stdio test

    Tencent · WeKnora

    Critical10.0
  • CVE-2025-59157

    Coolify has Git Repository RCE

    coollabsio · coolify

    Critical10.0
  • CVE-2025-69425

    Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

    RUCKUS Networks · vRIoT IoT Controller

    Critical10.0
  • CVE-2025-64093

    Unauthenticated Remote Code Execution via the device hostname

    Zenitel · ICX500

    Critical10.0
  • CVE-2025-70974

    Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may…

    Alibaba · Fastjson

    Critical10.0
  • CVE-2025-64420

    Coolify members can see private key of root user

    coollabsio · coolify

    Critical10.0
  • CVE-2025-64090

    Authenticated Remote Code Execution in device hostname

    Zenitel · TCIS-3+

    Critical10.0

Vendors with the most CVEs

  1. InternationalColorConsortium47
  2. MediaTek, Inc.28
  3. Qualcomm, Inc.22
  4. code-projects20
  5. Linux16
  6. coollabsio11
  7. UTT10
  8. nasa10
  9. EFACEC9
  10. Samsung Mobile9

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)178
  2. CWE-862 Missing authorization86
  3. CWE-89 SQL injection65
  4. CWE-20 Improper input validation44
  5. CWE-74 Injection32
  6. CWE-77 Command injection28
  7. CWE-787 Out-of-bounds write26
  8. CWE-352 Cross-site request forgery (CSRF)25
  9. CWE-98 PHP remote file inclusion25
  10. CWE-120 Classic buffer overflow22