Week 3, 2026
12 January to 18 January 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,116
- Critical
- 111
- High
- 480
- Added to KEV
- 2
Critical 111High 480Medium 458Low 31Not scored 36All 1,116 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-20805
Desktop Window Manager Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedMedium5.5 - CVE-2025-8110
File overwrite in file update API in Gogs
Gogs · Gogs
ExploitedHigh8.7
Most severe new CVEsBy CVSS score
- CVE-2025-52694
Execution of arbitrary SQL commands
Advantech · IoTSuite and IoT Edge Products
Critical10.0 - CVE-2026-23550
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
Modular DS · Modular DS
Critical10.0 - CVE-2026-22240
Plaintext Passwords Vulnerability in BLUVOYIX
Bluspark Global · BLUVOYIX
Critical10.0 - CVE-2026-22781
TinyWeb CGI Command Injection
maximmasiutin · TinyWeb
Critical10.0 - CVE-2025-61937
AVEVA Process Optimization Code Injection
AVEVA · Process Optimization
Critical10.0 - CVE-2026-22686
Sandbox Escape via Host Error Prototype Chain in enclave-vm
agentfront · enclave
Critical10.0 - CVE-2026-22238
Administrator Account Creation Vulnerability in BLUVOYIX
Bluspark Global · BLUVOYIX
Critical10.0 - CVE-2025-40805
Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent…
Siemens · Industrial Edge Cloud Device (IECD)
Critical10.0 - CVE-2025-68271
Unauthenticated Remote Code Execution in openc3-api
OpenC3 · cosmos
Critical10.0 - CVE-2026-22236
Improper Authentication Vulnerability in BLUVOYIX
Bluspark Global · BLUVOYIX
Critical10.0