Week 4, 2026

19 January to 25 January 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 1,262
Critical: 114
High: 510
Added to KEV: 6

Critical 114High 510Medium 596Low 42Not scored 0All 1,262 in the list

Added to KEVAttackers use these now; patch them first

CVE-2024-37079
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may…
VMware vCenter Server
ExploitedCritical9.8
CVE-2025-34026
Versa Concerto Actuator Authentication Bypass Information Leak
Versa · Concerto
ExploitedCritical9.2
CVE-2025-68645
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of…
Product not named
ExploitedHigh8.8
CVE-2025-54313
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an…
prettier · eslint-config-prettier
ExploitedHigh7.5
CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
vitejs · vite
ExploitedMedium5.3
CVE-2026-20045
Cisco Unified Communications Products Remote Code Execution Vulnerability
Cisco · Cisco Unified Communications Manager
ExploitedHigh8.2

Most severe new CVEsBy CVSS score

CVE-2026-21962
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…
Oracle Corporation · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
ExploitedCritical10.0
CVE-2025-68001
WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability
garidium · g-FFL Checkout
Critical10.0
CVE-2025-50002
WordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerability
Farost · Energia
Critical10.0
CVE-2025-69828
File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo…
Product not named
Critical10.0
CVE-2025-4320
Information Disclosure in Birebirsoft's Sufirmam
Birebirsoft Software and Technology Solutions · Sufirmam
Critical10.0
CVE-2026-23836
HotCRP vulnerable to remote code execution through formulas
kohler · hotcrp
Critical10.0
CVE-2026-22844
Zoom Node Deployments - Command Injection
Zoom Communications Inc. · Zoom Node
Critical9.9
CVE-2026-24304
Azure Resource Manager Elevation of Privilege Vulnerability
Microsoft · Azure Resource Manager
Critical9.9
CVE-2026-22797
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1.…
OpenStack · keystonemiddleware
Critical9.9
CVE-2025-68910
WordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerability
blazethemes · Blogzee
Critical9.9

Week 4, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses