Skip to content

Commit b28f4d1

Browse files
aboutcode-automationaboutcode-automation
committed
Update KEV: Tue Jan 27 00:15:44 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent ead6b84 commit b28f4d1

1 file changed

Lines changed: 78 additions & 3 deletions

File tree

‎known_exploited_vulnerabilities.json‎

Lines changed: 78 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,84 @@
11
{
22
"title": "CISA Catalog of Known Exploited Vulnerabilities",
3-
"catalogVersion": "2026.01.23",
4-
"dateReleased": "2026-01-23T18:00:05.4207Z",
5-
"count": 1494,
3+
"catalogVersion": "2026.01.26",
4+
"dateReleased": "2026-01-26T20:47:09.659Z",
5+
"count": 1499,
66
"vulnerabilities": [
7+
{
8+
"cveID": "CVE-2018-14634",
9+
"vendorProject": "Linux",
10+
"product": "Kernal",
11+
"vulnerabilityName": "Linux Kernel Integer Overflow Vulnerability",
12+
"dateAdded": "2026-01-26",
13+
"shortDescription": "Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.",
14+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
15+
"dueDate": "2026-02-16",
16+
"knownRansomwareCampaignUse": "Unknown",
17+
"notes": "This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/stable\/linux.git\/about\/ ; https:\/\/www.kernel.org\/ ; https:\/\/www.cve.org\/CVERecord?id=CVE-2018-14634; https:\/\/access.redhat.com\/errata\/RHSA-2018:3540 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-14634",
18+
"cwes": [
19+
"CWE-190"
20+
]
21+
},
22+
{
23+
"cveID": "CVE-2025-52691",
24+
"vendorProject": "SmarterTools",
25+
"product": "SmarterMail",
26+
"vulnerabilityName": "SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability",
27+
"dateAdded": "2026-01-26",
28+
"shortDescription": "SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.",
29+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
30+
"dueDate": "2026-02-16",
31+
"knownRansomwareCampaignUse": "Unknown",
32+
"notes": "https:\/\/www.smartertools.com\/smartermail\/release-notes\/current ; https:\/\/www.csa.gov.sg\/alerts-and-advisories\/alerts\/al-2025-124\/ ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-52691",
33+
"cwes": [
34+
"CWE-434"
35+
]
36+
},
37+
{
38+
"cveID": "CVE-2026-23760",
39+
"vendorProject": "SmarterTools",
40+
"product": "SmarterMail",
41+
"vulnerabilityName": "SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability",
42+
"dateAdded": "2026-01-26",
43+
"shortDescription": "SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.",
44+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
45+
"dueDate": "2026-02-16",
46+
"knownRansomwareCampaignUse": "Unknown",
47+
"notes": "https:\/\/www.smartertools.com\/smartermail\/release-notes\/current ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-23760",
48+
"cwes": [
49+
"CWE-288"
50+
]
51+
},
52+
{
53+
"cveID": "CVE-2026-24061",
54+
"vendorProject": "GNU",
55+
"product": "InetUtils",
56+
"vulnerabilityName": "GNU InetUtils Argument Injection Vulnerability",
57+
"dateAdded": "2026-01-26",
58+
"shortDescription": "GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable.",
59+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
60+
"dueDate": "2026-02-16",
61+
"knownRansomwareCampaignUse": "Unknown",
62+
"notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https:\/\/cgit.git.savannah.gnu.org\/cgit\/inetutils.git ; https:\/\/codeberg.org\/inetutils\/inetutils\/commit\/ccba9f748aa8d50a38d7748e2e60362edd6a32cc; https:\/\/codeberg.org\/inetutils\/inetutils\/commit\/fd702c02497b2f398e739e3119bed0b23dd7aa7b ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-24061",
63+
"cwes": [
64+
"CWE-88"
65+
]
66+
},
67+
{
68+
"cveID": "CVE-2026-21509",
69+
"vendorProject": "Microsoft",
70+
"product": "Office",
71+
"vulnerabilityName": "Microsoft Office Security Feature Bypass Vulnerability",
72+
"dateAdded": "2026-01-26",
73+
"shortDescription": "Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally.",
74+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
75+
"dueDate": "2026-02-16",
76+
"knownRansomwareCampaignUse": "Unknown",
77+
"notes": "Please adhere to Microsoft\u2019s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-21509 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-21509",
78+
"cwes": [
79+
"CWE-807"
80+
]
81+
},
782
{
883
"cveID": "CVE-2024-37079",
984
"vendorProject": "Broadcom",

0 commit comments

Comments
 (0)