New that day
- criticalpatchedexploited SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. Can be chained with CVE-2026-23760. Added to CISA KEV on 2026-01-26 (federal deadline 2026-02-16).
- highpatchedexploited Linux Kernel Integer Overflow Vulnerability Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system. Added to CISA KEV on 2026-01-26 (federal deadline 2026-02-16).
- highpatchedexploited GNU InetUtils Argument Injection Vulnerability GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable. Added to CISA KEV on 2026-01-26 (federal deadline 2026-02-16).
- highpatchedexploited Microsoft Office Security Feature Bypass Vulnerability Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Added to CISA KEV on 2026-01-26 (federal deadline 2026-02-16).