# january 2026

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for january 2026, painted from 4,302 published cves](https://media.cvegen.art/posters/2026-01/1280.jpg?v=d92922cc7c)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 12 ran above the 2025 average for their weekday and sweep fast and wide; the other 19 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-01.mp4?v=fd2fd0d062)

| fact | value |
| --- | --- |
| cves | 4,302 |
| against an average 2025 month | 1.1× |
| busiest day | jan 13, 444 |
| rated critical, cvss 9 or higher | 456 |
| critical with no login and no click | 373 |
| used in real attacks | 16 |

## january 2026 in numbers

january 2026 brought 4,302 cves, close to an average 2025 month. 12 of its 31 days ran above the 2025 average for that weekday.

- 444 on jan 13, the busiest day.
- 456 rated critical, cvss 9 or higher. 373 of them can be hit over the network with no login and nothing for a user to click.
- 1,258 in open-source packages, 2.8 times their 2025 monthly average. no other kind of software grew as fast.
- 404 came in two single drops: patchstack 309 on jan 22, patchstack 95 on jan 23.

## 16 already used in real attacks

cisa kev, as of oct 24.

### by product

- 2 fortinet products, jan 13, 27
- 2 smartertools smartermail, jan 22, 23
- 2 solarwinds web help desk, jan 28
- 2 ivanti endpoint manager mobile, jan 29
- 1 synacor zimbra collaboration suite, jan 5
- 1 microsoft sharepoint, jan 13
- 1 microsoft windows, jan 13
- 1 oracle http server and oracle weblogic server proxy plug-in, jan 20
- 1 cisco unified communications manager, jan 21
- 1 gnu inetutils, jan 21
- 1 langflow, jan 23
- 1 microsoft office, jan 26

### every cve

- jan 5, synacor zimbra collaboration suite (zcs), [cve-2025-66376](https://www.cve.org/CVERecord?id=CVE-2025-66376)
- jan 13, fortinet multiple products, [cve-2025-25249](https://www.cve.org/CVERecord?id=CVE-2025-25249)
- jan 13, microsoft windows, [cve-2026-20805](https://www.cve.org/CVERecord?id=CVE-2026-20805)
- jan 13, microsoft sharepoint, [cve-2026-20963](https://www.cve.org/CVERecord?id=CVE-2026-20963)
- jan 20, oracle http server and oracle weblogic server proxy plug-in, [cve-2026-21962](https://www.cve.org/CVERecord?id=CVE-2026-21962)
- jan 21, cisco unified communications manager, [cve-2026-20045](https://www.cve.org/CVERecord?id=CVE-2026-20045)
- jan 21, gnu inetutils, [cve-2026-24061](https://www.cve.org/CVERecord?id=CVE-2026-24061)
- jan 22, smartertools smartermail, [cve-2026-23760](https://www.cve.org/CVERecord?id=CVE-2026-23760)
- jan 23, langflow langflow, [cve-2026-0770](https://www.cve.org/CVERecord?id=CVE-2026-0770)
- jan 23, smartertools smartermail, [cve-2026-24423](https://www.cve.org/CVERecord?id=CVE-2026-24423)
- jan 26, microsoft office, [cve-2026-21509](https://www.cve.org/CVERecord?id=CVE-2026-21509)
- jan 27, fortinet multiple products, [cve-2026-24858](https://www.cve.org/CVERecord?id=CVE-2026-24858)
- jan 28, solarwinds web help desk, [cve-2025-40536](https://www.cve.org/CVERecord?id=CVE-2025-40536)
- jan 28, solarwinds web help desk, [cve-2025-40551](https://www.cve.org/CVERecord?id=CVE-2025-40551)
- jan 29, ivanti endpoint manager mobile (epmm), [cve-2026-1281](https://www.cve.org/CVERecord?id=CVE-2026-1281)
- jan 29, ivanti endpoint manager mobile (epmm), [cve-2026-1340](https://www.cve.org/CVERecord?id=CVE-2026-1340)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | january 1 to 31, 2026 |
| cves | 4,302 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-01/2000.jpg?v=d92922cc7c)

## other months

- before: [december 2025](https://cvegen.art/2025/12.md), 5,493 cves
- after: [february 2026](https://cvegen.art/2026/02.md), 4,616 cves
- [all months](https://cvegen.art/index.md)