CVE-2026 list

CVE-2026 records published in February 2026

Page three of four: records 2,001 to 3,000 of the 3,068 published in February 2026, newest first. The first page carries the figures for February 2026.

CVE-2026 records published in February 2026, newest first: records 2,001 to 3,000 of 3,068
CVE Summary CVSS EPSS Published Signals
CVE-2026-0595Improper neutralization of input during web page generation (cross-site scripting) in GitLab7.3CNA v3.10.2%2026-02-11Fix
CVE-2026-0229PAN-OS: Denial of service in Advanced DNS Security feature6.6CNA v4.00.5%2026-02-11Fix
CVE-2026-0228PAN-OS: Improper validation of Terminal Server Agent Certificate1.3CNA v4.00.2%2026-02-11Fix
CVE-2026-26013LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages3.7CNA v3.10.4%2026-02-10Fix
CVE-2026-26009Catalyst affected by remote code execution as Root via Containerized Install Script Execution10.0CNA v3.10.9%2026-02-10
CVE-2026-26007cryptography Subgroup Attack due to Missing Subgroup Validation for SECT Curves8.2CNA v4.00.3%2026-02-10Fix
CVE-2026-26006Redos at Code Extraction block in Significant-Gravitas/AutoGPT6.5CNA v3.10.6%2026-02-10Fix
CVE-2026-26003FastGPT plugin forwarding request is not authenticated, posing a serious risk of attack6.9CNA v4.00.4%2026-02-10Fix
CVE-2026-25993EverShop has a Second-order SQL injection in URL Rewrite Processing Derived from Category URL Keys9.3CNA v4.00.5%2026-02-10Exploit codeFix
CVE-2026-25992SiYuan has a File Read Interface Case Bypass vulnerability7.5CNA v3.10.7%2026-02-10Fix
CVE-2026-25956Frappe affected by XSS and open redirect in Sign Up6.1CNA v3.10.3%2026-02-10Fix
CVE-2026-25947Worklenz Boolean-based blind SQL injection via Improper ORDER BY Clause Input Validation8.8CNA v3.10.6%2026-02-10Fix
CVE-2026-25872JUNG Smart Panel KNX unauthenticated path traversal6.9CNA v4.00.8%2026-02-10
CVE-2026-25870DoraCMS UEditor Remote Image Fetch SSRF6.9CNA v4.00.4%2026-02-10
CVE-2026-25805Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning6.4CNA v3.10.4%2026-02-10Fix
CVE-2026-25728ClipBucket v5 affected by remote code execution via Avatar/Background file upload race condition9.3CNA v4.00.4%2026-02-10Fix
CVE-2026-25656Siemens SINEC NMS uncontrolled search path8.5CNA v4.00.2%2026-02-10Fix
CVE-2026-25655Siemens SINEC NMS uncontrolled search path8.5CNA v4.00.2%2026-02-10Fix
CVE-2026-25646LIBPNG has a heap buffer overflow in png_set_quantize8.3CNA v4.00.7%2026-02-10Fix
CVE-2026-25613An unsafe cast in the MongoDB query planner can result in a segmentation fault7.1CNA v4.00.4%2026-02-10Fix
CVE-2026-25612MongoDB Server internal ResourceId collision may affect unrelated collections7.1CNA v4.00.4%2026-02-10Fix
CVE-2026-25611Pre-authentication memory exhaustion denial of service in MongoDB Server8.7CNA v4.00.6%2026-02-10Fix
CVE-2026-25610MongoDB Server invalid $geoNear index hint may cause server crash7.1CNA v4.00.4%2026-02-10Fix
CVE-2026-25609MongoDB Server profile command may permit unauthorized configuration5.3CNA v4.00.3%2026-02-10Fix
CVE-2026-25577emmett-framework core Emmett has an Unhandled CookieError Exception causing denial of service7.5CNA v3.10.5%2026-02-10Fix
CVE-2026-25530Kanboard is missing authorization check in getSwimlane API allows cross-project data access4.3CNA v3.10.4%2026-02-10Fix
CVE-2026-25506MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery7.7CNA v3.10.3%2026-02-10Fix
CVE-2026-24885Kanboard affected by cross-site request forgery5.7CNA v3.10.2%2026-02-10Fix
CVE-2026-24343Apache HertzBeat: Uncontrolled resource consumption via Crafted XPath Expressions8.8CISA ADP v3.10.7%2026-02-10Fix
CVE-2026-24328Open redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)6.1CNA v3.10.2%2026-02-10Fix
CVE-2026-24327Missing authorization Check in SAP Strategic Enterprise Management4.3CNA v3.10.2%2026-02-10Fix
CVE-2026-24326Missing authorization check in SAP S/4HANA Defense and Security (Disconnected Operations)4.3CNA v3.10.2%2026-02-10Fix
CVE-2026-24325Cross-site scripting vulnerability in SAP BusinessObjects Enterprise4.8CNA v3.10.2%2026-02-10Fix
CVE-2026-24324Denial of service vulnerability in SAP BusinessObjects Business Intelligence Platform6.5CNA v3.10.4%2026-02-10Fix
CVE-2026-24323Multiple vulnerabilities in BSP Applications of SAP Document Management System6.1CNA v3.10.2%2026-02-10Fix
CVE-2026-24322Missing authorization check in SAP Solution Tools Plug-in (ST-PI)7.7CNA v3.10.2%2026-02-10Fix
CVE-2026-24321Information disclosure vulnerability in SAP Commerce Cloud5.3CNA v3.10.2%2026-02-10Fix
CVE-2026-24320Memory corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)3.1CNA v3.10.3%2026-02-10Fix
CVE-2026-24319Information disclosure vulnerability in SAP Business One (B1 Client Memory Dump files)5.8CNA v3.10.1%2026-02-10Fix
CVE-2026-24312Missing authorization check in SAP Business Workflow5.2CNA v3.10.2%2026-02-10Fix
CVE-2026-24045Docmost affected by stored XSS in Public Share page7.3CNA v3.10.2%2026-02-10Fix
CVE-2026-23906Apache Druid: Authentication bypass via LDAP Anonymous Bind9.8CISA ADP v3.11.1%2026-02-10Fix
CVE-2026-23901Apache Shiro: Brute force attack possible to determine valid user names1.0CNA v4.00.2%2026-02-10Fix
CVE-2026-23720Siemens Simcenter Femap out-of-bounds read7.3CNA v4.00.2%2026-02-10Fix
CVE-2026-23719Siemens Simcenter Femap heap-based buffer overflow7.3CNA v4.00.1%2026-02-10Fix
CVE-2026-23718Siemens Simcenter Femap out-of-bounds read7.3CNA v4.00.1%2026-02-10Fix
CVE-2026-23717Siemens Simcenter Femap out-of-bounds read7.3CNA v4.00.1%2026-02-10Fix
CVE-2026-23716Siemens Simcenter Femap out-of-bounds read7.3CNA v4.00.1%2026-02-10Fix
CVE-2026-23715Siemens Simcenter Femap out-of-bounds write7.3CNA v4.00.2%2026-02-10Fix
CVE-2026-23689Denial of service (DOS) in SAP Supply Chain Management7.7CNA v3.10.4%2026-02-10Fix
CVE-2026-23688Missing authorization check in SAP Fiori App (Manage Service Entry Sheets Lean services)4.3CNA v3.10.2%2026-02-10Fix
CVE-2026-23687XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform8.8CNA v3.10.5%2026-02-10Fix
CVE-2026-23686CRLF injection vulnerability in SAP NetWeaver Application Server Java3.4CNA v3.10.2%2026-02-10Fix
CVE-2026-23685Insecure deserialization vulnerability in SAP NetWeaver (JMS service)4.4CNA v3.10.1%2026-02-10Fix
CVE-2026-23684Race condition vulnerability in SAP Commerce Cloud5.9CNA v3.10.2%2026-02-10Fix
CVE-2026-23681Missing authorization check in a function module in SAP Support Tools Plug-In4.3CNA v3.10.2%2026-02-10Fix
CVE-2026-23655Microsoft ACI Confidential Containers information disclosure6.5CNA v3.11.0%2026-02-10Fix
CVE-2026-22923Siemens NX stack-based buffer overflow7.3CNA v4.00.1%2026-02-10Fix
CVE-2026-22153Fortinet FortiOS authentication bypass7.5CNA v3.10.7%2026-02-10Fix
CVE-2026-21743Fortinet FortiAuthenticator missing authorization6.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21537Microsoft Defender For Endpoint Linux extension remote code execution8.8CNA v3.10.5%2026-02-10Fix
CVE-2026-21533Microsoft Windows improper privilege management7.8CNA v3.14.1%2026-02-10KEVFix
CVE-2026-21531Microsoft Azure SDK for Python remote code execution9.8CNA v3.12.5%2026-02-10Exploit codeFix
CVE-2026-21529Microsoft Azure HDInsight spoofing5.7CNA v3.10.7%2026-02-10Fix
CVE-2026-21528Microsoft Azure IoT Explorer information disclosure6.5CNA v3.10.5%2026-02-10Fix
CVE-2026-21527Microsoft Exchange Server spoofing6.5CNA v3.18.1%2026-02-10Fix
CVE-2026-21525Microsoft Windows Null pointer dereference6.2CNA v3.14.8%2026-02-10KEVFix
CVE-2026-21523GitHub Copilot and Visual Studio Code remote code execution8.0CNA v3.10.8%2026-02-10Fix
CVE-2026-21522Microsoft ACI Confidential Containers elevation of privilege6.7CNA v3.10.4%2026-02-10Fix
CVE-2026-21519Microsoft Windows type confusion7.8CNA v3.12.5%2026-02-10KEVFix
CVE-2026-21518Microsoft GitHub Copilot and Visual Studio Code security feature bypass8.8CNA v3.11.4%2026-02-10Fix
CVE-2026-21517Microsoft Windows App for Mac Installer elevation of privilege4.7CNA v3.10.4%2026-02-10Fix
CVE-2026-21516Microsoft GitHub Copilot for Jetbrains remote code execution8.8CNA v3.10.8%2026-02-10Fix
CVE-2026-21514Microsoft Office Word reliance on untrusted inputs in a security decision7.8CNA v3.11.6%2026-02-10KEVExploit codeFix
CVE-2026-21513Microsoft MSHTML Framework protection mechanism failure8.8CNA v3.115.6%2026-02-10KEVKCVFix
CVE-2026-21512Microsoft Azure DevOps Server cross-site scripting6.5CNA v3.11.0%2026-02-10Fix
CVE-2026-21511Microsoft Outlook spoofing7.5CNA v3.13.9%2026-02-10Fix
CVE-2026-21510Microsoft Windows Shell protection mechanism failure8.8CNA v3.124.5%2026-02-10KEVExploit codeKCVFix
CVE-2026-21508Microsoft Windows Storage elevation of privilege7.0CNA v3.10.4%2026-02-10Exploit codeFix
CVE-2026-21358Adobe InDesign Desktop heap-based buffer overflow5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21357Adobe InDesign Desktop heap-based buffer overflow7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21355DNG SDK out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21354DNG SDK integer overflow or wraparound5.5CNA v3.10.1%2026-02-10Fix
CVE-2026-21353DNG SDK integer overflow or wraparound7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21352DNG SDK out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21351Adobe After Effects use-after-free7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21350Adobe After Effects null pointer dereference5.5CNA v3.10.1%2026-02-10Fix
CVE-2026-21349Adobe Lightroom Desktop out-of-bounds write7.8CNA v3.10.1%2026-02-10Fix
CVE-2026-21348Adobe Substance3D Modeler out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21347Adobe Bridge integer overflow or wraparound7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21346Adobe Bridge out-of-bounds write7.8CNA v3.10.1%2026-02-10Fix
CVE-2026-21345Adobe Substance3D Stager out-of-bounds read7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21344Adobe Substance3D Stager out-of-bounds read7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21343Adobe Substance3D Stager out-of-bounds read7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21342Adobe Substance3D Stager out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21341Adobe Substance3D Stager out-of-bounds write7.8CNA v3.10.1%2026-02-10Fix
CVE-2026-21340Substance3D Designer out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21339Substance3D Designer out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21338Substance3D Designer null pointer dereference5.5CNA v3.10.1%2026-02-10Fix
CVE-2026-21337Substance3D Designer out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21336Substance3D Designer null pointer dereference5.5CNA v3.10.1%2026-02-10Fix
CVE-2026-21335Substance3D Designer out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21334Substance3D Designer out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21332Adobe InDesign Desktop out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21330Adobe After Effects access of resource using incompatible type (type confusion)7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21329Adobe After Effects use-after-free7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21328Adobe After Effects out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21327Adobe After Effects out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21326Adobe After Effects use-after-free7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21325Adobe After Effects out-of-bounds read7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21324Adobe After Effects out-of-bounds read7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21323Adobe After Effects use-after-free7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21322Adobe After Effects out-of-bounds read7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21321Adobe After Effects integer overflow or wraparound7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21320Adobe After Effects use-after-free7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21319Adobe After Effects out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21318Adobe After Effects out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21317Adobe Audition out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21316Adobe Audition access of memory location after end of buffer5.5CNA v3.10.1%2026-02-10Fix
CVE-2026-21315Adobe Audition out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21314Adobe Audition out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21313Adobe Audition out-of-bounds read5.5CNA v3.10.2%2026-02-10Fix
CVE-2026-21312Adobe Audition out-of-bounds write7.8CNA v3.10.2%2026-02-10Fix
CVE-2026-21261Microsoft Excel information disclosure5.5CNA v3.10.6%2026-02-10Fix
CVE-2026-21260Microsoft Outlook spoofing7.5CNA v3.11.5%2026-02-10Fix
CVE-2026-21259Microsoft Excel elevation of privilege7.8CNA v3.10.6%2026-02-10Fix
CVE-2026-21258Microsoft Excel information disclosure5.5CNA v3.10.6%2026-02-10Fix
CVE-2026-21257GitHub Copilot and Visual Studio elevation of privilege8.0CNA v3.10.9%2026-02-10Fix
CVE-2026-21256GitHub Copilot and Visual Studio remote code execution8.8CNA v3.11.2%2026-02-10Fix
CVE-2026-21255Microsoft Windows Hyper-V security feature bypass8.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21253Microsoft Windows Mailslot File System elevation of privilege7.0CNA v3.10.8%2026-02-10Fix
CVE-2026-21251Microsoft Windows Cluster Client Failover (CCF) elevation of privilege7.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21250Microsoft Windows HTTP.sys elevation of privilege7.8CNA v3.11.1%2026-02-10Exploit codeFix
CVE-2026-21249Microsoft Windows NTLM spoofing3.3CNA v3.111.4%2026-02-10Fix
CVE-2026-21248Microsoft Windows Hyper-V remote code execution7.3CNA v3.11.3%2026-02-10Exploit codeFix
CVE-2026-21247Microsoft Windows Hyper-V remote code execution7.3CNA v3.10.6%2026-02-10Fix
CVE-2026-21246Microsoft Windows Graphics component elevation of privilege7.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21245Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21244Microsoft Windows Hyper-V remote code execution7.3CNA v3.11.3%2026-02-10Exploit codeFix
CVE-2026-21243Microsoft Windows Lightweight Directory Access Protocol (LDAP) denial of service7.5CNA v3.11.4%2026-02-10Fix
CVE-2026-21242Microsoft Windows subsystem for Linux elevation of privilege7.0CNA v3.10.4%2026-02-10Fix
CVE-2026-21241Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.12.6%2026-02-10Fix
CVE-2026-21240Microsoft Windows HTTP.sys elevation of privilege7.8CNA v3.10.3%2026-02-10Fix
CVE-2026-21239Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21238Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.13.4%2026-02-10Fix
CVE-2026-21237Microsoft Windows subsystem for Linux elevation of privilege7.0CNA v3.10.3%2026-02-10Fix
CVE-2026-21236Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21235Microsoft Windows Graphics component elevation of privilege7.3CNA v3.10.7%2026-02-10Fix
CVE-2026-21234Microsoft Windows Connected Devices Platform service elevation of privilege7.0CNA v3.10.3%2026-02-10Fix
CVE-2026-21232Microsoft Windows HTTP.sys elevation of privilege7.8CNA v3.10.4%2026-02-10Fix
CVE-2026-21231Microsoft Windows Kernel elevation of privilege7.8CNA v3.12.6%2026-02-10Fix
CVE-2026-21229Microsoft Power BI remote code execution8.0CNA v3.11.0%2026-02-10Fix
CVE-2026-21228Microsoft Azure Local remote code execution8.1CNA v3.10.8%2026-02-10Fix
CVE-2026-21222Microsoft Windows Kernel information disclosure5.5CNA v3.10.6%2026-02-10Fix
CVE-2026-21218Microsoft .NET spoofing7.5CNA v3.11.1%2026-02-10Fix
CVE-2026-20846Microsoft Office GDI+ denial of service7.5CNA v3.11.4%2026-02-10Fix
CVE-2026-20841Microsoft Windows Notepad App remote code execution7.8CNA v3.19.0%2026-02-10Exploit codeFix
CVE-2026-2303Heap out-of-bounds read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9CNA v4.00.2%2026-02-10Fix
CVE-2026-2302MongoDB Ruby Driver unsafe reflection in Mongoid::Criteria.from_hash6.9CNA v4.00.2%2026-02-10
CVE-2026-2268Ninja Forms WordPress plugin unauthenticated information disclosure in nf_ajax_submit AJAX action7.5CNA v3.10.4%2026-02-10Fix
CVE-2026-2260D-Link DCS-931L setSysAdmin os command injection8.6CNA v4.05.3%2026-02-10
CVE-2026-2259aardappel lobster Parsing parser.h ParseStatements memory corruption5.5v3.10.2%2026-02-10
CVE-2026-2258aardappel lobster wfc.h WaveFunctionCollapse memory corruption5.5v3.10.2%2026-02-10
CVE-2026-2099Flowring｜AgentFlow stored cross-site scripting5.1CNA v4.00.2%2026-02-10Fix
CVE-2026-2098Flowring｜AgentFlow reflected cross-site scripting5.1CNA v4.00.2%2026-02-10Fix
CVE-2026-2097Flowring｜Agentflow arbitrary file upload8.7CNA v4.00.5%2026-02-10Fix
CVE-2026-2096Flowring Agentflow missing authentication9.3CNA v4.00.6%2026-02-10Fix
CVE-2026-2095Flowring｜Agentflow authentication bypass9.3CNA v4.00.5%2026-02-10Fix
CVE-2026-2094Flowring｜Docpedia SQL injection8.7CNA v4.00.3%2026-02-10Fix
CVE-2026-2093Flowring｜Docpedia SQL injection8.7CNA v4.00.5%2026-02-10Fix
CVE-2026-1997Certain HP OfficeJet Pro Printers information disclosure6.9CNA v4.00.2%2026-02-10Fix
CVE-2026-1996Certain HP OfficeJet Pro Printers denial of service6.9CNA v4.00.3%2026-02-10Fix
CVE-2026-1922The Events Calendar Shortcode and Block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-10Fix
CVE-2026-1866Name Directory WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-02-10Fix
CVE-2026-1850MongoDB Server query planner resource exhaustion7.1CNA v4.00.3%2026-02-10Fix
CVE-2026-1849MongoDB Server mongod can run out of stack memory when expressions create deeply nested documents7.1CNA v4.00.3%2026-02-10Fix
CVE-2026-1848MongoDB Server proxy port connection handling resource exhaustion8.2CNA v4.00.3%2026-02-10Fix
CVE-2026-1847MongoDB Server may crash when inserting large documents7.1CNA v4.00.3%2026-02-10Fix
CVE-2026-1774CASL Ability,, contains a prototype pollution9.8CISA ADP v3.10.7%2026-02-10Fix
CVE-2026-1763Enervista UR Setup DLL hijacking4.6CNA v3.10.2%2026-02-10Fix
CVE-2026-1762Enervista UR Setup directory traversal2.9CNA v3.10.2%2026-02-10Fix
CVE-2026-1722WCFM Marketplace WordPress plugin insecure direct object reference5.3CNA v3.10.3%2026-02-10Fix
CVE-2026-1603Ivanti Endpoint Manager (EPM) authentication bypass8.6CNA v3.187.9%2026-02-10KEVNucleiEmerging ThreatsFix
CVE-2026-1602Ivanti Endpoint Manager SQL injection6.5CNA v3.10.7%2026-02-10Fix
CVE-2026-1507Uncaught exception vulnerability in AVEVA PI Data Archive8.7CNA v4.00.3%2026-02-10Fix
CVE-2026-1495Insertion of sensitive information into log file vulnerability in AVEVA PI to CONNECT Agent5.7CNA v4.00.1%2026-02-10Fix
CVE-2026-0996Fluent Forms WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-10Fix
CVE-2026-0845WCFM - WooCommerce Frontend Manager WordPress plugin arbitrary options update7.2CNA v3.10.5%2026-02-10Fix
CVE-2026-0653Insecure Access Control on TP-Link Tapo D235 and C2607.2CNA v4.00.4%2026-02-10Fix
CVE-2026-0652Remote code execution on TP-Link Tapo C260 by Guest User8.7CNA v4.023.3%2026-02-10Emerging ThreatsFix
CVE-2026-0651Path traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local HTTPS6.9CNA v4.00.3%2026-02-10Exploit codeFix
CVE-2026-0509Missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform9.6CNA v3.10.4%2026-02-10Fix
CVE-2026-0508Open redirect vulnerability in SAP BusinessObjects Business Intelligence Platform7.3CNA v3.10.3%2026-02-10Fix
CVE-2026-0505Multiple vulnerabilities in BSP Applications of SAP Document Management System6.1CNA v3.10.2%2026-02-10Fix
CVE-2026-0490Denial of service (DOS) in SAP BusinessObjects BI Platform7.5CNA v3.10.4%2026-02-10Fix
CVE-2026-0488Code injection vulnerability in SAP CRM and SAP S/4hana (Scripting Editor)9.9CNA v3.10.5%2026-02-10Fix
CVE-2026-0486Missing authorization Check in ABAP based SAP systems5.0CNA v3.10.2%2026-02-10Fix
CVE-2026-0485Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform7.5CNA v3.10.4%2026-02-10Fix
CVE-2026-0484Missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA6.5CNA v3.10.3%2026-02-10Fix
CVE-2026-25961SumatraPDF update mechanism improper certificate validation7.5CNA v3.10.4%2026-02-09Exploit code
CVE-2026-25958Cube privilege escalation via a specially crafted request7.7CNA v3.10.4%2026-02-09Fix
CVE-2026-25957Cube denial of service An authenticated attacker can crash the server6.5CNA v3.10.4%2026-02-09Fix
CVE-2026-25951FUXA has a path traversal Sanitization Bypass8.6CNA v4.01.8%2026-02-09Fix
CVE-2026-25939FUXA Unauthenticated Remote arbitrary Scheduler Write9.3CNA v4.00.9%2026-02-09Fix
CVE-2026-25938FUXA unauthenticated remote code execution in Node-RED Integration9.5CNA v4.01.4%2026-02-09Exploit codeFix
CVE-2026-25934go-git improperly verifies data integrity values for .idx and .pack files4.3CNA v3.10.2%2026-02-09Fix
CVE-2026-25931vscode-spell-checker has a workspace-trust bypass code execution7.8CNA v3.10.2%2026-02-09Fix
CVE-2026-25925PowerDocu affected by remote code execution via insecure deserialization7.8CNA v3.10.5%2026-02-09Fix
CVE-2026-25923mylittleforum phar deserialization leading to arbitrary file deletion in my little forum8.7CNA v4.00.7%2026-02-09Fix
CVE-2026-25920SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor5.5CNA v3.10.2%2026-02-09
CVE-2026-25918unity-cli exposes Plaintext Credentials in Debug Logs (sign-package command)5.9CNA v4.00.2%2026-02-09Fix
CVE-2026-25916Roundcube Webmail unprotected alternate channel4.3CNA v3.10.5%2026-02-09Emerging ThreatsExploit codeFix
CVE-2026-25905Lack of isolation in mcp-run-python leads to MCP server takeover5.8CNA v3.10.2%2026-02-09
CVE-2026-25904Overly permissive Deno configuration in mcp-run-python leads to SSRF5.8CNA v3.10.2%2026-02-09
CVE-2026-25895FUXA unauthenticated remote code execution via arbitrary file write in Upload API9.5CNA v4.06.3%2026-02-09NucleiExploit codeFix
CVE-2026-25894FUXA unauthenticated remote code execution via Hard-coded JWT Secret in Default Configuration9.5CNA v4.01.3%2026-02-09Fix
CVE-2026-25893FUXA unauthenticated remote code execution via Admin JWT Minting10.0CNA v4.01.1%2026-02-09Fix
CVE-2026-25892Adminer has an Unauthenticated Persistent DoS via Array injection in ?script=version endpoint7.5CNA v3.11.9%2026-02-09NucleiFix
CVE-2026-25890filebrowser File Browser has a Path-Based Access Control Bypass via multiple leading Slashes in URL8.1CNA v3.10.6%2026-02-09Fix
CVE-2026-25889filebrowser File Browser has an authentication bypass in User Password Update5.4CNA v3.10.4%2026-02-09Fix
CVE-2026-25885PolarLearn group chat WebSocket missing authentication10.0CNA v4.00.4%2026-02-09Fix
CVE-2026-25881@nyariv/SandboxJS has host prototype pollution from sandbox via array intermediary (sandbox escape)9.1CNA v3.10.7%2026-02-09Fix
CVE-2026-25880Untrusted search path in SumatraPDF Reader (explorer.exe on Windows)7.8CNA v3.10.2%2026-02-09
CVE-2026-25878FroshAdminer Adminer UI is accessible without admin session6.9CNA v4.00.5%2026-02-09Fix
CVE-2026-25876PlaciPy is missing authorization on Assessment results endpoint5.3CNA v4.00.5%2026-02-09Fix
CVE-2026-25875PlaciPy admin privilege escalation via Trusted JWT Claims9.3CNA v4.00.5%2026-02-09Fix
CVE-2026-25848JetBrains Hub missing authentication9.1CNA v3.10.6%2026-02-09Fix
CVE-2026-25847JetBrains PyCharm cross-site scripting8.2CNA v3.10.3%2026-02-09Fix
CVE-2026-25846JetBrains YouTrack sensitive information in log files6.5CNA v3.11.1%2026-02-09Fix
CVE-2026-25814Praskla-Technology assessment-placipy NoSQL injection Risk via Unsanitized Query parameters9.3CNA v4.00.6%2026-02-09Fix
CVE-2026-25813PlaciPy exposes Sensitive Data via Application Logs8.7CNA v4.00.4%2026-02-09Fix
CVE-2026-25812PlaciPy is missing CSRF Protection on State-Changing endpoints9.3CNA v4.00.2%2026-02-09Fix
CVE-2026-25811PlaciPy Email Domain Trust enables Cross-Tenant Data Access (Multi-Tenant Isolation failure)5.3CNA v4.00.4%2026-02-09Fix
CVE-2026-25810PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts5.3CNA v4.00.5%2026-02-09Fix
CVE-2026-25809PlaciPy code execution Allowed without Assessment Active State Validation5.3CNA v4.00.6%2026-02-09Fix
CVE-2026-25808Hollo DMs get leaked and can be seen on Webfinger Browser7.5CNA v3.10.5%2026-02-09Fix
CVE-2026-25807Unauthenticated remote code execution via P2P Sharing in ZAI-Shell8.8CNA v3.10.9%2026-02-09Fix
CVE-2026-25806PlaciPy has missing authorization Checks on Student Management Endpoints (IDOR)5.3CNA v4.00.4%2026-02-09Fix
CVE-2026-25791Sliver has a DNS C2 OTP Bypass allows Unauthenticated Session Flooding and denial of service7.5CNA v3.10.5%2026-02-09Fix
CVE-2026-25765Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url5.8CNA v3.10.4%2026-02-09Fix
CVE-2026-25761Command injection via crafted filenames in Super-linter action8.8CNA v3.12.1%2026-02-09Fix
CVE-2026-25740Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module5.8CNA v4.00.2%2026-02-09
CVE-2026-25639Axios affected by denial of service via __proto__ Key in mergeConfig7.5CNA v3.11.8%2026-02-09Fix
CVE-2026-25598Bypassing Logging of Outbound Connections using sendto, sendmsg, and sendmmsg in Harden-Runner6.3CNA v4.00.4%2026-02-09Fix
CVE-2026-25528langchain-ai langsmith-sdk LangSmith Client SDK affected by server-side request forgery5.8CNA v3.10.3%2026-02-09Fix
CVE-2026-25498Craft has a potential authenticated remote code execution via malicious attached Behavior8.6CNA v4.01.2%2026-02-09Fix
CVE-2026-25497Craft has a GraphQL Asset Mutation privilege escalation8.6CNA v4.00.5%2026-02-09Fix
CVE-2026-25496Craft has a stored XSS in Number Prefix and Suffix fields4.8CNA v4.00.4%2026-02-09Fix
CVE-2026-25495Craft has a SQL injection in Element Indexes via criteria[orderBy]8.7CNA v4.00.6%2026-02-09Fix
CVE-2026-25494Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation6.9CNA v4.00.4%2026-02-09Fix
CVE-2026-25493Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect6.9CNA v4.00.4%2026-02-09Fix
CVE-2026-25492Craft CMS save_images_Asset GraphQL mutation server-side request forgery5.3CNA v4.00.4%2026-02-09Fix
CVE-2026-25491Craft has a stored XSS in Entry Types Name1.9CNA v4.00.3%2026-02-09Fix
CVE-2026-25480litestar FileStore key canonicalization collisions allow response cache mixup/poisoning6.5CNA v3.10.5%2026-02-09Fix
CVE-2026-25479Litestar allowed hosts middleware vulnerability6.5CNA v3.10.4%2026-02-09Fix
CVE-2026-25478Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins7.4CNA v3.10.5%2026-02-09Fix
CVE-2026-25231FileRise affected by an Unauthenticated File Read due to insufficient access control7.5CNA v3.11.6%2026-02-09NucleiFix
CVE-2026-25230FileRise affected by HTML injection using color property in file tags4.6CNA v3.10.2%2026-02-09Fix
CVE-2026-25057Zip Slip in MarkUs config upload allowing RCE9.1CNA v3.10.5%2026-02-09Exploit codeFix
CVE-2026-24900MarkUs has a submission-view IDOR exposes all student submissions6.5CNA v3.10.3%2026-02-09Fix
CVE-2026-24777OpenProject user management missing authorization6.7CNA v3.10.3%2026-02-09Fix
CVE-2026-24684FreeRDP has a Heap-use-after-free in play_thread8.7CNA v4.00.6%2026-02-09Fix
CVE-2026-24683FreeRDP has a heap-use-after-free in ainput_send_input_event8.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24682FreeRDP heap-based buffer overflow8.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24681FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb8.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24680FreeRDP has a heap-use-after-free in update_pointer_new(SDL)8.7CNA v4.00.4%2026-02-09Fix
CVE-2026-24679FreeRDP heap-based buffer overflow8.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24678FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread8.7CNA v4.00.7%2026-02-09Fix
CVE-2026-24677FreeRDP webcam redirection H.264 encoder out-of-bounds read8.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24676FreeRDP has a heap-use-after-free in audio_format_compatible7.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24675FreeRDP has a Heap-use-after-free in urb_select_interface7.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24491FreeRDP has a heap-use-after-free in video_timer7.7CNA v4.00.5%2026-02-09Fix
CVE-2026-24466Oki Electric Industry See "References" section unquoted search path8.4CNA v4.00.1%2026-02-09
CVE-2026-24098Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors6.5CISA ADP v3.10.8%2026-02-09Fix
CVE-2026-24095Checkmk missing permission check on Analyze Configuration page5.3CNA v4.00.2%2026-02-09Fix
CVE-2026-24027PowerDNS Recursor crafted zones can lead to increased incoming network traffic5.3CNA v3.10.4%2026-02-09Fix
CVE-2026-23948FreeRDP has a null pointer dereference in rdp_write_logon_info_v26.9CNA v4.00.5%2026-02-09Fix
CVE-2026-23903Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems5.3CISA ADP v3.10.4%2026-02-09Fix
CVE-2026-22922Apache Airflow: Airflow externalLogUrl permission bypass6.5CISA ADP v3.10.4%2026-02-09Fix
CVE-2026-22906WAGO 0852-1322 hard-coded key allows credential disclosure9.8CNA v3.10.3%2026-02-09Fix
CVE-2026-22905WAGO 0852-1322 authentication bypass via URI Traversal7.5CNA v3.10.6%2026-02-09Fix
CVE-2026-22904WAGO 0852-1322 stack overflow via Oversized Cookie fields in lighttpd9.8CNA v3.10.6%2026-02-09Fix
CVE-2026-22903WAGO 0852-1322 stack overflow via SESSIONID Cookie in lighttpd9.8CNA v3.10.7%2026-02-09Fix
CVE-2026-22613Eaton Network M3 improper certificate validation5.7CNA v3.10.2%2026-02-09Fix
CVE-2026-21419Dell Display and Peripheral Manager (Windows) link following6.6CNA v3.10.2%2026-02-09Fix
CVE-2026-2246AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption4.8CNA v4.00.2%2026-02-09
CVE-2026-2245CCExtractor MPEG-TS file ts_tables.c parse_PMT out-of-bounds4.8CNA v4.00.1%2026-02-09
CVE-2026-2242janet-lang janet specials.c janetc_if out-of-bounds6.1v3.10.2%2026-02-09
CVE-2026-2241Janet os_strftime function out-of-bounds read6.1v3.10.2%2026-02-09
CVE-2026-2240janet-lang janet compile.c janetc_pop_funcdef out-of-bounds6.1v3.10.2%2026-02-09
CVE-2026-2236HGiga｜C&Cm@il SQL injection8.7CNA v4.00.4%2026-02-09Fix
CVE-2026-2235HGiga｜C&Cm@il SQL injection7.1CNA v4.00.3%2026-02-09Fix
CVE-2026-2234HGiga｜C&Cm@il missing authentication9.3CNA v4.00.5%2026-02-09Fix
CVE-2026-2227D-Link DCS-931L setSystemAdmin doSystem command injection7.2v3.16.2%2026-02-09
CVE-2026-2226DouPHP ZIP file file.php unrestricted upload7.2v3.10.4%2026-02-09
CVE-2026-2225itsourcecode News Portal Project Administrator Login index.php SQL injection9.8v3.10.4%2026-02-09
CVE-2026-2224code-projects Online Reviewer System btn_functions.php cross-site scripting5.4v3.10.2%2026-02-09
CVE-2026-2223code-projects Online Reviewer System index.php SQL injection9.8v3.10.5%2026-02-09
CVE-2026-2222code-projects Online Reviewer System btn_functions.php cross-site scripting4.8v3.10.2%2026-02-09
CVE-2026-2221code-projects Online Reviewer System Login index.php SQL injection9.8v3.10.4%2026-02-09
CVE-2026-2220code-projects Online Reviewer System btn_functions.php SQL injection9.8v3.10.4%2026-02-09
CVE-2026-2218D-Link DCS-933L alphapd setSystemAdmin command injection8.8v3.14.0%2026-02-09
CVE-2026-2217itsourcecode Event Management System manage_user.php SQL injection9.8v3.10.3%2026-02-09
CVE-2026-2216rachelos WeRSS we-mp-rss tools.py download_export_file path traversal5.3CNA v4.00.3%2026-02-09
CVE-2026-2215rachelos WeRSS we-mp-rss JWT auth.py default key6.3CNA v4.00.3%2026-02-09
CVE-2026-2214code-projects for Plugin AdminAddAlbum.php cross-site scripting4.8v3.10.2%2026-02-09
CVE-2026-2213code-projects Online Music Site AdminAddAlbum.php unrestricted upload7.2v3.10.3%2026-02-09
CVE-2026-2212code-projects Online Music Site AdminEditCategory.php SQL injection9.8v3.10.3%2026-02-09
CVE-2026-2211code-projects Online Music Site AdminDeleteCategory.php SQL injection9.8v3.10.3%2026-02-09
CVE-2026-2210D-Link DIR-823X set_filtering sub_4211C8 os command injection8.6CNA v4.04.1%2026-02-09
CVE-2026-2203Tenda AC8 Embedded Httpd service fast_setting_wifi_set buffer overflow8.7CNA v4.00.8%2026-02-09
CVE-2026-2202Tenda AC8 httpd WifiGuestSet fromSetWifiGusetBasic buffer overflow8.7CNA v4.00.8%2026-02-09
CVE-2026-2201ZeroWdd studentmanager LeaveController.java addLeave cross-site scripting5.4v3.10.2%2026-02-09
CVE-2026-2200heyewei JFinalCMS API endpoint save cross-site scripting4.8v3.10.2%2026-02-09
CVE-2026-2199code-projects Online Reviewer System user-delete.php SQL injection9.8v3.10.3%2026-02-09
CVE-2026-2198code-projects Online Reviewer System loaddata.php SQL injection9.8v3.10.4%2026-02-09
CVE-2026-2197code-projects Online Reviewer System exam-delete.php SQL injection9.8v3.10.3%2026-02-09
CVE-2026-2196code-projects Online Reviewer System exam-update.php SQL injection9.8v3.10.4%2026-02-09
CVE-2026-2195code-projects Online Reviewer System questions-view.php SQL injection9.8v3.10.3%2026-02-09
CVE-2026-2194D-Link DI-7100G C1 start_proxy_client_email command injection8.8v3.14.0%2026-02-09
CVE-2026-1960Stored cross-site scripting (XSS) vulnerability in Loggro Pymes5.1CNA v4.00.4%2026-02-09Fix
CVE-2026-1959Stored cross-site scripting (XSS) vulnerability in Loggro Pymes5.1CNA v4.00.4%2026-02-09Fix
CVE-2026-1868Improper neutralization of special elements used in a template engine in GitLab AI Gateway9.9CNA v3.10.5%2026-02-09Fix
CVE-2026-1615jsonpath has arbitrary code injection via Unsafe Evaluation of JSON Path Expressions9.2CNA v4.01.1%2026-02-09Fix
CVE-2026-1529Keycloak affected by improper invitation token validation8.1CNA v3.10.5%2026-02-09Exploit codeFix
CVE-2026-1486Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens8.8CNA v3.10.5%2026-02-09Fix
CVE-2026-0870GIGABYTE｜MacroHub local privilege escalation8.5CNA v4.00.1%2026-02-09Fix
CVE-2026-0632Fluent Forms Pro Add On Pack WordPress plugin server-side request forgery5.4CNA v3.10.2%2026-02-09Fix
CVE-2026-0398PowerDNS Recursor resource exhaustion5.3CNA v3.10.3%2026-02-09Fix
CVE-2026-2209WeKan Custom Translation translationBody.js setCreateTranslation improper authorization4.3v3.10.2%2026-02-08Fix
CVE-2026-2208WeKan Rules rules.js RulesBleed authorization6.5v3.10.3%2026-02-08Fix
CVE-2026-2207WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure6.9CNA v4.00.4%2026-02-08Fix
CVE-2026-2206WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control8.8v3.10.3%2026-02-08Fix
CVE-2026-2205WeKan Meteor Publication cards.js CardPubSubBleed information disclosure5.3CNA v4.00.3%2026-02-08Fix
CVE-2026-2193D-Link DI-7100G C1 set_jhttpd_info command injection8.8v3.13.5%2026-02-08
CVE-2026-2192Tenda AC9 formGetRebootTimer stack-based overflow8.6CNA v4.00.7%2026-02-08
CVE-2026-2191Tenda AC9 formGetDdosDefenceList stack-based overflow8.6CNA v4.00.7%2026-02-08
CVE-2026-2190itsourcecode School Management System controller.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2189itsourcecode School Management System index.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2188UTT 进取 521G formPdbUpConfig sub_446B18 os command injection8.6CNA v4.06.8%2026-02-08
CVE-2026-2187Tenda RX3 formSetQosBand set_qosMib_list stack-based overflow8.7CNA v4.00.9%2026-02-08
CVE-2026-2186Tenda RX3 SetIpMacBind fromSetIpMacBind stack-based overflow8.7CNA v4.00.9%2026-02-08
CVE-2026-2185Tenda RX3 MAC Filtering Configuration endpoint setBlackRule set_device_name stack-based overflow8.7CNA v4.00.7%2026-02-08
CVE-2026-2184Great Developers Certificate Generation System csv.php os command injection9.8v3.110.3%2026-02-08
CVE-2026-2183Great Developers Certificate Generation System csv.php unrestricted upload9.8v3.10.2%2026-02-08
CVE-2026-2182UTT 进取 521G setSysAdm doSystem command injection8.6CNA v4.09.7%2026-02-08
CVE-2026-2181Tenda RX3 openSchedWifi stack-based overflow8.7CNA v4.00.6%2026-02-08
CVE-2026-2180Tenda RX3 fast_setting_wifi_set stack-based overflow8.7CNA v4.00.6%2026-02-08
CVE-2026-2179PHPGurukul Hospital Management System manage-users.php SQL injection7.2v3.10.3%2026-02-08
CVE-2026-2178r-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injection8.8v3.13.4%2026-02-08
CVE-2026-2177SourceCodester Prison Management System Login session fixiation6.9CNA v4.00.3%2026-02-08
CVE-2026-2176code-projects Contact Management System index.py SQL injection8.8v3.10.3%2026-02-08
CVE-2026-2175D-Link DIR-823X set_upnp sub_420618 os command injection8.6CNA v4.04.0%2026-02-08
CVE-2026-2174code-projects Contact Management System CRUD endpoint improper authentication9.8v3.10.6%2026-02-08
CVE-2026-2173code-projects Online Examination System login.php SQL injection9.8v3.10.3%2026-02-08
CVE-2026-2172code-projects Online Application System for Admission Login endpoint index.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2171code-projects Online Student Management System Login accounts.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2169D-Link DWR-M921 formLtefotaUpgradeFibocom command injection8.8v3.13.0%2026-02-08Fix
CVE-2026-2168D-Link DWR-M921 formLtefotaUpgradeQuectel sub_419920 command injection8.8v3.13.5%2026-02-08Fix
CVE-2026-2167Totolink WA300 cstecgi.cgi setAPNetwork os command injection8.8v3.12.4%2026-02-08
CVE-2026-2166code-projects Online Reviewer System Login index.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2165detronetdip E-commerce Account Creation endpoint add_seller.php missing authentication9.8v3.10.6%2026-02-08
CVE-2026-2164detronetdip E-commerce addadhar.php unrestricted upload9.8v3.10.5%2026-02-08
CVE-2026-2163D-Link DIR-600 ssdp.cgi command injection7.2v3.16.0%2026-02-08
CVE-2026-2162itsourcecode News Portal Project aboutus.php SQL injection7.2v3.10.3%2026-02-08
CVE-2026-2161itsourcecode Directory Management System forget-password.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2160SourceCodester Simple Responsive Tourism Website Master.php cross-site scripting6.1v3.10.3%2026-02-08
CVE-2026-2159SourceCodester Simple Responsive Tourism Website Registration Master.php cross-site scripting6.1v3.10.4%2026-02-08
CVE-2026-2158code-projects Student Web Portal check_user.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-2157D-Link DIR-823X set_static_route_table sub_4175CC os command injection8.6CNA v4.04.2%2026-02-08
CVE-2026-2156Online Student Management System Announcement Management module cross-site scripting4.8v3.10.2%2026-02-08
CVE-2026-2155D-Link DIR-823X Configuration set_dmz sub_4208A0 os command injection8.6CNA v4.04.1%2026-02-08
CVE-2026-2154Patients Waiting Area Queue Management System Patient Registration module cross-site scripting6.1v3.10.3%2026-02-08
CVE-2026-2153mwielgoszewski doorman views.py is_safe_url redirect6.1v3.10.3%2026-02-08
CVE-2026-2152D-Link DIR-615 Web Configuration adv_routing.php os command injection8.6CNA v4.04.8%2026-02-08
CVE-2026-2151D-Link DIR-615 DMZ host feature adv_firewall.php os command injection8.6CNA v4.04.7%2026-02-08
CVE-2026-2150Patients Waiting Area Queue Management System checkin.php cross-site scripting6.1v3.10.4%2026-02-08
CVE-2026-2149Patients Waiting Area Queue Management System appointments.php cross-site scripting6.1v3.10.4%2026-02-08
CVE-2026-2148Tenda AC21 Web Management DownloadFlash information disclosure7.5v3.10.6%2026-02-08
CVE-2026-2147Tenda AC21 Web Management DownloadLog information disclosure6.9CNA v4.00.6%2026-02-08
CVE-2026-2146guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload8.8v3.10.3%2026-02-08
CVE-2026-2145cym1102 nginxWebUI Web Management check cross-site scripting5.4v3.10.3%2026-02-08
CVE-2026-2143D-Link DIR-823X DDNS service set_ddns os command injection8.6CNA v4.04.6%2026-02-08
CVE-2026-2142D-Link DIR-823X set_qos sub_420688 os command injection8.6CNA v4.06.0%2026-02-08
CVE-2026-2141WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization8.8v3.10.4%2026-02-08Fix
CVE-2026-2140Tenda TX9 setMacFilterCfg sub_4223E0 buffer overflow8.7CNA v4.00.8%2026-02-08
CVE-2026-2139Tenda TX9 fast_setting_wifi_set sub_432580 buffer overflow8.7CNA v4.00.7%2026-02-08
CVE-2026-2138Tenda TX9 SetStaticRouteCfg sub_42D03C buffer overflow8.7CNA v4.00.8%2026-02-08
CVE-2026-2137Tenda TX3 SetIpMacBind buffer overflow8.7CNA v4.00.8%2026-02-08
CVE-2026-2136Online Food Ordering System view-ticket.php SQL injection9.8v3.10.3%2026-02-08
CVE-2026-2135UTT HiPER 810 formPdbUpConfig sub_43F020 command injection8.8v3.14.5%2026-02-08
CVE-2026-2134PHPGurukul Hospital Management System manage-doctors.php SQL injection7.2v3.10.3%2026-02-08
CVE-2026-2133code-projects Online Music Site AdminUpdateCategory.php unrestricted upload9.8v3.10.4%2026-02-08
CVE-2026-2132code-projects Online Music Site AdminUpdateCategory.php SQL injection9.8v3.10.3%2026-02-08
CVE-2026-2131XixianLiang HarmonyOS-mcp-server input_text os command injection8.8v3.117.5%2026-02-08
CVE-2026-2130BurtTheCoder mcp-maigret search_username index.ts command injection9.8v3.11.8%2026-02-08Fix
CVE-2026-2129D-Link DIR-823X set_ac_status os command injection8.6CNA v4.04.6%2026-02-08
CVE-2026-2122Xiaopi Panel WAF Firewall demo.php SQL injection9.8v3.10.3%2026-02-08
CVE-2026-2120D-Link DIR-823X Configuration parameter set_server_settings os command injection8.6CNA v4.04.2%2026-02-08
CVE-2026-2118UTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection8.6CNA v4.04.5%2026-02-08
CVE-2026-2117itsourcecode Society Management System edit_activity.php SQL injection9.8v3.10.3%2026-02-08
CVE-2026-2116itsourcecode Society Management System edit_expenses.php SQL injection9.8v3.10.4%2026-02-08
CVE-2026-25859WeKan Migration Functionality insufficient permission Checks8.8v3.10.5%2026-02-07Fix
CVE-2026-25858macrozheng mall Unauthenticated Password Reset via OTP Disclosure9.8NVD v3.11.1%2026-02-07
CVE-2026-25857Tenda G300-f command injection via formSetWanDiag8.8v3.12.9%2026-02-07Exploit code
CVE-2026-25568WeKan allowPrivateOnly Setting Enforcement Bypass4.3NVD v3.10.4%2026-02-07Fix
CVE-2026-25567WeKan Card Comment Author spoofing via User-controlled authorId4.3v3.10.3%2026-02-07Fix
CVE-2026-25566WeKan Cross-board Card Move without Destination Authorization5.4NVD v3.10.3%2026-02-07Fix
CVE-2026-25565WeKan Read-only Board Roles can Update Cards6.5NVD v3.10.4%2026-02-07Fix
CVE-2026-25564WeKan Checklist Deletion IDOR via Missing Relationship Validation7.5v3.10.4%2026-02-07Fix
CVE-2026-25563WeKan Checklist Creation Cross-Board IDOR7.5v3.10.4%2026-02-07Fix
CVE-2026-25562WeKan Attachments Publication information disclosure4.3v3.10.4%2026-02-07Fix
CVE-2026-25561WeKan Attachment upload Object Relationship Validation Bypass7.5v3.10.4%2026-02-07Fix
CVE-2026-25560WeKan LDAP Authentication Filter injection9.8v3.10.9%2026-02-07Fix
CVE-2026-2115itsourcecode Society Management System delete_expenses.php SQL injection9.8v3.10.3%2026-02-07
CVE-2026-2114itsourcecode Society Management System edit_admin.php SQL injection9.8v3.10.4%2026-02-07
CVE-2026-2113yuan1994 tpAdmin WebUploader preview.php deserialization9.8v3.12.2%2026-02-07NucleiExploit code
CVE-2026-2111JeecgBoot Retrieval-Augmented Generation edit path traversal5.3CNA v4.00.6%2026-02-07
CVE-2026-2110Tasin1025 SwiftBuy login.php excessive authentication8.1v3.10.7%2026-02-07
CVE-2026-2109jsbroks COCO Annotator Delete Category undo improper authorization8.1v3.10.4%2026-02-07
CVE-2026-2108jsbroks COCO Annotator endpoint long_task denial of service7.5v3.10.7%2026-02-07
CVE-2026-2107yeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2106yeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2105yeqifu warehouse Department Management DeptController.java deleteDept improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2090SourceCodester Online Class Record System search.php SQL injection9.8v3.10.3%2026-02-07
CVE-2026-2089SourceCodester Online Class Record System controller.php SQL injection9.8v3.10.3%2026-02-07
CVE-2026-2088PHPGurukul Beauty Parlour Management System accepted-appointment.php SQL injection9.8v3.10.4%2026-02-07
CVE-2026-2087SourceCodester Online Class Record System login.php SQL injection9.8v3.10.3%2026-02-07
CVE-2026-2086UTT HiPER 810G Management formFireWall strcpy buffer overflow8.7CNA v4.00.7%2026-02-07
CVE-2026-2085D-Link DWR-M921 USSD Configuration endpoint formUSSDSetup sub_419F20 command injection8.6CNA v4.05.2%2026-02-07Fix
CVE-2026-2084D-Link DIR-823X set_language os command injection8.6CNA v4.04.6%2026-02-07
CVE-2026-2083code-projects Social Networking Site delete_post.php SQL injection9.8v3.10.3%2026-02-07
CVE-2026-2082D-Link DIR-823X set_mac_clone os command injection7.2v3.15.2%2026-02-07
CVE-2026-2081D-Link DIR-823X set_password os command injection7.2v3.16.4%2026-02-07
CVE-2026-2080UTT HiPER 810 formUser setSysAdm command injection8.6CNA v4.010.8%2026-02-07
CVE-2026-2079yeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2078yeqifu warehouse Permission Management improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2077yeqifu warehouse Role Management RoleController.java deleteRole improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2076yeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization8.8v3.10.3%2026-02-07
CVE-2026-2075yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control8.8v3.10.3%2026-02-07
CVE-2026-2074O2OA HTTP POST request check XML external entity reference5.3CNA v4.00.3%2026-02-07
CVE-2026-2073itsourcecode School Management System index.php SQL injection9.8v3.10.3%2026-02-07
CVE-2026-2071UTT 进取 520W formP2PLimitConfig strcpy buffer overflow8.7CNA v4.00.8%2026-02-07
CVE-2026-1675Advanced Country Blocker WordPress plugin unauthenticated authorization bypass5.3CNA v3.10.4%2026-02-07Fix
CVE-2026-1643MP-Ukagaka WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-02-07
CVE-2026-1634Subitem AL Slider WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-02-07
CVE-2026-1613Wonka Slide WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode6.4CNA v3.10.2%2026-02-07
CVE-2026-1611Wikiloops Track Player WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-02-07
CVE-2026-1608Video Onclick WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-02-07
CVE-2026-1573OMIGO WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode6.4CNA v3.10.2%2026-02-07
CVE-2026-1570Simple Bible Verse via Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-02-07
CVE-2026-1082TITLE ANIMATOR WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-02-07
CVE-2026-0555Premmerce WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-07Fix
CVE-2026-25804Antrea has invalid enforcement order for network policy rules caused by integer overflow8.0CNA v4.00.7%2026-02-06Fix
CVE-2026-258033DP-MANAGER Uses hard-coded credentials9.8CNA v3.10.6%2026-02-06Fix
CVE-2026-25793Nebula has possible Blocklist Bypass via ECDSA Signature Malleability7.6CNA v4.00.2%2026-02-06Fix
CVE-2026-25764OpenProject vulnerable to stored HTML injection3.5CNA v3.10.4%2026-02-06Fix
CVE-2026-25763Command injection on OpenProject repositories leads to remote code execution9.4CNA v4.00.7%2026-02-06Fix
CVE-2026-25762AdonisJS vulnerable to denial of service7.5CNA v3.10.7%2026-02-06Fix
CVE-2026-25760Website path traversal / arbitrary file read (Authenticated) in Sliver6.5CNA v3.10.6%2026-02-06Fix
CVE-2026-25758Spree allows unauthenticated users can access all guest addresses7.7CNA v4.00.8%2026-02-06Fix
CVE-2026-25757Unauthenticated Spree Commerce users can view completed guest orders by Order ID7.7CNA v4.00.5%2026-02-06Fix
CVE-2026-25754AdonisJS multipart body parsing has prototype pollution issue7.2CNA v3.10.6%2026-02-06Fix
CVE-2026-25753PlaciPy has a Hard-Coded default password for All Student Accounts (account takeover)9.3CNA v4.00.6%2026-02-06Fix
CVE-2026-25752FUXA Unauthenticated Remote arbitrary Device Tag Write9.3CNA v4.00.7%2026-02-06Fix
CVE-2026-25751FUXA Unauthenticated Exposure of Plaintext Database Credentials9.1CNA v4.00.4%2026-02-06Fix
CVE-2026-25749Heap overflow in Vim6.6CNA v3.10.2%2026-02-06Fix
CVE-2026-25732NiceGUI's path traversal via Unsanitized FileUpload.name enables arbitrary file write7.5CNA v3.13.3%2026-02-06Exploit codeFix
CVE-2026-25731Calibre affected by arbitrary code execution7.8CNA v3.10.3%2026-02-06Exploit codeFix
CVE-2026-25729DeepAudit affected by User Enumeration via broken access control2.1CNA v4.00.4%2026-02-06Fix
CVE-2026-25727time affected by a stack exhaustion denial of service attack6.8CNA v4.00.3%2026-02-06Fix
CVE-2026-25725anthropics claude-code claude Code has sandbox escape7.7CNA v4.00.7%2026-02-06Fix
CVE-2026-25724anthropics claude-code Claude Code has Permission Deny Bypass through Symbolic Links2.3CNA v4.00.7%2026-02-06Fix
CVE-2026-25723anthropics claude-code Claude Code vulnerable to command injection7.7CNA v4.00.5%2026-02-06Fix
CVE-2026-25722anthropics claude-code Claude Code vulnerable to command injection7.7CNA v4.00.7%2026-02-06Fix
CVE-2026-25651client-certificate-auth has an open redirect via host header injection in HTTP-to-HTTPS redirect6.1CNA v3.10.2%2026-02-06Fix
CVE-2026-25650MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token6.6CNA v4.00.6%2026-02-06Fix
CVE-2026-25647siyuan-note siyuan lute has a stored cross-site scripting (XSS) via Markdown hyperlink4.6CNA v3.10.3%2026-02-06Fix
CVE-2026-25644DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade7.5CNA v3.10.4%2026-02-06Fix
CVE-2026-25643Frigate affected by authenticated remote command execution (RCE) and Container Escape9.1CNA v3.14.2%2026-02-06Exploit codeFix
CVE-2026-25642HedgeDoc security headers for uploaded files were not working4.3CNA v3.10.4%2026-02-06Fix
CVE-2026-25641SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses10.0CNA v3.10.6%2026-02-06Fix
CVE-2026-25640Pydantic AI affected by stored XSS via path traversal in Web UI CDN URL7.1CNA v3.10.5%2026-02-06Fix
CVE-2026-25636calibre has a path traversal leading to arbitrary File Corruption and code execution8.2CNA v3.10.2%2026-02-06Fix
CVE-2026-25635calibre has a path traversal leading to arbitrary file write and potential code execution8.6CNA v3.10.4%2026-02-06Fix
CVE-2026-25634iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply7.8CNA v3.10.3%2026-02-06Fix
CVE-2026-25632EPyT-Flow has unsafe JSON deserialization (__type__)10.0CNA v3.11.4%2026-02-06Exploit codeFix
CVE-2026-25631n8n-io n8n domain allowlist bypass enables credential exfiltration5.3CNA v4.00.4%2026-02-06Fix
CVE-2026-25628Qdrant affected by arbitrary file write via `/logger` endpoint8.6CNA v3.10.7%2026-02-06Fix
CVE-2026-25597PrestaShop has a time based enumeration in FO login form5.3CNA v3.10.5%2026-02-06Fix
CVE-2026-25593OpenClaw affected by unauthenticated local RCE via WebSocket config.apply8.4CNA v3.11.0%2026-02-06Fix
CVE-2026-25592Microsoft semantic-kernel semantic Kernel has an arbitrary file write10.0CNA v3.12.4%2026-02-06Fix
CVE-2026-25587SandboxJS has a sandbox escape10.0CNA v3.10.7%2026-02-06Fix
CVE-2026-25586SandboxJS has a sandbox escape via Prototype Whitelist Bypass and host prototype pollution10.0CNA v3.10.7%2026-02-06Fix
CVE-2026-25581SCEditor affected by DOM XSS via emoticon URL/HTML injection5.4CNA v3.10.3%2026-02-06Fix
CVE-2026-25580Pydantic AI affected by server-side request forgery (SSRF) in URL Download Handling8.6CNA v3.10.7%2026-02-06Fix
CVE-2026-25574Payload affected by Cross-Collection IDOR in payload-preferences Access Control5.4CNA v3.10.3%2026-02-06Fix
CVE-2026-25556MuPDF Barcode Decoding double free7.5v3.10.8%2026-02-06Fix
CVE-2026-25544Payload has an SQL injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters9.8CNA v3.11.0%2026-02-06Exploit codeFix
CVE-2026-25533Enclave has a sandbox escape via infinite recursion and error objects6.4CNA v4.00.2%2026-02-06Fix
CVE-2026-25520SandboxJS has a sandbox escape10.0CNA v3.10.9%2026-02-06Fix
CVE-2026-25516NiceGUI's XSS vulnerability in ui.markdown allows arbitrary JavaScript execution6.1CNA v3.10.3%2026-02-06Fix
CVE-2026-25123Homarr affected by unauthenticated SSRF / Port-Scan Primitive via widget.app.ping5.3CNA v3.10.3%2026-02-06Fix
CVE-2026-24931Huawei HarmonyOS vulnerability of improper criterion security check in the card module5.9CNA v3.10.1%2026-02-06Fix
CVE-2026-24930Huawei HarmonyOS UAF concurrency vulnerability in the graphics module8.4CNA v3.10.1%2026-02-06Fix
CVE-2026-24929Huawei HarmonyOS out-of-bounds read vulnerability in the graphics module5.9CNA v3.10.1%2026-02-06Fix
CVE-2026-24928Huawei HarmonyOS out-of-bounds write vulnerability in the file system module5.8CNA v3.10.1%2026-02-06Fix
CVE-2026-24927Huawei HarmonyOS out-of-bounds access vulnerability in the frequency modulation module5.5CNA v3.10.1%2026-02-06Fix
CVE-2026-24926Huawei HarmonyOS out-of-bounds write vulnerability in the camera module8.4CNA v3.10.1%2026-02-06Fix
CVE-2026-24925Huawei HarmonyOS heap-based buffer overflow vulnerability in the image module7.3CNA v3.10.1%2026-02-06Fix
CVE-2026-24924Huawei HarmonyOS vulnerability of improper permission control in the print module6.1CNA v3.10.1%2026-02-06Fix
CVE-2026-24923Huawei HarmonyOS permission control vulnerability in the HDC module6.3CNA v3.10.1%2026-02-06Fix
CVE-2026-24922Huawei HarmonyOS buffer overflow vulnerability in the HDC module6.9CNA v3.10.1%2026-02-06Fix
CVE-2026-24921Huawei HarmonyOS address read vulnerability in the HDC module4.8CNA v3.10.1%2026-02-06Fix
CVE-2026-24920Huawei HarmonyOS permission control vulnerability in the AMS module6.2CNA v3.10.1%2026-02-06Fix
CVE-2026-24919Huawei HarmonyOS out-of-bounds write vulnerability in the DFX module6.0CNA v3.10.1%2026-02-06Fix
CVE-2026-24918Huawei HarmonyOS address read vulnerability in the communication module6.8CNA v3.10.1%2026-02-06Fix
CVE-2026-24917Huawei HarmonyOS UAF vulnerability in the security module6.5CNA v3.10.1%2026-02-06Fix
CVE-2026-24916Huawei HarmonyOS identity authentication bypass vulnerability in the window module5.9CNA v3.10.1%2026-02-06Fix
CVE-2026-24915Huawei HarmonyOS out-of-bounds read issue in the media subsystem6.2CNA v3.10.1%2026-02-06Fix
CVE-2026-24914Huawei HarmonyOS type confusion vulnerability in the camera module4.0CNA v3.10.1%2026-02-06Fix
CVE-2026-24903AlgoNetLab OrcaStatLLM-Researcher OrcaStatLLM Researcher stored cross-site scripting5.3CNA v4.00.2%2026-02-06
CVE-2026-24851OpenFGA Improper Policy Enforcement5.8CNA v4.00.3%2026-02-06Fix
CVE-2026-24776OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer4.3CNA v3.10.2%2026-02-06Fix
CVE-2026-24419OpenSTAManager has an SQL injection in the Prima Nota module8.7CNA v4.00.4%2026-02-06Exploit code
CVE-2026-24418OpenSTAManager has an SQL injection vulnerability in the Scadenzario bulk operations module8.7CNA v4.00.4%2026-02-06Exploit code
CVE-2026-24417OpenSTAManager has a Time-based blind SQL injection with Amplified denial of service8.7CNA v4.00.4%2026-02-06Exploit code
CVE-2026-24416OpenSTAManager has a Time-based blind SQL injection in Article Pricing module8.7CNA v4.00.4%2026-02-06Exploit code
CVE-2026-24135Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update7.2CNA v4.01.0%2026-02-06Emerging ThreatsExploit codeFix
CVE-2026-24050Zulip affected by stored XSS in user profile modal1.1CNA v4.00.3%2026-02-06Fix
CVE-2026-23989REVA Public Link Exploit8.2CNA v3.10.3%2026-02-06Exploit codeFix
CVE-2026-23741Sangoma Asterisk ast_coredumper script privilege escalation0.0CNA v3.10.2%2026-02-06Fix
CVE-2026-23740Asterisk vulnerable to potential privilege escalation0.0CNA v3.10.1%2026-02-06Fix
CVE-2026-23739Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE injection2.0CNA v3.10.2%2026-02-06Fix
CVE-2026-23738The Asterisk embedded web server 's /httpstatus page echos user supplied values without sanitization3.5CNA v3.10.2%2026-02-06Fix
CVE-2026-23633Gogs has arbitrary file read/write via path traversal in Git hook editing6.5CNA v3.10.5%2026-02-06Fix
CVE-2026-23632Gogs user can update repository content with read-only permission6.5CNA v3.10.3%2026-02-06Fix
CVE-2026-23623Collabora Online vulnerable to authorization bypass5.3CNA v3.10.2%2026-02-06Fix
CVE-2026-22592Gogs is vulnerable to denial of service6.5CNA v3.10.4%2026-02-06Fix
CVE-2026-22254Winter affected by stored cross-site scripting (XSS) in Asset Manager0.0CNA v3.10.3%2026-02-06Fix
CVE-2026-21643Fortinet FortiClient EMS SQL injection9.1CNA v3.193.9%2026-02-06KEVNucleiEmerging ThreatsExploit codeFix
CVE-2026-21626Extension Stackideas.com information disclosure in post custom fields in EasyDiscuss for Joomla7.5NVD v3.10.4%2026-02-06
CVE-2026-2103Infor SyteLine ERP use of hard-coded cryptographic key for Password Storage7.8v3.10.1%2026-02-06
CVE-2026-2070UTT 进取 520W formPolicyRouteConf strcpy buffer overflow8.7CNA v4.00.8%2026-02-06
CVE-2026-2069ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow4.8CNA v4.00.1%2026-02-06
CVE-2026-2068UTT 进取 520W formSyslogConf strcpy buffer overflow8.7CNA v4.00.8%2026-02-06
CVE-2026-2067UTT 进取 520W formTimeGroupConfig strcpy buffer overflow8.7CNA v4.01.0%2026-02-06
CVE-2026-2066UTT 进取 520W formIpGroupConfig strcpy buffer overflow8.7CNA v4.00.8%2026-02-06
CVE-2026-2065Flycatcher Toys smART Pixelator Bluetooth Low Energy missing authentication8.8v3.10.6%2026-02-06
CVE-2026-2064Portabilis i-Educar User Data meusdadod.php cross-site scripting5.4v3.10.3%2026-02-06
CVE-2026-2063D-Link DIR-823X Web Management set_ac_server os command injection7.2v3.15.3%2026-02-06
CVE-2026-2062Open5GS PGW S5U Address sgwc_sxa_handle_session_modification_response null pointer dereference7.5v3.10.7%2026-02-06
CVE-2026-2061D-Link DIR-823X set_ipv6 sub_424D20 os command injection7.2v3.15.2%2026-02-06
CVE-2026-2060code-projects Simple Blood Donor Management System editcampaignform.php SQL injection9.8v3.10.4%2026-02-06
CVE-2026-2059SourceCodester Medical Center Portal Management System emp_edit1.php SQL injection9.8v3.10.5%2026-02-06
CVE-2026-2058mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php SQL injection9.8v3.10.5%2026-02-06
CVE-2026-2057SourceCodester Medical Center Portal Management System login.php SQL injection9.8v3.10.4%2026-02-06
CVE-2026-2056D-Link DIR-605L/DIR-619L DHCP Connection Status wan_connection_status.asp information disclosure7.5v3.11.1%2026-02-06
CVE-2026-2055D-Link DIR-605L/DIR-619L DHCP client information information disclosure7.5v3.11.1%2026-02-06
CVE-2026-2054D-Link DIR-605L/DIR-619L Wifi setting information disclosure7.5v3.11.1%2026-02-06
CVE-2026-2018itsourcecode School Management System controller.php SQL injection9.8v3.10.4%2026-02-06
CVE-2026-2017IP-COM W30AP POST request wx3auth R7WebsSecurityHandler stack-based overflow9.3CNA v4.04.9%2026-02-06
CVE-2026-2016happyfish100 libfastcommon base64.c base64_decode stack-based overflow7.8v3.10.3%2026-02-06
CVE-2026-2015Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization8.8v3.10.3%2026-02-06Fix
CVE-2026-2014itsourcecode Student Management System index.php SQL injection9.8v3.10.5%2026-02-06
CVE-2026-2013itsourcecode Student Management System index.php SQL injection9.8v3.10.5%2026-02-06
CVE-2026-2012itsourcecode Student Management System index.php SQL injection9.8v3.10.4%2026-02-06
CVE-2026-2011itsourcecode Student Management System controller.php SQL injection9.8v3.10.4%2026-02-06
CVE-2026-2010Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization4.2v3.10.4%2026-02-06
CVE-2026-2009SourceCodester Gas Agency Management System createUser.php access control6.5v3.10.3%2026-02-06
CVE-2026-2008abhiphile fermat-mcp eqn_chart.py eqn_chart code injection8.8v3.10.4%2026-02-06
CVE-2026-2000DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection7.2v3.119.7%2026-02-06
CVE-2026-1998MicroPython runtime.c mp_import_all memory corruption5.5v3.10.2%2026-02-06Fix
CVE-2026-1991Libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference5.5v3.10.2%2026-02-06
CVE-2026-1990oatpp Type.hpp ObjectWrapper null pointer dereference4.8CNA v4.00.2%2026-02-06
CVE-2026-1979mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use-after-free5.5v3.10.2%2026-02-06Fix
CVE-2026-1978kalyan02 NanoCMS User Information pagesdata.txt direct request7.5v3.10.4%2026-02-06
CVE-2026-1977isaacwasserman mcp-vegalite-server visualize_data eval code injection5.3CNA v4.00.3%2026-02-06
CVE-2026-1976Free5GC SMF SessionDeletionResponse null pointer dereference7.5v3.10.6%2026-02-06
CVE-2026-1975Free5GC pfcp_reports.go identityTriggerType null pointer dereference7.5v3.10.6%2026-02-06
CVE-2026-1974Free5GC SMF datapath.go ResolveNodeIdToIp denial of service7.5v3.10.6%2026-02-06
CVE-2026-1973Free5GC SMF establishPfcpSession null pointer dereference7.5v3.10.6%2026-02-06
CVE-2026-1972Edimax BR-6208AC auth_check_userpass2 default credentials7.5v3.10.7%2026-02-06
CVE-2026-1971Edimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross-site scripting4.8v3.10.3%2026-02-06
CVE-2026-1909WaveSurfer-WP WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-06Fix
CVE-2026-1888Docus WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-06Fix
CVE-2026-1808Orange Confort+ accessibility toolbar for WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-06Fix
CVE-2026-1785Code Snippets WordPress plugin cross-site request forgery to Cloud Snippet Download/Update actions4.3CNA v3.10.2%2026-02-06Fix
CVE-2026-1769Stored XSS on Xerox CentreWare Web5.3CNA v3.10.2%2026-02-06Fix
CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS command injection9.9CNA v4.092.5%2026-02-06KEVNucleiMetasploitExploit codeFix
CVE-2026-1727Information disclosure via Bucket Squatting in Google Cloud Agentspace9.1CNA v4.00.3%2026-02-06Fix
CVE-2026-1709Keylime missing authentication for critical function and improper authentication9.4CNA v3.15.8%2026-02-06Fix
CVE-2026-1499WP Duplicate WordPress plugin arbitrary file upload8.8CNA v3.11.1%2026-02-06Fix
CVE-2026-1401Tune Library WordPress plugin missing authorization authenticated stored cross-site scripting6.4CNA v3.10.3%2026-02-06Fix
CVE-2026-1337neo4j Community Edition insufficient escaping of unicode characters in query log1.1CNA v4.00.2%2026-02-06Exploit codeFix
CVE-2026-1293Yoast SEO WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-02-06Fix
CVE-2026-1279Employee Directory WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-06Fix
CVE-2026-1252Events Listing Widget WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-06Fix
CVE-2026-1228Timeline Block WordPress plugin insecure direct object reference4.3CNA v3.10.2%2026-02-06Fix
CVE-2026-0598Red Hat Ansible Automation Platform Ansible Lightspeed API vulnerability4.2CNA v3.10.3%2026-02-06Fix
CVE-2026-0521TYDAC MAP+ reflected cross-site scripting in PDF Export Error message6.1v3.10.3%2026-02-06
CVE-2026-25815Fortinet FortiOS LDAP credential encryption vulnerability3.2CNA v3.10.1%2026-02-05
CVE-2026-25198web2py has an open redirect5.1CNA v4.00.3%2026-02-05Fix
CVE-2026-24302Microsoft Azure ARC elevation of privilege8.6CNA v3.11.5%2026-02-05Fix
CVE-2026-24300Microsoft Azure Front Door elevation of privilege9.8CNA v3.11.2%2026-02-05Fix
CVE-2026-23797Plaintext password display in Quick.Cart4.9v3.10.3%2026-02-05
CVE-2026-23796Session fixation in Quick.Cart9.8v3.10.3%2026-02-05
CVE-2026-23572Improper access control in TeamViewer clients7.2CNA v3.10.3%2026-02-05Fix
CVE-2026-21532Microsoft Azure function information disclosure8.2CNA v3.10.9%2026-02-05Fix
CVE-2026-1970Edimax BR-6258n formStaDrvSetup function open redirect6.1v3.10.3%2026-02-05
CVE-2026-1966YugabyteDB Anywhere exposes LDAP Credentials in Cleartext in Web UI2.4CNA v4.00.2%2026-02-05Fix
CVE-2026-1964WeKan REST endpoint boards.js BoardTitleRESTBleed access control5.3v3.10.3%2026-02-05Fix
CVE-2026-1963WeKan Attachment Storage attachments.js MoveStorageBleed access control9.8v3.10.4%2026-02-05Fix
CVE-2026-1962WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control9.8v3.10.4%2026-02-05Fix
CVE-2026-1953Stored cross-site scripting(XSS) in Nukegraphic CMS8.2CNA v4.00.5%2026-02-05Exploit code
CVE-2026-1927Greenshift WordPress plugin unauthorized access5.4CNA v3.10.2%2026-02-05Fix
CVE-2026-1898WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control5.3CNA v4.00.3%2026-02-05Fix
CVE-2026-1897WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization5.3CNA v4.00.3%2026-02-05Fix
CVE-2026-1896WeKan board migration handler improper access control5.3CNA v4.00.3%2026-02-05Fix
CVE-2026-1707Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)7.4CNA v3.10.4%2026-02-05Fix
CVE-2026-1654Peter's Date Countdown WordPress plugin reflected cross-site scripting via $_SERVER['PHP_SELF']6.1CNA v3.10.3%2026-02-05Fix
CVE-2026-1523Path traversal in Digitek from Grupo Azkoyen8.7CNA v4.01.3%2026-02-05Fix
CVE-2026-1517iomad Company Admin block SQL injection5.1CNA v4.00.3%2026-02-05
CVE-2026-1319Robin Image Optimizer WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-02-05Fix
CVE-2026-1301Out-of-bounds write in o6 Automation GmbH Open625416.8CNA v4.00.4%2026-02-05Fix
CVE-2026-1294All In One Image Viewer Block WordPress plugin unauthenticated server-side request forgery7.2CNA v3.10.3%2026-02-05Fix
CVE-2026-1271ProfileGrid WordPress plugin insecure direct object reference5.3CNA v3.10.4%2026-02-05Fix
CVE-2026-1268Dynamic Widget Content WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-05Fix
CVE-2026-1246ShortPixel Image Optimizer WordPress plugin arbitrary file read4.9CNA v3.10.6%2026-02-05Fix
CVE-2026-0867Essential Widgets WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-05Fix
CVE-2026-0715Moxa UC-1200A Series insufficiently protected credentials7.0CNA v4.00.3%2026-02-05Fix
CVE-2026-0714Moxa UC-1200A Series cleartext transmission of sensitive information7.0CNA v4.00.1%2026-02-05Fix
CVE-2026-0391Microsoft Edge (Chromium-based) for Android spoofing6.5CNA v3.10.6%2026-02-05Fix
CVE-2026-0106Google Android vpu_ioctl privilege escalation9.3CISA ADP v3.10.1%2026-02-05Fix
CVE-2026-25585iccDEV vulnerable to OOB in CIccXform3DLut::Apply7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-25584iccDEV vulnerable to stack-based buffer overflow in CIccTagFloatNum::GetValues7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-25583iccDEV vulnerable to heap buffer overflow in CIccFileIO::Read87.8CNA v3.10.3%2026-02-04Fix
CVE-2026-25582iccDEV vulnerable to heap buffer overflow in CIccIO::WriteUInt16Float7.8CNA v3.10.3%2026-02-04Fix
CVE-2026-25579Navidrome affected by denial of service and disk exhaustion9.2CNA v4.00.6%2026-02-04Fix
CVE-2026-25578Navidrome is vulnerable to XSS via comment from song metadata6.1CNA v3.10.4%2026-02-04Fix
CVE-2026-25575NavigaTUM has a path traversal vulnerability in the propose_edits functionality8.8CNA v4.00.6%2026-02-04
CVE-2026-25547Uncontrolled resource consumption in @isaacs/brace-expansion9.2CNA v4.00.5%2026-02-04Fix
CVE-2026-25546Coding-Solo godot-mcp godot MCP is vulnerable to command injection via unsanitized projectPath7.8CNA v3.11.0%2026-02-04Fix
CVE-2026-25543HtmlSanitizer has a bypass via template tag6.3CNA v4.00.4%2026-02-04Fix
CVE-2026-25541Bytes is vulnerable to integer overflow in BytesMut::reserve5.5CNA v4.00.6%2026-02-04Fix
CVE-2026-25540Mastodon ActivityPub response cache vulnerability6.5CNA v3.10.5%2026-02-04Fix
CVE-2026-25539SiYuan has arbitrary file write via /API/file/copyFile leading to RCE9.1CNA v3.11.1%2026-02-04Fix
CVE-2026-25538Devtron Attributes API unauthorized access leading to API Token Signing key leakage8.7CNA v4.00.5%2026-02-04
CVE-2026-25537jsonwebtoken has type confusion that leads to potential authorization bypass5.5CNA v4.00.6%2026-02-04Fix
CVE-2026-25536@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse7.1CNA v3.10.4%2026-02-04Fix
CVE-2026-25532espressif esp-idf ESF-IDF is vulnerable to WPS Enrollee Fragment integer underflow6.3CNA v3.10.4%2026-02-04Fix
CVE-2026-25526JinJava Bypass through ForTag leads to arbitrary Java Execution9.8CNA v3.11.0%2026-02-04Exploit codeFix
CVE-2026-25523Magento's X-Original-Url header can expose admin URL5.3CNA v3.10.4%2026-02-04Fix
CVE-2026-25521Locutus is vulnerable to prototype pollution9.4CNA v4.00.5%2026-02-04Fix
CVE-2026-25519OpenSlides has incorrect access control vulnerability in authentication service8.1CNA v3.10.7%2026-02-04Fix
CVE-2026-25518cert-manager cert-manager-controller DoS via Specially Crafted DNS Response5.9CNA v3.10.4%2026-02-04Fix
CVE-2026-25517Wagtail has improper permission handling on admin preview endpoints5.1CNA v4.00.5%2026-02-04Fix
CVE-2026-25514FacturaScripts has SQL injection vulnerability in Autocomplete Actions8.7CNA v4.00.6%2026-02-04Fix
CVE-2026-25513FacturaScripts has SQL injection vulnerability in API ORDER BY Clause8.3CNA v4.00.6%2026-02-04Exploit codeFix
CVE-2026-25512Group-office is vulnerable to RCE due to command injection via TNEF Attachment handler9.4CNA v4.03.8%2026-02-04NucleiExploit codeFix
CVE-2026-25511Group-office is vulnerable to SSRF and File Read in WOPI service discovery8.2CNA v4.00.5%2026-02-04Fix
CVE-2026-25508espressif esp-idf ESF-IDF has Memory Safety vulnerabilities in BLE Provisioning6.3CNA v3.10.4%2026-02-04
CVE-2026-25507espressif esp-idf ESF-IDF has use-after-free vulnerability in BLE Provisioning6.3CNA v3.10.4%2026-02-04
CVE-2026-25505Bambuddy Uses hard-coded secret Key + Many API endpoints do not Require Authentication9.8CNA v3.11.0%2026-02-04Fix
CVE-2026-25499terraform-provider-proxmox has insecure sudo recommendation in the documentation8.7CNA v4.00.6%2026-02-04Fix
CVE-2026-25481Langroid has WAF Bypass leading to RCE in TableChatAgent9.4CNA v4.00.8%2026-02-04Fix
CVE-2026-25475OpenClaw vulnerable to local file inclusion via MEDIA: Path Extraction6.5CNA v3.10.9%2026-02-04Fix
CVE-2026-25161Alist vulnerable to path traversal in multiple file operation handlers8.8CNA v3.10.8%2026-02-04Fix
CVE-2026-25160Alist has Insecure TLS Config9.1CNA v3.10.3%2026-02-04Fix
CVE-2026-25157OpenClaw/Clawdbot has OS command injection via Project Root Path in sshNodeCommand7.8CNA v3.11.1%2026-02-04Fix
CVE-2026-25145melange has a path traversal in license-path which allows reading files outside workspace5.5CNA v3.10.2%2026-02-04Fix
CVE-2026-25143melange affected by potential host command execution via license-check YAML mode patch pipeline7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-25140chainguard-dev apko resource exhaustion7.5CNA v3.10.4%2026-02-04Fix
CVE-2026-25139RIOT vulnerable to multiple out-of-bounds read when Processing Received 6LoWPAN SFR Fragments8.7CNA v4.00.6%2026-02-04
CVE-2026-25122Chainguard apko APK stream decompression denial of service5.5CNA v3.10.1%2026-02-04Fix
CVE-2026-25121apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base7.5CNA v3.10.4%2026-02-04Fix
CVE-2026-25115n8n is vulnerable to Python sandbox escape9.4CNA v4.00.6%2026-02-04Fix
CVE-2026-25056n8n arbitrary file write leading to RCE in n8n Merge Node9.4CNA v4.00.7%2026-02-04Fix
CVE-2026-25055n8n arbitrary file write on Remote Systems via SSH Node7.1CNA v4.01.9%2026-02-04Fix
CVE-2026-25054n8n is vulnerable to stored cross-site scripting via Markdown Rendering in Workflow UI8.5CNA v4.00.2%2026-02-04Fix
CVE-2026-25053n8n is vulnerable to OS command injection in Git Node9.4CNA v4.00.6%2026-02-04Exploit codeFix
CVE-2026-25052n8n Improper File Access Controls allow arbitrary file read by Authenticated Users9.4CNA v4.00.3%2026-02-04Fix
CVE-2026-25051n8n Improper CSP Enforcement in Webhook Responses may allow stored XSS8.5CNA v4.00.3%2026-02-04Fix
CVE-2026-25049n8n has an Expression Escape vulnerability leading to RCE9.4CNA v4.01.6%2026-02-04Exploit codeFix
CVE-2026-24884Compressing vulnerable to arbitrary file write via Symlink Extraction8.4CNA v3.10.4%2026-02-04Fix
CVE-2026-24844melange pipeline working-directory could allow command injection7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-24843melange QEMU runner could write files outside workspace directory8.2CNA v3.10.2%2026-02-04Fix
CVE-2026-24735Apache Answer: Revision API improper access control leads to information disclosure7.5CISA ADP v3.10.7%2026-02-04Fix
CVE-2026-24447Six Apart Movable Type (Software Edition) CSV injection4.8CNA v4.00.3%2026-02-04
CVE-2026-23897Apollo GraphQL Apollo Server startStandaloneServer denial of service7.5CNA v3.10.7%2026-02-04Fix
CVE-2026-23704Six Apart Movable Type (Software Edition) unrestricted file upload5.1CNA v4.00.2%2026-02-04
CVE-2026-23624GLPI is vulnerable to session stealing on externally authenticated user change4.3CNA v3.10.4%2026-02-04Fix
CVE-2026-23110Linux kernel SCSI error handler race condition4.7NVD v3.10.1%2026-02-04Fix
CVE-2026-23109Linux kernel writeback inode sync infinite loop5.5v3.10.1%2026-02-04Fix
CVE-2026-23108Linux kernel usb_8dev CAN driver memory leak5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23107Linux kernel arm64 SME ZA signal context restoration null pointer dereference5.5v3.10.1%2026-02-04Fix
CVE-2026-23106Linux kernel auxiliary timekeeper leap state vulnerability5.5v3.10.1%2026-02-04Fix
CVE-2026-23105Linux kernel QFQ packet scheduler vulnerability7.8CNA v3.10.1%2026-02-04Fix
CVE-2026-23104Linux kernel ice driver hwmon sensor vulnerability5.5v3.10.1%2026-02-04Fix
CVE-2026-23103Linux kernel IPvlan address locking vulnerability7.8CNA v3.10.1%2026-02-04Fix
CVE-2026-23102Linux kernel arm64 SVE signal context restoration out-of-bounds read7.1v3.10.1%2026-02-04Fix
CVE-2026-23101Linux kernel LED class trigger registration vulnerability4.7NVD v3.10.1%2026-02-04Fix
CVE-2026-23100Linux kernel hugetlb PMD table sharing vulnerability5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23099Linux kernel bonding 802.3ad driver out-of-bounds read7.1NVD v3.10.2%2026-02-04Fix
CVE-2026-23098Linux kernel NetRom routing double free8.8CNA v3.10.2%2026-02-04Fix
CVE-2026-23097Linux kernel hugetlb folio migration deadlock5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23096In the Linux kernel, the following vulnerability has been resolved: uacce: fix cdev handling in the cleanup path When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_dev5.5v3.10.1%2026-02-04Fix
CVE-2026-23095Linux kernel gue memory leak7.5CNA v3.10.3%2026-02-04Fix
CVE-2026-23094Linux kernel uacce crash5.5v3.10.1%2026-02-04Fix
CVE-2026-23093In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbd: fix dma_unmap_sg() nents The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.5.5v3.10.1%2026-02-04Fix
CVE-2026-23092Linux kernel AD3552R-HS DAC driver out-of-bounds write7.8v3.10.2%2026-02-04Fix
CVE-2026-23091Linux kernel intel_th memory leak5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23090Linux kernel SLIMbus device registration vulnerability5.5v3.10.1%2026-02-04Fix
CVE-2026-23089Linux kernel USB audio mixer driver use-after-free7.8NVD v3.10.2%2026-02-04Fix
CVE-2026-23088Linux kernel ftrace synthetic events null pointer dereference5.5v3.10.1%2026-02-04Fix
CVE-2026-23087Linux kernel Xen SCSI backend driver memory leak5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23086Linux kernel virtio vsock transport vulnerability5.5NVD v3.10.2%2026-02-04Fix
CVE-2026-23085Linux kernel GICv3 ITS interrupt controller driver vulnerability5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23084Linux kernel be2net MAC address retrieval null pointer dereference5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23083In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu(). L7.8NVD v3.10.2%2026-02-04Fix
CVE-2026-23082Linux kernel gs_usb CAN driver infinite loop5.5v3.10.1%2026-02-04Fix
CVE-2026-23081In the Linux kernel, the following vulnerability has been resolved: net: phy: intel-xway: fix OF node refcount leakage Automated review spotted am OF node reference count leakage when checking if the 'leds' child node exists. Call of_put_node() to correctly maintain the refcount.5.5v3.10.1%2026-02-04Fix
CVE-2026-23080Linux kernel mcba_usb CAN driver memory leak5.5v3.10.1%2026-02-04Fix
CVE-2026-23079Linux kernel cdev memory leak5.5v3.10.1%2026-02-04Fix
CVE-2026-23078Linux kernel Scarlett2 USB audio driver out-of-bounds write7.8v3.10.1%2026-02-04Fix
CVE-2026-23077Linux kernel mm/vma use-after-free7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-23076Linux kernel ctxfi audio mixer driver out-of-bounds read7.1NVD v3.10.1%2026-02-04Fix
CVE-2026-23075Linux kernel esd_usb CAN driver memory leak5.5v3.10.1%2026-02-04Fix
CVE-2026-23074Linux kernel net/sched use-after-free7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-23073Linux kernel rsi Wi-Fi driver out-of-bounds write7.8NVD v3.10.2%2026-02-04Fix
CVE-2026-23072Linux kernel L2TP UDP encapsulation receive path memory leak5.5v3.10.1%2026-02-04Fix
CVE-2026-23071Linux kernel regmap hwspinlock irqsave routine race condition4.7NVD v3.10.1%2026-02-04Fix
CVE-2026-23070In the Linux kernel, the following vulnerability has been resolved: Octeontx2-af: Add proper checks for fwdata firmware populates MAC address, link modes (supported, advertised) and EEPROM data in shared firmware structure which kernel access via MAC block(CGX/RPM). Accessing fwdata, on boards bo5.5v3.10.1%2026-02-04Fix
CVE-2026-23069Linux kernel virtio vsock credit accounting integer underflow5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23068Linux kernel spi-sprd-adi double free7.8v3.10.1%2026-02-04Fix
CVE-2026-23067Linux kernel ARM IOMMU page table unmap path reachable assertion5.5v3.10.1%2026-02-04Fix
CVE-2026-23066Linux kernel rxrpc recvmsg queue handling vulnerability7.8CNA v3.10.1%2026-02-04Fix
CVE-2026-23065Linux kernel AMD wbrf driver memory leak5.5v3.10.1%2026-02-04Fix
CVE-2026-23064Linux kernel act_ife null pointer dereference5.5v3.10.1%2026-02-04Fix
CVE-2026-23063Linux kernel uacce accelerator queue release null pointer dereference5.5v3.10.1%2026-02-04Fix
CVE-2026-23062Linux kernel HP BIOS configuration driver null pointer dereference5.5v3.10.1%2026-02-04Fix
CVE-2026-23061Linux kernel Kvaser USB CAN driver memory leak5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23060Linux kernel crypto null pointer dereference5.5NVD v3.10.1%2026-02-04Fix
CVE-2026-23059In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the ioc–0.2%2026-02-04Fix
CVE-2026-23058Linux kernel ems_usb CAN driver memory leak–0.2%2026-02-04Fix
CVE-2026-23057Linux kernel vsock virtio skb handling vulnerability–0.2%2026-02-04Fix
CVE-2026-23056Linux kernel uacce mmap handling double free–0.2%2026-02-04Fix
CVE-2026-23055Linux kernel riic I2C driver suspend handling vulnerability–0.2%2026-02-04Fix
CVE-2026-23054Linux kernel hv_netvsc RSS configuration denial of service–0.2%2026-02-04Fix
CVE-2026-23053Linux kernel NFS folio release deadlock–0.2%2026-02-04Fix
CVE-2026-23052Linux kernel ftrace record allocation vulnerability–0.2%2026-02-04Fix
CVE-2026-23051Linux kernel amdgpu display driver null pointer dereference–0.2%2026-02-04Fix
CVE-2026-23050Linux kernel pNFS delegation return deadlock–0.2%2026-02-04Fix
CVE-2026-23049Linux kernel panel-simple DataImage panel driver vulnerability–0.2%2026-02-04Fix
CVE-2026-23048Linux kernel UDP receive skb handling vulnerability–0.2%2026-02-04Fix
CVE-2026-23047In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not just clear it Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it's able to determine when the request s–0.2%2026-02-04Fix
CVE-2026-23046Linux kernel virtio_net RSS header allocation vulnerability–0.2%2026-02-04Fix
CVE-2026-23045Linux kernel ena devlink parameter update vulnerability–0.2%2026-02-04Fix
CVE-2026-23044Linux kernel hibernation image compression vulnerability–0.2%2026-02-04Fix
CVE-2026-23043Linux kernel btrfs log replay null pointer dereference–0.2%2026-02-04Fix
CVE-2026-23042Linux kernel idpf RDMA auxiliary device null pointer dereference–0.2%2026-02-04Fix
CVE-2026-23041Linux kernel bnxt_en PTP driver null pointer dereference–0.2%2026-02-04Fix
CVE-2026-23040Linux kernel mac80211_hwsim NAN notification null pointer dereference–0.2%2026-02-04Fix
CVE-2026-22875Six Apart Movable Type (Software Edition) Export Sites stored cross-site scripting4.8CNA v4.00.2%2026-02-04
CVE-2026-22549F5 BIG-IP Container Ingress Services execution with unnecessary privileges6.9CNA v4.00.4%2026-02-04Fix
CVE-2026-22548F5 BIG-IP Advanced WAF and ASM bd process race condition8.2CNA v4.00.2%2026-02-04Fix
CVE-2026-22247GLPI is vulnerable to SSRF via Webhooks4.1CNA v3.10.4%2026-02-04Fix
CVE-2026-22044GLPI is vulnerable to authenticated SQL injection6.5CNA v3.10.3%2026-02-04Fix
CVE-2026-22038AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration blocks8.1CNA v3.10.5%2026-02-04
CVE-2026-21893n8n vulnerable to command injection in Community Package Installation9.4CNA v4.01.6%2026-02-04Fix
CVE-2026-21393Six Apart Movable Type (Software Edition) Edit Comment stored cross-site scripting4.8CNA v4.00.2%2026-02-04
CVE-2026-20987Samsung Mobile GalaxyDiagnostics improper input validation8.7CNA v4.00.2%2026-02-04
CVE-2026-20986Samsung Mobile Chinese Samsung Members path traversal5.1CNA v4.00.2%2026-02-04Fix
CVE-2026-20985Samsung Mobile Samsung Members improper input validation7.0CNA v4.00.3%2026-02-04Fix
CVE-2026-20984Samsung Mobile Galaxy Wearable Improper handling of improper permissions5.1CNA v4.00.2%2026-02-04
CVE-2026-20983Samsung Mobile Devices improper export of Android application components8.4CNA v4.00.1%2026-02-04Fix
CVE-2026-20982Samsung Mobile Devices ShortcutService path traversal6.8CNA v4.00.3%2026-02-04Fix
CVE-2026-20981Samsung Mobile Devices FacAtFunction improper input validation5.4CNA v4.00.2%2026-02-04Fix
CVE-2026-20980Samsung Mobile Devices PACM improper input validation7.0CNA v4.00.3%2026-02-04Exploit codeFix
CVE-2026-20979Samsung Mobile Devices settings improper privilege management8.4CNA v4.00.1%2026-02-04Fix
CVE-2026-20978Samsung Mobile Devices KnoxGuardManager improper authorization5.8CNA v4.00.1%2026-02-04Fix
CVE-2026-20977Samsung Mobile Devices Emergency Sharing improper access control6.9CNA v4.00.1%2026-02-04Fix
CVE-2026-20732F5 BIG-IP Configuration utility UI misrepresentation2.3CNA v4.00.2%2026-02-04Fix
CVE-2026-20730F5 BIG-IP Edge Client information disclosure2.0CNA v4.00.1%2026-02-04Fix
CVE-2026-20123Cisco Prime Infrastructure and Evolved Programmable Network Manager open redirect4.3CNA v3.10.2%2026-02-04Fix
CVE-2026-20119Cisco TelePresence Collaboration Endpoint Software and RoomOS software denial of service7.5CNA v3.10.4%2026-02-04Fix
CVE-2026-20111Cisco Prime Infrastructure stored cross-site scripting4.8CNA v3.10.2%2026-02-04Fix
CVE-2026-20098Cisco Meeting Management arbitrary file upload8.8CNA v3.10.4%2026-02-04Fix
CVE-2026-20056Cisco Secure Web Appliance Dynamic Vectoring and Streaming Engine vulnerability4.0CNA v3.10.2%2026-02-04Fix
CVE-2026-1895WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control6.3v3.10.3%2026-02-04Fix
CVE-2026-1894WeKan REST API checklistItems.js Checklist REST Bleed improper authorization5.4v3.10.3%2026-02-04Fix
CVE-2026-1892WeKan REST API boards.js setBoardOrgs improper authorization2.3CNA v4.00.3%2026-02-04Fix
CVE-2026-1884ZenTao Webhook model.php fetchHook server-side request forgery4.9v3.10.4%2026-02-04
CVE-2026-1835lcg0124 BootDo cross-site request forgery5.3CNA v4.00.2%2026-02-04
CVE-2026-1819Stored XSS in Karel Electronics' ViPort8.8CNA v3.10.4%2026-02-04
CVE-2026-1813bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload9.8v3.10.4%2026-02-04
CVE-2026-1791Arbitrary file upload vulnerability in Operation and Maintenance Security Gateway2.7CNA v3.10.4%2026-02-04
CVE-2026-1756WP FOFT Loader WordPress plugin authenticated (Author+) arbitrary file upload8.8CNA v3.10.7%2026-02-04Fix
CVE-2026-1642F5 NGINX upstream TLS proxying acceptance of untrusted data8.2CNA v4.00.4%2026-02-04Fix
CVE-2026-1633Synectix LAN 232 TRIO missing authentication for critical function10.0CNA v4.00.6%2026-02-04
CVE-2026-1622neo4j Community Edition unredacted data exposure in query.log4.8CNA v4.00.2%2026-02-04Fix
CVE-2026-1554Central Authentication System (CAS) Server Less critical XML Element injection SA-CONTRIB-2026-0074.2CISA ADP v3.10.2%2026-02-04Fix
CVE-2026-1553Drupal Canvas Moderately critical Access bypass SA-CONTRIB-2026-0064.8CISA ADP v3.10.2%2026-02-04Fix
CVE-2026-1370SIBS - WooCommerce WordPress plugin authenticated (Admin+) SQL injection via referencedId parameter4.9CNA v3.10.4%2026-02-04
CVE-2026-0948Microsoft Entra ID SSO Login Critical Access bypass SA-CONTRIB-2026-0056.5CISA ADP v3.10.2%2026-02-04Fix
CVE-2026-0947AT Internet Piano Analytics Moderately critical cross-site scripting SA-CONTRIB-2026-0044.8CISA ADP v3.10.2%2026-02-04Fix
CVE-2026-0946AT Internet SmartTag Moderately critical cross-site scripting SA-CONTRIB-2026-0036.1CISA ADP v3.10.2%2026-02-04Fix
CVE-2026-0945Role Delegation Moderately critical Access bypass SA-CONTRIB-2026-0028.8v3.10.2%2026-02-04Fix
CVE-2026-0944Group invite Moderately critical Access bypass SA-CONTRIB-2026-0015.3CISA ADP v3.10.2%2026-02-04Fix
CVE-2026-0873Privilege Elevation in Ercom Cryptobox administration console4.8CNA v4.00.3%2026-02-04
CVE-2026-0816All push notification for WP WordPress plugin SQL injection4.9CNA v3.10.4%2026-02-04
CVE-2026-0743WP Content Permission WordPress plugin stored cross-site scripting4.4CNA v3.10.6%2026-02-04Nuclei
CVE-2026-0742Smart Appointment and Booking WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-02-04Fix
CVE-2026-0681Extended Random Number Generator WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-02-04
CVE-2026-0679Fortis for WooCommerce WordPress plugin authorization bypass5.3CNA v3.10.4%2026-02-04Fix
CVE-2026-0662Untrusted search path vulnerability when opening max files7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-0661Autodesk 3ds Max out-of-bounds write in RGB File Parsing8.4CNA v3.10.2%2026-02-04Fix
CVE-2026-0660Autodesk 3ds Max stack based buffer overflow in GIF File Parsing8.4CNA v3.10.2%2026-02-04Fix
CVE-2026-0659USD File Parsing out-of-bounds write7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-0572WebPurify Profanity Filter WordPress plugin unauthorized access6.5CNA v3.10.3%2026-02-04Fix
CVE-2026-0538Autodesk 3ds Max GIF File Parsing out-of-bounds write8.4CNA v3.10.2%2026-02-04Fix
CVE-2026-0537Autodesk 3ds Max RGB File Parsing memory corruption8.4CNA v3.10.2%2026-02-04Fix
CVE-2026-0536Autodesk 3ds Max GIF File Parsing stack based buffer overflow7.8CNA v3.10.2%2026-02-04Fix
CVE-2026-25616Blesta cross-site scripting6.1v3.10.4%2026-02-03NucleiFix
CVE-2026-25615Blesta deserialization of untrusted data7.2CNA v3.10.7%2026-02-03Fix
CVE-2026-25614Blesta deserialization of untrusted data7.5CNA v3.10.6%2026-02-03Fix
CVE-2026-25522Craft Commerce has stored XSS in Shipping Zone fields leading to potential privilege escalation6.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25510CI4MS vulnerable to remote code execution (RCE) via arbitrary file creation and Save in File Editor10.0CNA v3.11.1%2026-02-03Fix
CVE-2026-25509CI4MS vulnerable to User Email Enumeration via Password Reset Flow5.3CNA v3.10.5%2026-02-03Fix
CVE-2026-25503iccDEV has type confusion in CIccTagEmbeddedHeightImage::Validate7.1CNA v3.10.5%2026-02-03Fix
CVE-2026-25502International Color Consortium iccDEV icFixXml XML parser stack-based buffer overflow7.8CNA v3.10.3%2026-02-03Fix
CVE-2026-25490Craft Commerce inventory location address field stored cross-site scripting6.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25489Craft Commerce has stored XSS in Tax Zones leading to potential privilege escalation6.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25488Craft Commerce has stored XSS in Tax Categories fields leading to potential privilege escalation6.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25487Craft CMS has stored XSS in Tax Rates Name leading to potential privilege escalation6.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25486Craft Commerce shipping methods name field stored cross-site scripting6.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25485Craft Commerce shipping categories fields stored cross-site scripting6.2CNA v4.00.4%2026-02-03Fix
CVE-2026-25484Craft Commerce has stored XSS in Product Type Name4.8CNA v4.00.4%2026-02-03Fix
CVE-2026-25483Craft Commerce has stored XSS via Order Status message with potential database exfiltration6.2CNA v4.00.4%2026-02-03Fix
CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in Recent Orders Dashboard widget)6.2CNA v4.00.5%2026-02-03Fix
CVE-2026-25241PEAR package version endpoint SQL injection9.3CNA v4.00.5%2026-02-03Fix
CVE-2026-25240PEAR is vulnerable to SQL injection in user::maintains Role IN Filter6.9CNA v4.00.3%2026-02-03Fix
CVE-2026-25239PEAR is vulnerable to SQL injection in apidoc_queue Insert via Unescaped Filename8.2CNA v4.00.2%2026-02-03Fix
CVE-2026-25238PEAR is vulnerable to SQL injection in Bug Subscription Deletion via Weak Email Validation9.2CNA v4.00.3%2026-02-03Fix
CVE-2026-25237PEAR is vulnerable to PHP code execution via preg_replace /e in Bug Update Emails9.2CNA v4.00.4%2026-02-03Fix
CVE-2026-25236PEAR is vulnerable to SQL injection in Damblan_Karma IN Query via Literal Substitution6.9CNA v4.00.3%2026-02-03Fix
CVE-2026-25235PEAR has a Predictable Verification Hash in Election Account requests8.2CNA v4.00.3%2026-02-03Fix
CVE-2026-25234PEAR is vulnerable to SQL injection in Category Deletion5.3CNA v4.00.3%2026-02-03Fix
CVE-2026-25233PEAR has a Roadmap authorization bypass via Operator Precedence Bug7.1CNA v4.00.4%2026-02-03Fix
CVE-2026-25224Fastify vulnerable to DoS via Unbounded Memory Allocation in sendWebStream3.7CNA v3.10.6%2026-02-03Fix
CVE-2026-25223Fastify's Content-Type header tab character allows body validation bypass7.5CNA v3.10.9%2026-02-03Fix
CVE-2026-25155Qwik City CSRF protection middleware does not work properly for content type header with parameters5.9CNA v3.10.1%2026-02-03Fix
CVE-2026-25151Qwik City has a CSRF Protection Bypass via Content-Type Header Validation5.9CNA v3.10.2%2026-02-03Fix
CVE-2026-25150Prototype pollution via FormData Processing in Qwik City9.3CNA v3.10.7%2026-02-03Fix
CVE-2026-25149Qwik City open redirect via fixTrailingSlash2.7CNA v4.00.3%2026-02-03Fix
CVE-2026-25148Qwik SSR XSS via Unsafe Virtual Node Serialization5.3CNA v4.00.4%2026-02-03Fix
CVE-2026-25036Passster WordPress plugin broken access control6.5CNA v3.10.3%2026-02-03Fix
CVE-2026-25028ElementInvader Addons for Elementor WordPress plugin broken access control5.4CNA v3.10.2%2026-02-03Fix
CVE-2026-25027Unicamp WordPress theme local file inclusion7.5CNA v3.10.4%2026-02-03Fix
CVE-2026-25024ThirstyAffiliates WordPress plugin cross-site request forgery (CSRF)5.4CNA v3.10.1%2026-02-03Fix
CVE-2026-25023Run Contests, Raffles, and Giveaways with ContestsWP WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-25022KiviCare WordPress plugin SQL injection8.5CNA v3.10.2%2026-02-03Fix
CVE-2026-25021Mizan Demo Importer WordPress plugin broken access control5.4CNA v3.10.2%2026-02-03Fix
CVE-2026-25020WP Sync for Notion WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-25019Atarim WordPress plugin broken access control5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-25016Nelio Popups WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-25015UsersWP WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-02-03Fix
CVE-2026-25014Enter Addons WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-02-03Fix
CVE-2026-25012WP Bannerize Pro WordPress plugin broken access control5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-25011WP Custom Admin Interface WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-25010Share This Image WordPress plugin broken access control5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24998Hustle WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24997Wired Impact Volunteer Management WordPress plugin broken access control5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24996WPElemento Importer WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24995Latest Post Shortcode WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24994Sunshine Photo Cart WordPress plugin broken access control5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24992Advanced WooCommerce Product Sales Reporting WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24991Extensions For CF7 WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24990WP Docs WordPress plugin broken access control5.4CNA v3.10.2%2026-02-03Fix
CVE-2026-24988The Events Calendar Shortcode and Block WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-02-03Fix
CVE-2026-24986Simple Membership WP user Import WordPress plugin cross-site request forgery (CSRF)5.4CNA v3.10.1%2026-02-03Fix
CVE-2026-24985WP Forms Signature Contract Add-On WordPress plugin broken access control to Notice Dismissal4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24984Visual Link Preview WordPress plugin broken access control6.5CNA v3.10.4%2026-02-03Fix
CVE-2026-24982Spectra WordPress plugin broken access control5.3CNA v3.10.3%2026-02-03Fix
CVE-2026-24967Amelia WordPress plugin broken access control5.3CNA v3.10.3%2026-02-03Fix
CVE-2026-24966Copyscape Premium WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-02-03Fix
CVE-2026-24965Contest Gallery WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24962Sigmize WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-02-03Fix
CVE-2026-24961Grand Blog WordPress theme server side request forgery (SSRF)5.4CNA v3.10.2%2026-02-03Fix
CVE-2026-24958JetElements For Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-02-03Fix
CVE-2026-24957Strong Testimonials WordPress plugin broken access control6.5CNA v3.10.3%2026-02-03Fix
CVE-2026-24954WpEvently WordPress plugin deserialization of untrusted data8.8CNA v3.10.4%2026-02-03Fix
CVE-2026-24952Seriously Simple Podcasting WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-02-03Fix
CVE-2026-24951myCred WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24947LA-Studio Element Kit for Elementor WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24945Ultimate Addons for Contact Form 7 WordPress plugin broken access control5.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24942WpEvently WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-02-03Fix
CVE-2026-24940Travelfic Toolkit WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24939Modula Image Gallery WordPress plugin broken access control4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24938Better Search WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-02-03Fix
CVE-2026-24936An improper input validation vulnerability was found in ADM while joining a AD Domain9.8v3.10.9%2026-02-03Fix
CVE-2026-24935ASUSTOR ADM NAT traversal module improper certificate validation5.6v3.10.2%2026-02-03Fix
CVE-2026-24934ASUSTOR ADM DDNS function improper certificate validation3.7NVD v3.10.2%2026-02-03Fix
CVE-2026-24933ASUSTOR ADM API communication component improper certificate validation5.9NVD v3.10.2%2026-02-03Fix
CVE-2026-24932An improper certificate validation vulnerability was found in ADM while updating the DDNS settings5.9NVD v3.10.2%2026-02-03Fix
CVE-2026-24887Anthropic Claude Code find command execution command injection7.7CNA v4.00.7%2026-02-03Fix
CVE-2026-24774Open eClass business logic flaw allows Students to Mark Attendance in Expired Activities4.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24773Open eClass unauthenticated IDOR allows Access to arbitrary User files7.5CNA v3.10.4%2026-02-03Fix
CVE-2026-24762RustFS Logs Sensitive Credentials in Plaintext6.9CNA v4.00.3%2026-02-03Fix
CVE-2026-24694Roland Cloud Manager uncontrolled search path8.4CNA v4.00.2%2026-02-03
CVE-2026-24674Open eClass is vulnerable to reflected cross-site scripting (XSS) in multiple endpoints4.7CNA v3.10.2%2026-02-03Fix
CVE-2026-24673Open eClass has file upload Filter Bypass via ZIP Archive Extraction4.3CNA v3.10.3%2026-02-03Fix
CVE-2026-24672Open eClass is vulnerable to stored cross-site scripting (XSS) in User Profile fields7.3CNA v3.10.2%2026-02-03Fix
CVE-2026-24671Open eClass is vulnerable to stored cross-site scripting in multiple High-Privilege User fields6.1CNA v3.10.2%2026-02-03Fix
CVE-2026-24670Open eClass has broken access control in Course Units module allows Students to Create Units6.5CNA v3.10.2%2026-02-03Fix
CVE-2026-24669Open eClass Insecure Password Reset Token Reuse enables account takeover7.8CNA v3.10.2%2026-02-03Fix
CVE-2026-24668Open eClass broken access control allows Students to Add Content to Course Units6.5CNA v3.10.2%2026-02-03Fix
CVE-2026-24667Open eClass's Active Sessions not Invalidated after Password Change allow Persistent Account Access5.0CNA v3.10.2%2026-02-03Fix
CVE-2026-24666Open eClass is vulnerable to CSRF in Teacher-Restricted endpoints allows unauthorized actions6.5CNA v3.10.2%2026-02-03Fix
CVE-2026-24665Open eClass is vulnerable to stored cross-site scripting (XSS) via Student Assignment upload8.7CNA v3.10.2%2026-02-03Fix
CVE-2026-24664Open eClass is vulnerable to Username Enumeration via Login Response Discrepancies5.3CNA v3.10.3%2026-02-03Fix
CVE-2026-24514ingress-nginx Admission controller denial of service6.5CNA v3.10.5%2026-02-03Fix
CVE-2026-24513ingress-nginx auth-url protection bypass3.1CNA v3.10.3%2026-02-03Fix
CVE-2026-24512ingress-nginx auth-method nginx configuration injection8.8CNA v3.10.6%2026-02-03Fix
CVE-2026-24465ELECOM WAB-S733IW2-PD stack-based buffer overflow9.3CNA v4.00.8%2026-02-03Fix
CVE-2026-24449ELECOM WRC-X1500GS-B weak credentials5.1CNA v4.00.2%2026-02-03Fix
CVE-2026-24441Tenda AC7 Transmits Admin Credentials without HTTPS Protection5.9NVD v3.10.2%2026-02-03
CVE-2026-24434Tenda AC7 Web interface lacks CSRF Protections for Admin Actions6.5v3.10.2%2026-02-03
CVE-2026-24427Tenda AC7 exposes Admin Credentials in Configuration Responses5.5v3.10.1%2026-02-03
CVE-2026-24426Tenda AC7 reflected XSS via Web Interface Output Encoding6.1v3.10.2%2026-02-03
CVE-2026-24149NVIDIA Megatron-LM code injection7.8CNA v3.10.3%2026-02-03Fix
CVE-2026-24053Anthropic Claude Code Bash command validation path traversal7.7CNA v4.00.5%2026-02-03Fix
CVE-2026-24052Anthropic Claude Code WebFetch domain validation vulnerability7.1CNA v4.00.4%2026-02-03Fix
CVE-2026-23795Apache Syncope: Console XXE on Keymaster parameters4.9CISA ADP v3.11.9%2026-02-03Fix
CVE-2026-23794Apache Syncope: Reflected XSS on Enduser Login6.8CISA ADP v3.10.5%2026-02-03Fix
CVE-2026-22550ELECOM WRC-X6000XS-G OS command injection8.8v3.11.9%2026-02-03Fix
CVE-2026-22228Improper input validation leading to DoS on TP-Link Archer BE2306.8CNA v4.00.4%2026-02-03Fix
CVE-2026-22220Improper input validation leading to DoS on TP-Link Archer BE2306.8CNA v4.00.2%2026-02-03Fix
CVE-2026-21862RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers7.7CNA v4.00.2%2026-02-03Fix
CVE-2026-20704ELECOM WRC-X1500GS-B cross-site request forgery5.1CNA v4.00.2%2026-02-03
CVE-2026-1862Google Chrome V8 type confusion8.8CISA ADP v3.10.6%2026-02-03Fix
CVE-2026-1861Google Chrome libvpx heap-based buffer overflow8.8CISA ADP v3.10.5%2026-02-03Fix
CVE-2026-1814Rapid7 Nexpose Insecure Java Keystore Password Generation6.8CNA v4.00.2%2026-02-03Exploit codeFix
CVE-2026-1812bolo-blog bolo-solo Filename BackupService.java importFromCnblogs path traversal9.8v3.10.5%2026-02-03
CVE-2026-1811bolo-blog bolo-solo Filename BackupService.java importFromMarkdown path traversal8.8v3.10.5%2026-02-03
CVE-2026-1810bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal8.8v3.10.5%2026-02-03
CVE-2026-1803Ziroom ZHOME A0101 Dropbear SSH service default credentials9.2CNA v4.00.7%2026-02-03
CVE-2026-1802Ziroom ZHOME A0101 zrMacClone.lua macAddrClone command injection6.9CNA v4.03.9%2026-02-03
CVE-2026-1801Libsoup: Libsoup: Http request smuggling via malformed chunk headers6.5NVD v3.10.4%2026-02-03Fix
CVE-2026-1788Buffer overflow in Xquic Server6.6CNA v4.00.4%2026-02-03Fix
CVE-2026-1755Menu Icons by ThemeIsle WordPress plugin authenticated (Author+) stored cross-site scripting6.4CNA v3.10.2%2026-02-03Fix
CVE-2026-1730OS DataHub Maps WordPress plugin authenticated (Author+) arbitrary file upload8.8CNA v3.10.6%2026-02-03Fix
CVE-2026-1664Insecure direct object reference (IDOR) via Header-Based Email Routing6.9CNA v4.00.5%2026-02-03Fix
CVE-2026-1632RISS SRL MOMA Seismic Station missing authentication for critical function9.3CNA v4.00.5%2026-02-03Fix
CVE-2026-1592Stored XSS via Create New Layer field found in Foxit PDF Editor Cloud6.3CNA v3.10.2%2026-02-03Fix
CVE-2026-1591Stored XSS via Attachments feature in HTTPS://pdfonline.Foxit.com/6.3CNA v3.10.2%2026-02-03Fix
CVE-2026-1580ingress-nginx auth-method nginx configuration injection8.8CNA v3.10.5%2026-02-03Fix
CVE-2026-1568Rapid7 InsightVM signature validation9.6CNA v3.10.2%2026-02-03Fix
CVE-2026-1447Mail Mint WordPress plugin cross-site request forgery to stored cross-site scripting5.4CNA v3.10.2%2026-02-03Fix
CVE-2026-1432SQL injection (SQLi) on the Buroweb platform9.3CNA v4.00.4%2026-02-03Fix
CVE-2026-1375Tutor LMS WordPress plugin insecure direct object reference8.1CNA v3.10.4%2026-02-03Exploit codeFix
CVE-2026-1371Tutor LMS WordPress plugin information disclosure in Coupon Details5.3CNA v3.10.3%2026-02-03Fix
CVE-2026-1341Missing authentication for critical function in Avation Light Engine Pro9.3CNA v4.00.6%2026-02-03Fix
CVE-2026-1312Django potential SQL injection via QuerySet.order_by and FilteredRelation5.4CISA ADP v3.10.9%2026-02-03Exploit codeFix
CVE-2026-1287Django potential SQL injection in column aliases via control characters5.4CISA ADP v3.10.9%2026-02-03Fix
CVE-2026-1285Django potential denial of service vulnerability in Django.utils.text.Truncator HTML methods7.5CISA ADP v3.11.1%2026-02-03Fix
CVE-2026-1210Happy Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-02-03Fix
CVE-2026-1207Django potential SQL injection via raster lookups on PostGIS5.4CISA ADP v3.112.8%2026-02-03Reported exploitedNucleiEmerging ThreatsExploit codeFix
CVE-2026-1065Form Maker by 10Web WordPress plugin unauthenticated stored cross-site scripting via SVG file7.2CNA v3.10.4%2026-02-03Fix
CVE-2026-1058Form Maker by 10Web WordPress plugin unauthenticated stored cross-site scripting via Hidden field7.1CNA v3.10.4%2026-02-03Fix
CVE-2026-0950Spectra Gutenberg Blocks WordPress plugin unauthenticated information disclosure in sensitive data5.3CNA v3.10.4%2026-02-03Fix
CVE-2026-0909WP ULike WordPress plugin insecure direct object reference to authenticated arbitrary Log deletion5.3CNA v3.10.4%2026-02-03Fix
CVE-2026-0620TP-Link Systems AXE75 L2TP over IPSec Encryption failure on ArcherAXE756.0CNA v4.00.3%2026-02-03Fix
CVE-2026-0617LatePoint WordPress plugin stored cross-site scripting7.2CNA v3.10.4%2026-02-03Fix
CVE-2026-0383Information disclosure in Brocade Fabric OS, and8.2CNA v4.00.2%2026-02-03Fix
CVE-2026-25228SignalK Server has path traversal leading to information disclosure5.0CNA v3.10.4%2026-02-02Fix
CVE-2026-25222PolarLearn affected by User Enumeration via Argon2 Timing Attack on Sign-In endpoint6.3CNA v4.00.5%2026-02-02
CVE-2026-25221PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub and Google)2.3CNA v4.00.2%2026-02-02
CVE-2026-25202Samsung Electronics MagicINFO 9 Server hard-coded credentials9.8CNA v3.10.5%2026-02-02Fix
CVE-2026-25201Samsung Electronics MagicINFO 9 Server unrestricted file upload8.8CNA v3.10.5%2026-02-02Fix
CVE-2026-25200Samsung Electronics MagicINFO 9 Server unrestricted file upload9.8CNA v3.10.5%2026-02-02Fix
CVE-2026-25144Talishar has a stored XSS which can lead to data exfiltration and user impersonation5.3CNA v3.10.3%2026-02-02
CVE-2026-25142SandboxJS sandbox escape10.0CNA v3.11.2%2026-02-02Fix
CVE-2026-25137NixOs Odoo database and filestore publicly accessible with default odoo configuration9.1CNA v3.110.5%2026-02-02Fix
CVE-2026-25134Group-office argument injection in MaintenanceController::actionZipLanguage9.4CNA v4.00.9%2026-02-02Fix
CVE-2026-25060OpenList Insecure TLS Default Configuration8.1CNA v3.10.3%2026-02-02Fix
CVE-2026-25059OpenList affected by path traversal in file copy and remove handlers8.8CNA v3.10.7%2026-02-02Fix
CVE-2026-24788RaspAP raspap-webgui contains an OS command injection8.7CNA v4.01.4%2026-02-02Fix
CVE-2026-24763Authenticated command injection in OpenClaw Docker Execution via path Environment variable8.8CNA v3.15.3%2026-02-02Fix
CVE-2026-24737jsPDF has a PDF injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution8.1CNA v3.10.6%2026-02-02Fix
CVE-2026-24471continuwuity room membership event signing confused deputy9.3CNA v4.00.4%2026-02-02Fix
CVE-2026-24133jsPDF affected by denial of service (DoS) via Unvalidated BMP Dimensions in BMPDecoder8.7CNA v4.00.6%2026-02-02Fix
CVE-2026-24071Native Instruments Native Access XPC privileged helper race condition7.8CISA ADP v3.10.2%2026-02-02
CVE-2026-24070Local privilege escalation via DYLIB injection in Native Instruments Native Access8.8CISA ADP v3.10.2%2026-02-02Fix
CVE-2026-24051OpenTelemetry-Go affected by arbitrary code execution via path Hijacking7.0CNA v3.10.2%2026-02-02Fix
CVE-2026-24043jsPDF affected by Stored XMP Metadata injection (spoofing and Integrity Violation)6.9CNA v4.00.3%2026-02-02Fix
CVE-2026-24040jsPDF has a Shared State race condition in addJS plugin6.3CNA v4.00.3%2026-02-02Fix
CVE-2026-24007Tuleap is missing CSRF protection in the Overview inconsistent items4.6CNA v3.10.2%2026-02-02Fix
CVE-2026-23997FacturaScripts has a stored cross-site scripting (XSS) in Observations field via History view8.0CNA v3.10.4%2026-02-02
CVE-2026-23515signalk-server RCE command injection in Signal K set-system-time plugin10.0CNA v3.14.6%2026-02-02Fix