CVEs published in February 2026
4,803 vulnerabilities, 449 critical, 20 exploited.
- tenda f453, f453 firmware +1 more Tenda F453 SafeUrlFilter fromSafeUrlFilter buffer overflow 8.7 High
- tenda f453, f453 firmware +1 more Tenda F453 SafeMacFilter fromSafeMacFilter buffer overflow 8.7 High
- gvectors wpforo forum wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter 8.8 High
- gvectors wpforo forum wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates 4.8 Medium
- gvectors wpforo forum wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script 4.8 Medium
- gvectors wpforo forum wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed 6.9 Medium
- gvectors wpforo forum wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload 5.1 Medium
- gvectors wpforo forum wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler 7.1 High
- gvectors wpforo forum wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers 5.3 Medium
- gvectors wpforo forum wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler 5.3 Medium
- gvectors wpforo forum wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler 5.3 Medium
- microchip timepictra TimePictra Stored Cross-Site Scripting 9.3 Critical
- microchip timepictra TimePictra Authentication Bypass Vulnerability 9.3 Critical
- themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code 7.5 High
- smub wp mail logging WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field 7.5 High
- unknown super stage wp Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection 6.5 Medium
- svelte sveltekit, sveltejs kit +1 more SvelteKit 2.49.0 before 2.53.3 Denial of Service via form 8.7 High
- fasterxml jackson-core jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service 6.9 Medium
-
maven-modelOSS-Fuzz Security exception in java.base/java.util.Arrays.copyOfRange No score - statamic cms, statamic +1 more Statamic vulnerable to privilege escalation via stored cross-site scripting 8.7 High
- statamic cms, statamic +1 more Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs 8.0 High
- dhrumil kumbhani featured image from content Featured Image from Content < 1.7 Authenticated SSRF via save_post 5.3 Medium
- statamic cms, statamic +1 more Statamic's missing authorization allows access to email addresses 6.5 Medium
- opendcim openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter 9.3 Critical
- statamic cms, statamic +1 more Statamic Vulnerable to Server-Side Request Forgery via Glide 6.8 Medium
- opendcim openDCIM <= 23.04 SQL Injection in Config::UpdateParameter 9.3 Critical
- opendcim openDCIM <= 23.04 Missing Authorization in install.php 9.3 Critical
- openclaw OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata 5.3 Medium
- vim Vim has stack-buffer-overflow in build_stl_str_hl() 2.2 Low
- vim Vim has a heap-buffer-overflow and a segmentation fault 5.3 Medium
- vim Vim has Heap-based Buffer Overflow and OOB Read in :terminal 4.4 Medium
- vim Vim has Heap-based Buffer Underflow in Emacs tags parsing 5.3 Medium
- vim Vim has Heap-based Buffer Overflow in Emacs tags parsing 4.4 Medium
- vim Vim has OS Command Injection in netrw 4.4 Medium
- labredescefetrj wegia WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)` 9.8 Critical
- labredescefetrj wegia WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection 10.0 Critical
- labredescefetrj wegia WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php 9.8 Critical
- gradio-app gradio Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing 8.2 High
- gradio-app gradio Gradio has Open Redirect in OAuth Flow 4.3 Medium
- gradio-app gradio Gradio has Absolute Path Traversal on Windows with Python 3.13+ 7.5 High
- gradio-app gradio Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret 0.0 None
- openclaw OpenClaw Skill Env applySkillConfigenvOverrides code injection 5.3 Medium
- statamic cms, statamic +1 more Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass 8.8 High
- chainguard malcontent malcontent's nested archive extraction failure can drop content from scan inputs 6.9 Medium
- chainguard kaniko, red hat openshift serverless +1 more kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory 8.2 High
- nimiq core-rs-albatross, proof-of-stake +1 more nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification 7.1 High
- docker model-runner Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint 7.6 High
- thinkst canarytokens "PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting 1.3 Low
- cern indico Indico missing access check in event series management API 6.5 Medium
- py-pdf pypdf Manipulated RunLengthDecode streams can exhaust RAM 6.9 Medium
- Show olderLoading…