CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Admin JWT Minting10.0 Critical
libicalOSS-FuzzUse-of-uninitialized-value in vcardstructured_freeNo score- wekanWeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization5.3 Medium
- apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 moreApache Tomcat Native, Apache Tomcat: OCSP revocation bypass7.5 High
- apache tomcatApache Tomcat: Security constraint bypass with HTTP/0.93.7 Low
- microweberMicroweber Cross-site Scripting vulnerability6.1 Medium
- microweberMicroweber has a Cross-site Scripting vulnerability6.1 Medium
- 1000mz chestnutcmsAn issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via...7.2 High
- monstra cmsMonstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin....8.8 High
- zipperapp my teditorA path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via...5.5 Medium
- axigen mail serverAxigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS)...9.0 Critical
- axigen mail serverAxigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery...8.8 High
- axigen mail serverAxigen Mail Server before 10.5.57 contains an improper access control vulnerability in the...8.1 High
- axigen mail serverAxigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the...5.4 Medium
- apache tomcatApache Tomcat: Client certificate verification bypass due to virtual host mapping9.1 Critical
- wekanWeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control5.3 Medium
- roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggersPopup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints8.2 High
- gcafe gcafé_GCafé 3.0 - 'gbClienService' Unquoted Service Path8.5 High
- shrew soft vpn clientShrew Soft VPN Client 2.2.2 - 'iked' Unquoted Service Path8.5 High
- wacom wtabletserviceWacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path8.5 High
- webcompanion adaware web companion versionAdaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path8.5 High
- alps device controllerAlps Pointing-device Controller 8.1202.1711.04 - 'ApHidMonitorService' Unquoted Service Path8.5 High
- ncp-e ncp secure entry clientNCP_Secure_Entry_Client 9.2 - Unquoted Service Paths8.5 High
- rockwellautomation studioStudio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path8.5 High
- filehorse bartvpnBartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path8.5 High
- photodex proshow producerProShow Producer 9.0.3797 - Unquoted Service Path8.5 High
- easy-hide-ip ipEasy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service Path8.5 High
- tenaxsoft texassoft cyberplanetTexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service Path8.5 High
- netgate data backupNETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path8.5 High
- netgate amiti antivirusAmiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability8.5 High
- wftpserver wing ftp server, wing ftp server ftp server +1 moreWing FTP Server 6.0.7 - Unquoted Service Path8.5 High
- wekanWeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control5.3 Medium
- wekanWeKan REST API checklistItems.js Checklist REST Bleed improper authorization5.3 Medium
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT has SSRF vulnerability in SendDiscordFileBlock9.3 Critical
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT has SSRF vulnerability in ReadRSSFeedBlock9.3 Critical
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks8.1 High
- color iccdeviccDEV vulnerable to OOB in CIccXform3DLut::Apply()7.8 High
- color iccdeviccDEV vulnerable to Stack-based Buffer Overflow in CIccTagFloatNum::GetValues()7.8 High
- color iccdeviccDEV vulnerable to Heap Buffer Overflow in CIccFileIO::Read8()7.8 High
- color iccdeviccDEV vulnerable to Heap Buffer Overflow in CIccIO::WriteUInt16Float()7.8 High
- wekanWeKan REST API boards.js setBoardOrgs improper authorization2.3 Low
- tum navigatumNavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality8.8 High
- joinmastodon mastodonMastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)6.5 Medium
- wintercms winterWinter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager0.0 None
- zentaoZenTao Webhook model.php fetchHook server-side request forgery5.1 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software6.3 Medium
- ibm operations analytics - log analysisIBM Operations Analytics - Log Analysis is affected by CSRF Token Replay Attack4.3 Medium
- ibm jazz reporting serviceIBM Jazz Reporting Service Denial of Service3.5 Low
- ibm jazz reporting serviceIBM Jazz Reporting Service Information Disclosure3.5 Low
- Show moreLoading…