CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- ultravnc team viewer, uvnc ultravnc viewer +1 moreUltraVNC Viewer 1.2.4.0 - 'VNCServer' Denial of Service4.6 Medium
- ultravnc team launcher, uvnc ultravnc, ultravnc launcher +2 moreUltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of Service6.7 Medium
- ultravnc team launcher, uvnc ultravnc, ultravnc launcher +2 moreUltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service6.7 Medium
- nsasoft product key explorerProduct Key Explorer 4.2.2.0 - 'Key' Denial of Service6.7 Medium
- nsasoft nsauditorNsauditor 3.2.0.0 - 'Name' Denial of Service6.7 Medium
- memuplay memu playMemu Play 7.1.3 - Insecure Folder Permissions8.5 High
- emtec zoc terminalZOC Terminal 7.25.5 - 'Script' Denial of Service6.7 Medium
- dnsmasq dnsmasq-utilsdnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service6.9 Medium
- drive software company free desktop clockFree Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)8.4 High
- edimax ew-7438rpn mini firmware, edimax technology ew-7438rpn mini +1 moreEdimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution9.3 Critical
- 4mhz b64decB64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter)8.4 High
- wcchandler pingerPinger 1.0 - Remote Code Execution9.3 Critical
- code::blocksCODE::BLOCKS 16.01 - Buffer Overflow (SEH) UNICODE6.7 Medium
- rubo medical imaging dicom viewerRubo DICOM Viewer 2.0 - Buffer Overflow (SEH)8.4 High
- nsasoft nsauditorNsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite))8.4 High
- p5 fnip-8x16aP5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- jizhicmsjizhiCMS 1.6.7 - Arbitrary File Download8.6 High
- ciprianmp phpmychat plus, phpmychat-plus +1 morephpMyChat Plus 1.98 'deluser.php' SQL Injection8.8 High
- ibm webmethods integration (on prem) - integration serverIBM webMethods Integration Sever is affected by6.5 Medium
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container Information Disclosure5.1 Medium
- ibm aspera consoleA SQL Injection vulnerability has been addressed in IBM Aspera Console8.6 High
- wpsoul greenshift – animation and page builder blocksGreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css5.4 Medium
- primion digitek digitek adt1100, digitek dt950 +1 morePath Traversal in Digitek from Grupo Azkoyen8.7 High
- No product listediomad Company Admin Block sql injection5.1 Medium
- time-rs timetime affected by a stack exhaustion denial of service attack6.8 Medium
- teamviewer remote, samsung open source one, teamviewer tensor +2 moreImproper Access Control in TeamViewer clients7.2 High
- yugabytedb inc anywhereYugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI2.4 Low
- opensolution quick.cartSession Fixation in Quick.Cart4.8 Medium
- opensolution quick.cartPlaintext password display in Quick.Cart6.9 Medium
- pkthree peter’s date countdownPeter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- bplugins all in one image viewer block – gutenberg block to create image viewer with hyperlinkAll In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint7.2 High
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification5.3 Medium
- elextensions elex wordpress helpdesk & customer ticketing systemELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update5.3 Medium
- themeisle robin image optimizer – unlimited image optimization & webp converterRobin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field6.4 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension4.3 Medium
- web2pyweb2py has an Open Redirect Vulnerability5.1 Medium
- nokia infinera dnaA time-based SQL Injection vulnerability in Infinera DNA6.3 Medium
- brechtvds dynamic widget contentDynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field6.4 Medium
- catchthemes essential widgetsEssential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- shortpixel image optimizer – optimize images, convert webp & avifShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter4.9 Medium
- nukegraphic cms cmsStored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.28.2 High
- mitsubishi electric corporation melsec iq-r series r08pcpu, melsec iq-r series r120pcpu, melsec iq-r series r16pcpu +1 more +3 moreInformation Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products8.8 High
- go toolchain cmd/cgo, golang go, red hat enterprise linux 10 +31 more +33 morePotential code smuggling via doc comments in cmd/cgo8.6 High
- mitsubishi electric corporation freqship-mini for windowsMalicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows8.8 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +1 more +3 moreA post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI...7.2 High
- frangoteam fuxaFUXA Unauthenticated Remote Arbitrary Device Tag Write9.3 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API9.5 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration9.5 Critical
- frangoteam fuxaFUXA Unauthenticated Exposure of Plaintext Database Credentials9.1 Critical
- wekanWeKan LDAP User Sync syncUser.js SyncLDAPBleed access control5.3 Medium
- Show moreLoading…