CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- htplugins docus – youtube video playlistDocus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- dcn dcme-320, dcnetworks dcme-320 firmware +1 moreDCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection5.1 Medium
- tydac ag map+, tydac map\+ +1 moreReflected Cross-Site Scripting in PDF Export Error Message5.6 Medium
- red hat ansible automation platform 2, ansible automation platform 2.6 +1 moreAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api4.2 Medium
- libuvclibuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference4.8 Medium
- No product listedoatpp Type.hpp ObjectWrapper null pointer dereference4.8 Medium
- mrubymruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free4.8 Medium
- kalyan02 nanocmskalyan02 NanoCMS User Information pagesdata.txt direct request6.9 Medium
- isaacwasserman mcp-vegalite-serverisaacwasserman mcp-vegalite-server visualize_data eval code injection5.3 Medium
- kubernetes ingress-nginxingress-nginx auth-proxy-set-headers nginx configuration injection8.8 High
- free5gcFree5GC SMF SessionDeletionResponse null pointer dereference6.9 Medium
- free5gcFree5GC pfcp_reports.go identityTriggerType null pointer dereference6.9 Medium
- bplugins timeline block – beautiful timeline builder for wordpress (vertical & horizontal timelines)Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute4.3 Medium
- free5gcFree5GC SMF datapath.go ResolveNodeIdToIp denial of service6.9 Medium
- free5gcFree5GC SMF establishPfcpSession null pointer dereference6.9 Medium
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC auth_check_userpass2 default credentials6.9 Medium
libicalOSS-FuzzSegv on unknown address in icalarray_appendNo scoreshadercOSS-FuzzSegv on unknown address in glslang::TIntermediate::addSymbolNo scorekmimeOSS-FuzzGlobal-buffer-overflow in nameMatchNo scoretinyusbOSS-FuzzNull-dereference READ in ubsan_GetStackTraceNo score- edimax br-6288acl, br-6288acl firmware +1 moreEdimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross site scripting4.8 Medium
debian-security-supportDebiandebian-security-support - updateNo score- micropythonmicropython runtime.c mp_import_all memory corruption4.8 Medium
- getgophish gophishGophish is vulnerable to Incorrect Access Control7.6 High
- collaboraonline onlineCollabora Online vulnerable to Authorization Bypass5.3 Medium
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT has a DoS vulnerability in ReadRSSFeedBlock8.7 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) for Android Spoofing Vulnerability6.5 Medium
- microsoft azure front doorAzure Front Door Elevation of Privilege Vulnerability9.8 Critical
- microsoft azure functionsAzure Function Information Disclosure Vulnerability8.2 High
- microsoft azure arcAzure Arc Elevation of Privilege Vulnerability8.6 High
- edimax br-6258n, br-6258n firmware +1 moreEdimax BR-6258n formStaDrvSetup redirect5.1 Medium
- bishopfox sliverWebsite Path Traversal / Arbitrary File Read (Authenticated) in Sliver6.5 Medium
- openfga, openfga helm charts +1 moreOpenFGA Improper Policy Enforcement5.8 Medium
- nyariv sandboxjsSandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses10.0 Critical
- wekanWeKan REST Endpoint boards.js BoardTitleRESTBleed access control5.3 Medium
github.com/opencloud-eu/opencloudGoOpenCloud Affected by Public Link Exploit8.2 High- qdrantQdrant affected by arbitrary file write via `/logger` endpoint8.6 High
- spreeSpree allows unauthenticated users can access all guest addresses7.7 High
- fortinet fortiosFortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device...3.2 Low
- spreeUnauthenticated Spree Commerce users can view completed guest orders by Order ID7.7 High
- zauberzeug niceguiNiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write7.5 High
- nyariv sandboxjsSandboxJS has a Sandbox Escape10.0 Critical
- nyariv sandboxjsSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution10.0 Critical
- payloadcms payloadPayload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)5.4 Medium
- wekanWeKan Attachment Storage attachments.js MoveStorageBleed access control5.3 Medium
intel-microcodeTuxCareUpdate of intel-microcodeNo score- payloadcms payloadPayload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters9.8 Critical
- nyariv sandboxjsSandboxJS has a Sandbox Escape10.0 Critical
- opencloud-eu reva, heinlein opencloud reva +1 moreREVA Public Link Exploit8.2 High
- wekanWeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control5.3 Medium
- Show moreLoading…