CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- smn2gnt mcp salesforce connector, mcp-salesforce +1 moreMCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token6.6 Medium
- pydantic ai, pydantic-ai, red hat enterprise linux ai (rhel ai) 3 +2 morePydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL7.1 High
- tgies client-certificate-authclient-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect6.1 Medium
- microsoft semantic-kernelSemantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK10.0 Critical
- samclarke sceditorSCEditor affected by DOM XSS via emoticon URL/HTML injection5.4 Medium
- pydantic ai, pydantic-ai, red hat enterprise linux ai (rhel ai) 3 +2 morePydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling8.6 High
- open5gsOpen5GS PGW S5U Address sgwc_sxa_handle_session_modification_response null pointer dereference6.9 Medium
- zulip, zulip server +1 moreZulip affected by Stored XSS in user profile modal1.1 Low
- devcode openstamanagerOpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module8.7 High
- devcode openstamanagerOpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection in Scadenzario Print Template8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection in the Prima Nota module8.7 High
- devcode openstamanagerOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)8.7 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_ipv6 sub_424D20 os command injection5.1 Medium
- devcode openstamanagerOpenSTAManager has an OS Command Injection in P7M File Processing9.4 Critical
- openprojectOpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer4.3 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json7.7 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code Has Permission Deny Bypass Through Symbolic Links2.3 Low
- anthropic claude code, anthropics claude-code +1 moreClaude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions7.7 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection7.7 High
- gogsGogs vulnerable to arbitrary file deletion via path traversal in wiki page update7.2 High
- gogsGogs has arbitrary file read/write via path traversal in Git hook editing6.5 Medium
- algonet orcastatllm researcher, algonetlab orcastatllm-researcher +1 moreOrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page5.3 Medium
- gogsGogs user can update repository content with read-only permission6.5 Medium
- gogsGogs is Vulnerable to Denial of Service6.5 Medium
- gogsGogs Vulnerable to 2FA Bypass via Recovery Code7.7 High
- code-projects simple blood donor management systemcode-projects Simple Blood Donor Management System editcampaignform.php sql injection6.9 Medium
- xerox centreware, centreware web +1 moreStored XSS on Xerox CentreWare Web 7.0.65.3 Medium
- bontrofftech medical center portal management systemSourceCodester Medical Center Portal Management System emp_edit1.php sql injection6.9 Medium
- gogsGogs's update .git/config file allows remote command execution9.3 Critical
- asterisk, sangoma certified asterisk +1 moreast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation0.0 None
- asterisk, sangoma certified asterisk +1 moreAsterisk vulnerable to potential privilege escalation0.0 None
- asterisk, sangoma certified asterisk +1 moreAsterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection2.0 Low
- bluestacks blue stacks app playerBlue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service Path8.5 High
- asterisk, sangoma certified asterisk +1 moreThe Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization3.5 Low
- inforprograma jumpstartJumpStart 0.6.0.0 - 'jswpbapi' Unquoted Service Path8.5 High
- issivs intelligent security system securos enterpriseIntelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service Path8.5 High
- thejshen contentmanagementsystemTheJshen contentManagementSystem 1.04 - 'id' SQL Injection7.1 High
- acer launch managerAcer Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service Path8.5 High
- thrsrossi millhouse projectthrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting5.1 Medium
- thejshen globitek cmsthejshen Globitek CMS 1.4 - 'id' SQL Injection7.1 High
- rimbalinux ahadposrimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection7.1 High
- lolypop55 html5 snmphtml5_snmp 1.11 - 'Router_ID' SQL Injection7.1 High
- lolypop55 html5 snmphtml5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting5.1 Medium
- alps hid monitor serviceAlps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path8.5 High
- wondershare application framework serviceWondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path8.5 High
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection6.9 Medium
- infor syteline erpUse of Hard-Coded Cryptographic Key for Password Storage7.1 High
- artifex mupdfMuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free5.9 Medium
- Show moreLoading…