CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- tripath project electioneLection 2.0 - 'id' SQL Injection7.1 High
- atutorATutor 2.2.4 - 'id' SQL Injection7.0 High
- ace security aptina ar0130 960p 1.3mp cameraAptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure8.7 High
- amss++AMSS++ v 4.31 - 'id' SQL Injection8.8 High
- amss++AMSS++ 4.7 - Backdoor Admin Account9.3 Critical
- nsauditor ftp password recoverSpotFTP-FTP Password Recover 2.4.8 - Denial of Service6.7 Medium
- asc applied software consultants timetablesaSc TimeTables 2020.11.4 - Denial of Service6.7 Medium
- core ftp leCore FTP LE 2.2 - Denial of Service6.7 Medium
- bdtask business live chat softwareBusiness Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- cyberoam authentication clientCyberoam Authentication Client 2.1.2.7 - Buffer Overflow (SEH)8.4 High
- denpiligrim 3dp-manager3DP-MANAGER Uses Hard-coded Credentials9.8 Critical
- bishopfox sliverSliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service7.5 High
- vim, neovim +1 moreHeap Overflow in Vim6.6 Medium
- datahubDataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade7.5 High
- antrea-io antreaAntrea has invalid enforcement order for network policy rules caused by integer overflow8.0 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formPolicyRouteConf strcpy buffer overflow8.7 High
github.com/authzed/spicedbGoLookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic1.3 Low- openprojectCommand Injection on OpenProject repositories leads to Remote Code Execution9.4 Critical
- openprojectOpenProject vulnerable to Stored HTML injection3.5 Low
- ggml-org llama.cppggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow4.8 Medium
- beyondtrust privileged remote access, remote support (rs) and privileged remote access (pra), remote support +1 more +3 moreRemote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)9.9 Critical
- google cloud gemini enterprise (formerly agentspace)Information Disclosure via Bucket Squatting in Google Cloud Agentspace.9.1 Critical
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formSyslogConf strcpy buffer overflow8.7 High
- triliumnext triliumTrilium Notes has a Timing Attack Vulnerability in /api/login/sync7.4 High
- homarrHomarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping5.3 Medium
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formTimeGroupConfig strcpy buffer overflow8.7 High
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formIpGroupConfig strcpy buffer overflow8.7 High
- lintsinghua deepauditDeepAudit Affected by User Enumeration via Broken Access Control2.1 Low
- color iccdeviccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()7.8 High
- calibre-ebook calibreCalibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export7.8 High
- calibre-ebook calibrecalibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution8.6 High
- calibre-ebook calibrecalibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution8.2 High
- slack nebulaNebula Has Possible Blocklist Bypass via ECDSA Signature Malleability7.6 High
- flycatcher toys smart pixelator, flycatcher smart pixelator firmware +1 moreFlycatcher Toys smART Pixelator Bluetooth Low Energy missing authentication5.3 Medium
- adonisjs bodyparser, core +1 moreAdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection7.5 High
gogs.io/gogsGo,govulncheck-vulndbopenSUSE +1 moreGogs has authorization bypass in repository deletion API5.7 Mediumgogs.io/gogsGoGogs vulnerable to Stored XSS via Mermaid diagrams7.3 Highdydx-v4-clientPyPIA single post-release of dydx-v4-client contained obfuscated multi-stage loader9.3 CriticalphlexRubyGemsPhlex XSS protection bypass via attribute splatting, dynamic tags, and href values7.1 High- portabilis i-educarPortabilis i-Educar User Data meusdadod.php cross site scripting5.1 Medium
- adonisjs bodyparser, core +1 moreAdonisJS multipart body parsing has Prototype Pollution issue7.2 High
- hedgedocHedgeDoc security headers for uploaded files were not working4.3 Medium
- tanium, tanium client +1 moreTanium addressed a denial of service vulnerability in Tanium Client.3.3 Low
- blakeblackshear frigateFrigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape9.1 Critical
- keylime, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 moreKeylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication9.4 Critical
- b3log siyuanLute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink4.6 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Web Management set_ac_server os command injection5.1 Medium
- actix actix-filesactix-files before 0.6.10 Denial of Service via empty Range header6.9 Medium
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)9.3 Critical
- actix actix-filesactix-files before 0.6.10 Information Disclosure via Files6.3 Medium
- Show moreLoading…