CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- janobe online class record systemSourceCodester Online Class Record System controller.php sql injection6.9 Medium
- phpgurukul beauty parlour management systemPHPGurukul Beauty Parlour Management System accepted-appointment.php sql injection6.9 Medium
- janobe online class record systemSourceCodester Online Class Record System login.php sql injection6.9 Medium
- utt hiper 810g, 810g firmware +1 moreUTT HiPER 810G Management formFireWall strcpy buffer overflow8.7 High
- d-link dwr-m921, dlink dwr-m921 firmware +1 moreD-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection8.6 High
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_language os command injection8.6 High
- code-projects social networking sitecode-projects Social Networking Site delete_post.php sql injection6.9 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_mac_clone os command injection5.1 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_password os command injection5.1 Medium
- utt hiper 810, 810 firmware +1 moreUTT HiPER 810 formUser setSysAdm command injection8.6 High
- yeqifu warehouseyeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization5.3 Medium
- omi-mexico omigoOMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- simonfairbairn the bucketlisterThe Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes6.5 Medium
- simonfairbairn the bucketlisterThe Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification4.3 Medium
- mrlister1 wonka slideWonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- jmrukkers wikiloops track playerWikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- arkapravamajumder title animatorTITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- tigor4eg video onclickVideo Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- premmercePremmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint6.4 Medium
- brstefanovic advanced country blockerAdvanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key5.3 Medium
- ariagle mp-ukagakaMP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting6.1 Medium
- alexdtn subitem al sliderSubitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- dannycarlton simple bible verse via shortcodeSimple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- yeqifu warehouseyeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Role Management RoleController.java deleteRole improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization5.3 Medium
- unknown post slidesPost Slides <= 1.0.1 - Contributor+ Local File Inclusion5.5 Medium
- boldthemes bold page builderBold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- boldthemes bold page builderBold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode6.4 Medium
- yeqifu warehouseyeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control5.3 Medium
- zoneland o2oaO2OA HTTP POST Request check xml external entity reference5.3 Medium
- itsourcecode school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- hclsoftware hcl devops velocityHCL DevOps Velocity is susceptible to a Denial of Service vulnerability6.8 Medium
- utt 进取 520w, 520w firmware +1 moreUTT 进取 520W formP2PLimitConfig strcpy buffer overflow8.7 High
gpsdOSS-FuzzUNKNOWN READ in gpsd_pollNo score- wftpserver wing ftp server, wing ftp server ftp server +1 moreWing FTP Server < 6.2.7 - Cross-site Request Forgery5.1 Medium
- raimersoft tapinradioTapinRadio 2.12.3 - 'username' Denial of Service6.7 Medium
- raimersoft tapinradioTapinRadio 2.12.3 - 'address' Denial of Service6.7 Medium
- celestial software absolutetelnetAbsoluteTelnet 11.12 - 'SSH2/username' Denial of Service6.9 Medium
- celestial software absolutetelnetAbsoluteTelnet 11.12 - "license name" Denial of Service6.7 Medium
- celestial software absolutetelnetAbsoluteTelnet 11.12 - "license entry" Denial of Service6.7 Medium
- quickdateQuickDate 1.3.2 - SQL Injection8.8 High
- wedding slideshow studio slideshow studio, wedding-slideshow-studio wedding slideshow studio +1 moreWedding Slideshow Studio 1.36 - 'Key' Buffer Overflow8.4 High
- wedding slideshow studio slideshow studio, wedding-slideshow-studio wedding slideshow studio +1 moreWedding Slideshow Studio 1.36 - 'Name' Buffer Overflow8.4 High
- veridium sprintworkSprintWork 2.3.1 - Local Privilege Escalation8.5 High
- parallaxis cuckoo clockCuckoo Clock 5.0 - Buffer Overflow8.4 High
- dbpower c300 hd cameraDBPower C300 HD Camera - Remote Configuration Disclosure8.7 High
- core ftp liteCore FTP Lite 1.3 - Denial of Service (PoC)6.7 Medium
- Show moreLoading…