CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_qos sub_420688 os command injection8.6 High
- tenda tx9, tx9 firmware +1 moreTenda TX9 setMacFilterCfg sub_4223E0 buffer overflow8.7 High
- tenda tx9, tx9 firmware +1 moreTenda TX9 fast_setting_wifi_set sub_432580 buffer overflow8.7 High
- tenda tx9, tx9 firmware +1 moreTenda TX9 SetStaticRouteCfg sub_42D03C buffer overflow8.7 High
- tenda tx3, tx3 firmware +1 moreTenda TX3 SetIpMacBind buffer overflow8.7 High
- projectworlds online food ordering systemprojectworlds Online Food Ordering System view-ticket.php sql injection6.9 Medium
- utt hiper 810, 810 firmware +1 moreUTT HiPER 810 formPdbUpConfig sub_43F020 command injection5.3 Medium
- phpgurukul hospital management systemPHPGurukul Hospital Management System manage-doctors.php sql injection5.1 Medium
- code-projects online music sitecode-projects Online Music Site AdminUpdateCategory.php unrestricted upload6.9 Medium
- code-projects online music sitecode-projects Online Music Site AdminUpdateCategory.php sql injection6.9 Medium
- xixianliang harmonyos-mcp-server, harmonyos mcp server +1 moreXixianLiang HarmonyOS-mcp-server input_text os command injection5.3 Medium
- burtthecoder mcp-maigret, maigret mcp server +1 moreBurtTheCoder mcp-maigret search_username index.ts command injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X set_ac_status os command injection8.6 High
- jayarsiech jay login & registerJAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile8.8 High
- jayarsiech jay login & registerJAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user9.8 Critical
- wekanWeKan Custom Translation translationBody.js setCreateTranslation improper authorization5.3 Medium
- wekanWeKan Rules rules.js RulesBleed authorization5.3 Medium
- wekanWeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure6.9 Medium
- wekanWeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control5.3 Medium
- wekanWeKan Meteor Publication cards.js CardPubSubBleed information disclosure5.3 Medium
- convoypanel panelXiaopi Panel WAF Firewall demo.php sql injection5.3 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Configuration Parameter set_server_settings os command injection8.6 High
gpsdOSS-FuzzUse-of-uninitialized-value in ntrip_parse_urlNo score- utt hiper 810, 810 firmware +1 moreUTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection8.6 High
- angeljudesuarez society management systemitsourcecode Society Management System edit_activity.php sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System edit_expenses.php sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System delete_expenses.php sql injection6.9 Medium
- angeljudesuarez society management systemitsourcecode Society Management System edit_admin.php sql injection6.9 Medium
- wekanWeKan < 8.20 Migration Functionality Insufficient Permission Checks7.1 High
- wekanWeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass7.1 High
- wekanWeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId5.3 Medium
- wekanWeKan < 8.19 Cross-board Card Move Without Destination Authorization7.1 High
- wekanWeKan < 8.19 Read-only Board Roles Can Update Cards7.1 High
- wekanWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation7.1 High
- wekanWeKan < 8.19 Checklist Creation Cross-Board IDOR7.1 High
- wekanWeKan < 8.19 Attachments Publication Information Disclosure5.3 Medium
- wekanWeKan < 8.19 Attachment Upload Object Relationship Validation Bypass7.1 High
- wekanWeKan < 8.19 LDAP Authentication Filter Injection8.7 High
- macrozheng mallmacrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure9.3 Critical
- shenzhen tenda technology tenda g300-f, tenda g300-f firmware +1 moreTenda G300-F Command Injection via formSetWanDiag8.6 High
- mapnikMapnik value.cpp operator divide by zero4.8 Medium
- tpadmin project tpadminyuan1994 tpadmin WebUploader preview.php deserialization6.9 Medium
- jeecg bootJeecgBoot Retrieval-Augmented Generation edit path traversal5.3 Medium
- swiftbuyTasin1025 SwiftBuy login.php excessive authentication6.3 Medium
- jsbroks coco annotatorjsbroks COCO Annotator Delete Category undo improper authorization5.3 Medium
- jsbroks coco annotatorjsbroks COCO Annotator Endpoint long_task denial of service6.9 Medium
- yeqifu warehouseyeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Department Management DeptController.java deleteDept improper authorization5.3 Medium
- janobe online class record systemSourceCodester Online Class Record System search.php sql injection6.9 Medium
- Show moreLoading…