CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- craftcms cms, craft cms +1 moreCraft has a Stored XSS in Entry Types Name1.9 Low
- markusproject markusZip Slip in MarkUs config upload allowing RCE9.1 Critical
ccextractorDebianCCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-bounds4.8 Medium- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreKeycloak: incorrect ownership checks in /uma-policy/5.4 Medium
- markusproject markusMarkUs has a submission-view IDOR exposes all student submissions6.5 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant8.8 High
- error311 fileriseFileRise affected by an Unauthenticated File Read Due to Insufficient Access Control7.5 High
- error311 fileriseFileRise affected by HTML Injection using color property in file tags4.6 Medium
- openprojectOpenProject has Improper Access Control on User Management allows user managers to lock admin accounts6.7 Medium
- super-linterCommand injection via crafted filenames in Super-linter Action8.8 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfig7.5 High
- step-security harden-runnerBypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)6.3 Medium
- litestarFileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)6.5 Medium
- litestarLitestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns6.5 Medium
- litestarLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins7.4 High
- janet-lang janetjanet-lang janet specials.c janetc_if out-of-bounds4.8 Medium
- dell display and peripheral manager (windows)Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link...6.6 Medium
- silabs.com simplicity sdkDPA countermeasures not reseeded under certain conditions1.0 Low
- janet-lang janetjanet-lang janet os.c os_strftime out-of-bounds4.8 Medium
- janet-lang janetjanet-lang janet compile.c janetc_pop_funcdef out-of-bounds4.8 Medium
- checkmk gmbh checkmkMissing Permission Check on Analyze Configuration Page5.3 Medium
- gofiber fiberFiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure9.2 Critical
- red hat cert manager support for red hat openshift release 1.18, ai inference server 3.2, ai inference server 3.3 +23 more +25 moreGnutls: gnutls: denial of service via excessive resource consumption during certificate verification5.3 Medium
- powerdns recursorCrafted zones can lead to increased incoming network traffic5.3 Medium
- powerdns recursorCrafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor5.3 Medium
- birtech information technologies industry and trade ltd. co. sensawayUnrestricted File Upload in Birtech Information Technologies' Sensaway8.8 High
- birtech information technologies industry and trade ltd. co. sensewayCleartext password storage in Birtech Information Technologies' Sensaway6.5 Medium
- birtech information technologies industry and trade ltd. co. sensewayImproper Authentication in Birtech Information Technologies' Sensaway7.3 High
- atlas educational software industry ltd. co. k12netSensitive Data Exposure in Atlas Software's k12net6.8 Medium
- loggro pymes pymesStored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes5.1 Medium
- loggro pymes pymesStored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes5.1 Medium
- techjewel fluent forms pro add on packFluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'5.4 Medium
- xpoda türkiye information technology inc. password moduleSQLi in Xpoda Türkiye Information Technology's Password Module9.8 Critical
- jetbrains hubIn JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was...9.1 Critical
- jetbrains pycharmIn JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible8.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs6.5 Medium
- apache airflowApache Airflow: Airflow externalLogUrl Permission Bypass6.5 Medium
- apache airflowApache Airflow: Assigning single DAG permission leaked all DAGs Import Errors6.5 Medium
- d-link dcs-931l, dlink dcs-931l firmware +1 moreD-Link DCS-931L setSystemAdmin doSystem command injection5.1 Medium
- douco douphpDouPHP ZIP File file.php unrestricted upload5.1 Medium
- apache shiroApache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems5.3 Medium
- clive 21 news portal projectitsourcecode News Portal Project Administrator Login index.php sql injection6.9 Medium
mcp-run-pythonPyPILack of isolation in mcp-run-python leads to MCP server takeover5.8 Mediummcp-run-pythonPyPIOverly permissive Deno configuration in mcp-run-python leads to SSRF5.8 Medium- code-projects online reviewer systemcode-projects Online Reviewer System btn_functions.php cross site scripting5.1 Medium
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does...4.3 Medium
- zirve information technologies inc. e-taxpayer accounting websiteReflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website8.6 High
- code-projects online reviewer systemcode-projects Online Reviewer System index.php sql injection6.9 Medium
- wago 0852-1322, 0852-1328 +1 moreHardcoded Key Allows Credential Disclosure9.8 Critical
- Show moreLoading…