CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- wclovers wcfm – frontend manager for woocommerceWCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update7.2 High
- tanium end-user-cxTanium addressed an arbitrary file deletion vulnerability in end-user-cx.5.5 Medium
- tanium eussTanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.5.5 Medium
- tanium patch endpoint tools, endpoint configuration toolset solution +1 moreTanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.7.8 High
- tanium end-user notifications endpoint tools, end-user notifications +1 moreTanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.5.1 Medium
- tanium patch endpoint toolsTanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.7.8 High
- cube-js cube, cube cube.js +1 moreCube privilege escalation via a specially crafted request7.7 High
- cube-js cube, cube cube.js +1 moreCube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request6.5 Medium
- frangoteam fuxaFUXA has a Path Traversal Sanitization Bypass8.6 High
- frangoteam fuxaFUXA Unauthenticated Remote Arbitrary Scheduler Write9.3 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution in Node-RED Integration9.5 Critical
- go-gitgo-git improperly verifies data integrity values for .idx and .pack files4.3 Medium
- streetsidesoftware vscode-spell-checkervscode-spell-checker has a workspace-trust bypass Code Execution7.8 High
- modery powerdocuPowerDocu Affected by Remote Code Execution via Insecure Deserialization7.8 High
- mylittleforum my little forum, my-little-forum mylittleforum +1 morePhar Deserialization leading to Arbitrary File Deletion in my little forum8.7 High
- fedify holloHollo DMs get leaked and can be seen on Webfinger Browser7.5 High
- tanium server, module server +1 moreTanium addressed a local privilege escalation vulnerability in Tanium Server.6.7 Medium
- tanium module server, server +1 moreTanium addressed a local privilege escalation vulnerability in Tanium Module Server.6.7 Medium
- taklaxbr zai-shell, zai shell +1 moreUnauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell8.8 High
- tanium serverTanium addressed an uncontrolled resource consumption vulnerability in Tanium Server.6.5 Medium
- sumatrapdfreader sumatrapdfSumatraPDF Update MITM -> Arbitrary Code Execution7.5 High
- sumatrapdfreader sumatrapdfSumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor5.5 Medium
- rageagainstthepixel unity-cliunity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)5.9 Medium
- adminerAdminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint7.5 High
- filebrowserFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL8.1 High
- filebrowserFile Browser has an Authentication Bypass in User Password Update5.4 Medium
- polarlearnPolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats10.0 Critical
- nyariv sandboxjs@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)9.1 Critical
- sumatrapdfreader sumatrapdfUntrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)7.8 High
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Admin Privilege Escalation via Trusted JWT Claims9.3 Critical
- prasklatechnology placipy, praskla-technology assessment-placipy +1 moreNoSQL Injection Risk via Unsanitized Query Parameters9.3 Critical
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Exposes Sensitive Data via Application Logs8.7 High
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy is Missing CSRF Protection on State-Changing Endpoints9.3 Critical
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)5.3 Medium
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Code Execution Allowed Without Assessment Active State Validation5.3 Medium
- friendsofshopware froshadminer, froshplatformadminer +1 moreFroshAdminer Adminer UI is accessible without admin session6.9 Medium
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)5.3 Medium
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy is Missing Object-Level Authorization in student.submission.routes.ts5.3 Medium
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy is Missing Authorization on Assessment Results Endpoint5.3 Medium
- faraday project faradayFaraday affected by SSRF via protocol-relative URL host override in build_exclusive_url5.8 Medium
- nixos nixpkgsPrivilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module5.8 Medium
- langchain-ai langsmith-sdkLangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection5.8 Medium
- craftcms cms, craft cms +1 moreCraft has a potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- craftcms cms, craft cms +1 moreCraft has a GraphQL Asset Mutation Privilege Escalation8.6 High
- craftcms cms, craft cms +1 moreCraft has a stored XSS in Number Prefix & Suffix Fields4.8 Medium
- craftcms cms, craft cms +1 moreCraft has a SQL Injection in Element Indexes via criteria[orderBy]8.7 High
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via HTTP Redirect6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host5.3 Medium
- aprilrobotics apriltagAprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption4.8 Medium
- Show moreLoading…