CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- kamleshyadav videospirecore theme pluginVideospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover8.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +14 more +16 moreGIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- wpzoom addons for elementor – starter templates & widgetsWPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more5.3 Medium
- microcom zeuswebLEAK OF SENSITIVE INFORMATION ON MICROCOM'S ZEUSWEB6.9 Medium
- microcom zeuswebREFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB5.1 Medium
- microcom zeuswebREFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB5.1 Medium
- microcom zeuswebSTORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB4.8 Medium
- vadi corporate information systems ltd. co. digikentImproper Access Control in Vadi Corporate Information System's DIGIKENT8.2 High
python-brotlipyopenSUSESecurity update for python-brotlipyNo score- luke-alford ide micro code-editorIDE Micro code-editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- sm rasmy wamate confirm – order confirmationWaMate Confirm <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking5.3 Medium
- pankajanupam category imageCategory Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter4.4 Medium
- openpos lite – point of sale for woocommerceOpenPOS Lite <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- badbreze twitter posts to blogTwitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update6.5 Medium
- nko custom block builder – lazy blocksCustom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution8.8 High
- jhoylman html shortcodesHTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- kirilkirkov invoct – pdf invoices & billing for woocommerceInvoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure4.3 Medium
- wecodify wplyr media blockWPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter4.4 Medium
- digiblogger buddyholis listsearchBuddyHolis ListSearch <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute6.4 Medium
- messagemetric mma call trackingMMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- aumsrini slideshow wpSlideshow Wp <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute6.4 Medium
- microtangoMicrotango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- master-buldog wdes responsive popupWDES Responsive Popup <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute6.4 Medium
- ione360 configuratoriONE360 configurator <= 2.0.57 - Unauthenticated Stored Cross-Site Scripting via Contact Form Parameters7.2 High
- saastech cleaning and internet services inc. temizlikyoldaXSS in saastech.io's TemizlikYolda8.3 High
- saastech cleaning and internet services inc. temizlikyoldaIDOR in saastech.io's TemizlikYolda5.4 Medium
- unknown wp ecommerceWP eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection6.5 Medium
- unknown openpix for woocommerceOpenPix < 2.13.6 - Subscriber+ Payment Gateway Settings Reset6.5 Medium
- wpvividplugins wpvivid — backup, migration & stagingMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload9.8 Critical
- lordspace orbisius random name generatorOrbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute6.4 Medium
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)...4.7 Medium
- beaverbuilder beaver builder page builder – drag and drop website builderBeaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings6.4 Medium
- villatheme lucky wheel giveawayLucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter7.2 High
- veronalabs slimstat analyticsSlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter6.5 Medium
- fooplugins gallery by foogalleryGallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure4.3 Medium
- tp-link systems inc. archer c60 v3, tp-link archer c60 firmware +1 moreReflected XSS Vulnerability on TP-Link Archer C605.3 Medium
assimpOSS-FuzzSegv on unknown address in aiAnimation::~aiAnimationNo scoregpsdOSS-FuzzUNKNOWN WRITE in decode_xa2_00No score- mealieA stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving...6.1 Medium
- mealieA stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1...5.4 Medium
- opensatkitAn issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes...9.8 Critical
- opensatkitDirectory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to...7.5 High
- opensatkitAn issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by...7.8 High
- sunbird sunbirded-portalAn issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information....7.5 High
- unjs nanotarnanotar is vulnerable to path traversal in parseTar() and parseTarGzip()9.8 Critical
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` option2.9 Low
- red hat ai inference server, enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 more +4 moreDiskCache has unsafe pickle deserialization9.8 Critical
medusaUbuntuA race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage...8.1 High- No product listedWeak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to...9.8 Critical
- Show moreLoading…