CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- indextwo stylebidetStyleBidet <= 1.0.0 - Reflected Cross-Site Scripting6.1 Medium
- bssoftware appointment booking calendar plugin – bookrAppointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification5.3 Medium
directorytree/imapenginePackagistImapEngine affected by command injection via the ID command parameters7.2 High- bluesnap payment gateway for woocommerceBlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation7.5 High
- sourcez seatt: simple event attendanceSEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion4.3 Medium
- ulaulaman citations toolsCitations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute6.4 Medium
- phoenixstudiodz easy voice mailEasy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'6.1 Medium
- nayon46 simple wp colorfull accordionSimple Wp colorfull Accordion <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- alexeyknyazev personal-authors-categorypersonal-authors-category <= 0.3 - Reflected Cross-Site Scripting6.1 Medium
- katsushi-kawamori magic login mail or qr codeMagic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage8.1 High
- ampenhancer amp enhancer – compatibility layer for official amp pluginAMP Enhancer <= 1.0.49 - Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting4.4 Medium
- infosatech wp last modified infoWP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification5.3 Medium
- hassantafreshi easy form builder by whitestudio — drag & drop form builderEasy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure5.3 Medium
- kasuga16 stickeasy protected contact formStickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure5.3 Medium
- thebaldfatguy bfg tools – extension zipperBFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter4.9 Medium
gpsdOSS-FuzzUse-of-uninitialized-value in ntrip_parse_urlNo scoregpsdOSS-FuzzUse-of-uninitialized-value in packet_get1No score- caidoCaido has an insufficient patch for DNS rebind leading to RCE8.1 High
- idno knownKnown affected by Account Takeover via Password Reset Token Leakage9.8 Critical
- pixelyoursite – your smart pixel (tag) & api managerPixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- pixelyoursite pro – your smart pixel (tag) managerPixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- starfishwp starfish review generation & marketing for wordpressStarfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults8.8 High
agentsnpmCloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site6.2 Mediumpgpcrates.iorPGP's integrity protection of encrypted data was not always checked6.3 Mediumpgpcrates.iorPGP affected by crash in message handling for deeply nested messages8.7 Highpgpcrates.iorPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-218958.7 High- mend renovate-ce, renovate-ee-server, renovate-ee-worker +1 more +3 moreRenovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure6.8 Medium
- calero verasmartCalero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials8.5 High
- calero verasmartCalero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE10.0 Critical
- calero verasmartCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE9.3 Critical
nssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +2 more +4 moreUpdate of nssNo score- vimVim has a Netbeans specialKeys Stack Buffer Overflow5.4 Medium
nssTuxCare,nsprTuxCare,nspr-develTuxCare +10 more +12 moreUpdate of nssNo scorenssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +2 more +4 moreUpdate of nssNo scorenssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +2 more +4 moreUpdate of nssNo score- alex4ssb adb-explorerADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization7.8 High
- tandoor recipesTandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import7.7 High
- google chrome, chromium +1 moreUse after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to...8.8 High
- tandoor recipesTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read4.9 Medium
- bacnetstack bacnet stack, bacnet-stack +1 moreBACnet Stack WriteProperty decoding length underflow leads to OOB read and crash7.8 High
- bacnetstack bacnet stack, bacnet-stack +1 moreBACnet Stack Improperly Limits Pathnames to a Restricted Directory7.5 High
libnss3TuxCare,libnss3-1dTuxCare,libnss3-devTuxCare +2 more +4 moreUpdate of nssNo score- bacnet-stack, bacnetstack bacnet stack +1 moreThe BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string5.5 Medium
nssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +8 more +10 moreUpdate of nssNo score- anysphere cursorCursor sandbox escape via Git hooks8.1 High
- genetec inc. sipeliaLocal privilege escalation in Genetec Sipelia Plugin. An authenticated low-privileged Windows...5.8 Medium
- lukilabs beautiful-mermaidbeautiful-mermaid < 0.1.3 SVG Attribute Injection5.3 Medium
sqlparsePyPIsqlparse: formatting list of tuples leads to denial of service6.9 Medium- lakefslakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access8.1 High
- tenable agent, nessus agent +1 moreImproper Access Control Allows Denial of Service5.4 Medium
- Show moreLoading…