CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- tubitak bilgem software technologies research institute liderahenkImproper Access Control in TUBITAK BILGEM's Liderahenk6.1 Medium
- apache arrowApache Arrow: Potential use-after-free when reading IPC file with pre-buffering7.0 High
- wavlink wl-nu516u1, wl-nu516u1 firmware +1 moreWavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection8.6 High
- eka software computer information advertising services ltd. real estate script v5 (with doping module – store module – new language system)XSS in EKA Software's Real Estate Script V5 (With Doping Module – Store Module – New Language System)6.5 Medium
- tumeva internet technologies software information advertising and consulting services trade ltd. co. prime news softwareTime-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News Software8.6 High
- clickedu saas platformSQL Injection in Clickedu's SaaS platform8.3 High
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization4.3 Medium
kernel-firmwareSUSESecurity update for kernel-firmwareNo score- apache nifiApache NiFi: Missing Authorization of Restricted Permissions for Component Updates8.7 High
- rebelcode rss aggregator – rss import, news feeds, feed to post, and autobloggingRSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter7.2 High
kernel-firmwareSUSESecurity update for kernel-firmwareNo score- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending5.8 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint5.3 Medium
- zarinpal gatewayZarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update7.7 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- modeltc lightllmLightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE9.3 Critical
gpsdOSS-FuzzUNKNOWN WRITE in nmeaid_to_prnNo score- totolink a3002ru firmwareTOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow...8.8 High
- totolink a3002ru firmwareTOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow...8.8 High
- totolink a3002ru firmwareTOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow...8.8 High
- No product listedlty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page...7.1 High
- No product listedA Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart...9.9 Critical
- running-elephant datartAn information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to...5.7 Medium
- running-elephant datartAn issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter...8.8 High
- jizhicmsjizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the...7.2 High
- No product listedMalwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file...8.7 High
- joraniA SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an...7.6 High
- No product listedAn issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers...7.5 High
- rocketsoftware trufusion enterpriseRocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services...9.4 Critical
- rocketsoftware trufusion enterpriseRocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections....7.9 High
- phpgurukul gym management systemA Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym...3.5 Low
- phpgurukul student management systemphpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search...8.8 High
- flippercode wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filtersWP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion8.8 High
- bva concierge::sessions, concierge\ +1 moreConcierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids9.8 Critical
- teejay maypoleMaypole versions from 2.10 through 2.13 for Perl generates session ids insecurely9.8 Critical
- ddick crypt::urandom, crypt\ +1 moreCrypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()7.5 High
- wpxpo wowrevenue – product bundles & bulk discountsWowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation8.8 High
- wavlink wl-nu516u1, wl-nu516u1 firmware +1 moreWavlink WL-NU516U1 nas.cgi sub_401218 stack-based overflow8.6 High
- smoothwall expressSmoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting5.3 Medium
- smoothwall expressSmoothwall Express 3.1 'modem.cgi' Cross-Site Scripting5.3 Medium
- smoothwall expressSmoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'interfaces.cgi' Cross-Site Scripting4.8 Medium
- smoothwall expressSmoothwall Express 3.1 'timedaccess.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'ipblock.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'xtaccess.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'dmzholes.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'outgoing.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'portfw.cgi' Cross-Site Scripting5.1 Medium
- smoothwall expressSmoothwall Express 3.1 'apcupsd.cgi' Cross-Site Scripting5.1 Medium
- Show moreLoading…