CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- ibm concertMultiple Vulnerabilities in IBM Concert Software.6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software.5.4 Medium
- cisco skill scanner, cisco-ai-defense skill-scanner +1 moreSkill Scanner Unsecured Network Binding Vulnerability6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software.5.9 Medium
- convoypanel panelPterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization9.2 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software.6.5 Medium
- cern indicoIndico affected by Cross-Site-Scripting via material uploads5.4 Medium
- labstack echoEcho has a Windows path traversal via backslash in middleware.Static default filesystem5.3 Medium
- cern indicoIndico has Server-Side Request Forgery (SSRF) in multiple places6.9 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software.6.1 Medium
- ibm mq operator, supplied mq advanced container images +1 moreMultiple vulnerabilities in IBM MQ Operator and Queue manager container images4.0 Medium
kubernetes-oldopenSUSESecurity update for kubernetes-oldNo scorekubernetesopenSUSESecurity update for kubernetesNo scorecontainerized-data-importerSUSESecurity update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont…No score- rackRack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href5.4 Medium
- openclawOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass7.5 High
- gogsGogs allows unauthenticated file uploads6.9 Medium
- gogsGogs has a Protected Branch Deletion Bypass in Web Interface7.1 High
- gogsGogs Authorization Bypass Allows Cross-Repository Label Modification5.3 Medium
- gogsGogs Allows Cross-Repository Comment Deletion via DeleteComment5.1 Medium
- clawdbot, openclaw +1 moreOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions3.7 Low
- tenable security center[R1] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.27.4 High
github.com/pterodactyl/wingsGo,pterodactyl/panelPackagist +1 morePterodactyl Panel's SFTP sessions remain active after user account deletion or password change7.5 High- openclawOpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust8.2 High
openclawnpmOpenClaw affected by SSRF in Image Tool Remote Fetch7.6 High- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 XML External Entity Reference7.1 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Information Disclosure5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Denial of Service6.5 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Denial of Service6.5 Medium
- openclawOpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl6.3 Medium
- openclawOpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes9.2 Critical
- openclawOpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint7.4 High
- openclawOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement9.2 Critical
- openclawOpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path7.1 High
openclawnpmOpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing7.1 High- weblateWeblate has an argument injection in management console6.6 Medium
- openclawOpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake9.2 Critical
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 SSH Service risky encryption6.3 Medium
- glory global solutions rbg-100Glory RBG-100 Recycler System Local Privilege Escalation via Insecure File Permissions8.5 High
- glory global solutions rbg-100Glory RBG-100 Recycler System Hard-coded OS Credentials9.3 Critical
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack has a Directory Traversal via Rack:Directory7.5 High
- bsv-blockchain ts-sdkBSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability5.4 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource5.3 Medium
- smartypants sp project & document managerWordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerability6.5 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 Web Management hard-coded credentials8.7 High
- openstack nova, red hat openstack platform 13 (queens), openstack platform 16.2 +4 more +6 moreOpenStack Nova calls qemu-img without format restrictions for resize8.2 High
- paul custom content by country (by shield security)WordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerability6.5 Medium
- opens100 project opens100OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access9.4 Critical
- dell unisphere for powermax vapp,Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of...5.4 Medium
- ocaml, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreIn OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization ...7.9 High
- Show moreLoading…