CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings4.4 Medium
- tickera – sell tickets & manage eventsTickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update4.3 Medium
- wpcalc popup box – easily create wordpress popupsPopup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpovernight pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification4.3 Medium
- jamesits keybase.io verificationKeybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters6.5 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title6.4 Medium
- brikou wp plugin info cardWP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation4.3 Medium
- strategy11team business directory plugin – easy listing directories for wordpressBusiness Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter7.5 High
- roxnor emailkit – email customizer for woocommerce & wpEmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification4.3 Medium
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action8.6 High
- kaizencoders url shortify – simple and easy url shortenerURL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter4.7 Medium
- gserafini display during conditional shortcodeDisplay During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter6.4 Medium
- hwk-fr wp 404 auto redirect to similar postWP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- jonschr rent fetchRent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter7.2 High
- wpshuffle frontend post submission manager lite – frontend posting wordpress pluginFrontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter6.1 Medium
- fahad mahmood order splitter for woocommerceOrder Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure4.3 Medium
- shanaver filestackFilestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- absikandar frontend user notesFrontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification4.3 Medium
- postmagthemes context blogContext Blog <= 1.2.5 - Unauthenticated Private Post Disclosure5.3 Medium
- ruby zlibzlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because...2.9 Low
- openclawOpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling8.6 High
- openclawOpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters8.4 High
- isaacs node-tar, tar +1 morenode-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction7.1 High
openclawnpmOpenClaw inter-session prompts could be treated as direct user instructions7.1 High- openclawOpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling7.7 High
- openclawOpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authentication6.3 Medium
- openclawOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility6.3 Medium
- openclawOpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization6.9 Medium
- openclawOpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity8.2 High
- openclaw, clawdbot +1 moreOpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints7.1 High
- openclawOpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering8.7 High
- openclawOpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive6.7 Medium
- openclawOpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding6.8 Medium
- openclawOpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch8.7 High
- openclawOpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages8.2 High
- openclawOpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist8.6 High
- openclawOpenClaw has a command injection in maintainer clawtributors updater8.6 High
- openclawOpenClaw has a path traversal in browser upload allows local file read7.1 High
- openclaw, clawdbot +1 moreOpenClaw iMessage group allowlist authorization inherited DM pairing-store identities6.5 Medium
- openclawOpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning7.1 High
gpsdOSS-FuzzUse-of-uninitialized-value in tsip_parse_inputNo score- gnome evolution data server, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreEvolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling5.6 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +2 moresmb: client: split cached_fid bitfields to avoid shared-byte RMW races8.8 High
- linux, linux kernel, siemens ruggedcom rst2428p +2 morecrypto: virtio - Add spinlock protection with virtqueue notification5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +2 moresmb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()5.5 Medium
- linux, linux kernel +1 moreerofs: fix UAF issue for file-backed mounts w/ directio option7.8 High
- linux, linux kernel +1 morexfs: fix UAF in xchk_btree_check_block_owner7.8 High
- linux, linux kernel, siemens ruggedcom rst2428p +2 morecrypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly7.8 High
- linux, linux kernel, siemens ruggedcom rst2428p +2 moreksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths5.5 Medium
- Show moreLoading…