CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- graylog, graylog web interface +1 moreIncorrect management of session invalidation vulnerability in Graylog Web Interface9.3 Critical
- soflyy wp all export – drag & drop export to any custom csv, xml & excelWP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling3.7 Low
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name6.5 Medium
- posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerceThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'p…4.3 Medium
- bookster – wordpress appointment booking pluginBookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'4.9 Medium
- doruk communication and automation industry and trade inc. wispotterOTP Password Brute Forcing in DorukNet's Wispotter5.3 Medium
pyo3crates.ioPyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature7.2 Highlinux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +18 more +20 moreUpdate of linux-firmwareNo scorelinux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +18 more +20 moreUpdate of linux-firmwareNo scorelinux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +18 more +20 moreUpdate of linux-firmwareNo score- neeraj slit brevo – email, sms, web push, chat, and more.Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling6.5 Medium
ca-certificatesTuxCareUpdate of ca-certificatesNo scoreca-certificatesTuxCareUpdate of ca-certificatesNo scoreca-certificatesTuxCareUpdate of ca-certificatesNo score- admesh project admeshadmesh normals.c stl_check_normal_vector heap-based overflow4.8 Medium
ca-certificatesTuxCareUpdate of ca-certificatesNo scoreca-certificatesTuxCareUpdate of ca-certificatesNo scoreca-certificatesTuxCareUpdate of ca-certificatesNo scorearpopamARP unbounded memory usage7.4 High- gamerz wp-downloadmanagerWP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter6.5 Medium
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification6.5 Medium
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment5.3 Medium
- complianz – gdpr/ccpa cookie consentComplianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter5.3 Medium
- videowhisper video share vod – turnkey video site builder scriptVideo Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values4.4 Medium
- strategy11team business directory plugin – easy listing directories for wordpressBusiness Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification5.3 Medium
- gpriday siteorigin widgets bundleSiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4 Medium
- jackdewey community eventsCommunity Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter4.4 Medium
- qdonow wpnakama – team and multi-client collaboration, editorial and project managementWPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter7.5 High
- xylus wp event aggregator: import eventbrite events, meetup events, social events and any ical events into event calendarWP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- webguyio dam spamDam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion4.3 Medium
- wpchill kali forms — contact form & drag-and-drop builderKali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure4.3 Medium
- yaycommerce yaymail – woocommerce email customizerYayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation2.7 Low
- yaycommerce yaymail – woocommerce email customizerYayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements4.4 Medium
- yaycommerce yaymail – woocommerce email customizerYayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint5.3 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter4.3 Medium
- gamerz wp-downloadmanagerWP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter2.7 Low
- minisatniklasso minisat DIMACS File SolverTypes.h value out-of-bounds4.8 Medium
- acowebs product addons for woocommerce – product options with custom fieldsProduct Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter7.2 High
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload4.3 Medium
- edersonpeka private commentPrivate Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting4.4 Medium
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation4.3 Medium
- yaycommerce yaymail – woocommerce email customizerYayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action7.2 High
- interactivecalculator for wordpressInteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter4.3 Medium
- codename065 download managerDownload Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter6.1 Medium
- villatheme cart all in one for woocommerceCart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting7.2 High
- ggreer the silver searcherggreer the_silver_searcher search.c search_stream null pointer dereference4.8 Medium
- deepen bajracharya video conferencing with zoomVideo Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation7.5 High
- universal-ctags ctagsuniversal-ctags V Language v.c parseExprList recursion4.8 Medium
- Show moreLoading…