CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- mjdm majordomoMajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval9.3 Critical
- advantech wise-6610-cb, wise-6610-eb, wise-6610-el-cb +10 more +12 moreAdvantech WISE-6610-NB Background Management openvpn_apply os command injection8.6 High
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform User delete access control6.9 Medium
- invoiceplaneInvoicePlane has a Stored Cross-Site Scripting (XSS) issue5.7 Medium
- invoiceplaneInvoicePlane has a Stored Cross-Site Scripting (XSS) issue5.7 Medium
- saturnremote saturn remote mouse serverSaturn Remote Mouse Server UDP Command Injection RCE8.6 High
- ipfireIPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi4.8 Medium
- ipfireIPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi5.1 Medium
- ipfireIPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi5.1 Medium
- ipfireIPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi5.1 Medium
- ipfireIPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi5.1 Medium
- invoiceplaneInvoicePlane has a Stored Cross-Site Scripting (XSS) issue5.7 Medium
- github enterprise serverIncorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests7.1 High
- github enterprise serverMissing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports6.0 Medium
- github enterprise serverImproper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution7.6 High
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform User add access control6.9 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform api access control6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGlibc: vdso getrandom acceleration may return predictable randomness4.8 Medium
- https://github.com/rgaufman/live555 rgaufman/live555Remote code execution via segmentation fault in increasebufferto function6.3 Medium
- mingsoft mcmsmingSoft MCMS Template Archive uploadTemplate.do unrestricted upload5.1 Medium
- huanzi-qch base-adminhuanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload5.3 Medium
- invoiceplaneInvoicePlane has Unauthenticated Path Traversal in Guest Controller9.3 Critical
- autodesk shared componentsMODEL File Parsing Out-of-Bounds Write7.8 High
- autodesk shared componentsCATPART File Parsing Out-of-Bounds Write7.8 High
- alixhan xh-admin-backendAlixhan xh-admin-backend Database Query query sql injection5.3 Medium
- fascinatedbox lilyFascinatedBox lily lily_emitter.c count_transforms out-of-bounds4.8 Medium
- squirrel-lang squirrelSquirrel sqobject.h operator heap-based overflow4.8 Medium
- fascinatedbox lilyFascinatedBox lily lily_symtab.c shorthash_for_name use after free4.8 Medium
- mmaitre314 picklescanpicklescan - Scanning Bypass via Dynamic Eval in scan_pytorch7.1 High
- openclawOpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server8.5 High
- nltk, nltk nltk/nltk, red hat openshift lightspeed +2 more +4 moreZip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution10.0 Critical
- openclawOpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching6.3 Medium
- openclawOpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling8.2 High
- openclawOpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup4.3 Medium
- openclawOpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow5.9 Medium
- openclawOpenClaw: Prevent shell injection in macOS keychain credential write7.6 High
- openclawOpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths8.7 High
- openclawOpenClaw has a Path Traversal in Browser Download Functionality6.7 Medium
- squirrel-lang squirrelSquirrel sqfuncstate.cpp PopTarget out-of-bounds4.8 Medium
- newbee-ltd newbee-mallnewbee-ltd newbee-mall Multiple Endpoints cross-site request forgery5.3 Medium
- splunk, splunk enterprise +1 moreSensitive Information Disclosure in "_internal" index in Splunk Enterprise6.8 Medium
- splunk, splunk enterprise +1 moreSensitive Information Disclosure in "_internal" index in Splunk Enterprise6.8 Medium
- splunk, splunk cloud platform, enterprise +2 moreClient-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreSensitive Information Disclosure in ''_internal'' index in Splunk Enterprise6.8 Medium
- splunk, splunk enterprise +1 moreImproper Access Control in Splunk Monitoring Console App4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreRisky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise3.5 Low
- wrenwren-lang wren Error Message wren_compiler.c printError stack-based overflow4.8 Medium
- wpdevelop booking calendarBooking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification4.3 Medium
- f5 big-ipBIG-IP TMM Vulnerability8.7 High
- open-policy-agent opa-envoy-pluginopa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`7.1 High
- Show moreLoading…