CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- nestersoft worktime, nestersoft inc. worktime (on-prem/cloud) +1 moreUnauthenticated OS Command Injection in NesterSoft WorkTime9.8 Critical
- wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 moreAuthenticated arbitrary file upload via a System REST API requiring administrator permission.9.1 Critical
- wso2 identity serverServer-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution8.4 High
- dealia – request a quoteDealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes6.4 Medium
- sonaar mp3 audio player – music player, podcast player & radio by sonaarMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure5.3 Medium
- amu02aftab client testimonial sliderClient Testimonial Slider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting4.4 Medium
- wpinsider-1 simple membershipSimple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values6.5 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege...8.1 High
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege...6.3 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of...4.7 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of...4.7 Medium
- significant-gravitas autogptAuthentication bypass in AutoGPT de Thesamur6.9 Medium
- dell powermax, unisphere for powermax +1 moreDell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A...8.8 High
- lewe webmeasureReflected Cross-Site Scripting (XSS) in Lewe WebMeasure5.1 Medium
- dell powermax, unisphere for powermax +1 moreDell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path...8.1 High
- alkacon opencmsReflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms5.1 Medium
- alkacon opencmsStored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms5.1 Medium
- dell powermax, unisphere for powermax +1 moreDell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path...8.8 High
- godaddy coblocksWordPress CoBlocks plugin <= 3.1.16 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- greg winiarski wpadvertsWordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability6.5 Medium
- wp moose kenta companionWordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- aakash chakravarthy shortcoderWordPress Shortcoder plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pencidesign soledadWordPress Soledad theme <= 8.7.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pencidesign penci recipeWordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pencidesign penci podcastWordPress Penci Podcast plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pencidesign penci filter everythingWordPress Penci Filter Everything plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pencidesign penci ai smartcontent creatorWordPress Penci AI SmartContent Creator plugin <= 2.0 - Broken Access Control vulnerability4.3 Medium
- villatheme sales countdown timer for woocommerce and wordpressWordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability7.5 High
- thimpress realpressWordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wpdeveloper notificationxWordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability5.3 Medium
- aa-team wzoneWordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability5.4 Medium
- themefusion fusion builderWordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpestate wpresidence coreWordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- uixthemes soberWordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability4.3 Medium
- mdempfle advanced iframeWordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- boldthemes bold page builderWordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- unknown leadconnectorWordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerability5.3 Medium
- omnipressteam omnipressWordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- totalsoft ts pollWordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- creativeinteractivemedia real 3d flipbookWordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability3.8 Low
- themes4wp popularis extraWordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- mailerliteWordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability4.3 Medium
- flycart upsellwpWordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability4.3 Medium
- bit apps form, unknown bit form +1 moreWordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability7.6 High
- blazethemes news kit elementor addonsWordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability4.3 Medium
- iqonicdesign wpbookit proWordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability5.3 Medium
- themastercut revision manager tmcWordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- tim stephenson wp-corsWordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability4.3 Medium
- crgeary jamstack deploymentsWordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability4.3 Medium
- apos37 broken link notifierWordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…