CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- openclawOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool6.9 Medium
- vapor leaf-kit, leafkit +1 moreLeaf-kit html escaping does not work on characters that are part of extended grapheme cluster6.1 Medium
- ciliumCilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled6.1 Medium
- pjsip pjmedia-video, pjsip +1 morePJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL5.1 Medium
- kaleidos penpotPenpot has Arbitrary File Read via create-font-variant RPC endpoint7.5 High
- hdfgroup hdf5, red hat enterprise linux ai (rhel ai) 3 +1 moreHDF5 Affected by H5T__conv_struct_opt Heap Buffer Overflow7.8 High
- openwebui open webui, open-webui +1 moreOpen WebUI vulnerable to Stored XSS via iFrame embeds in response messages7.3 High
- openwebui open webui, open-webui +1 moreOpen WebUI vulnerable to Stored XSS via iFrame in citations model7.3 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php2.1 Low
- spipSPIP < 4.4.9 Insecure Deserialization9.2 Critical
- spipSPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)4.8 Medium
- spipSPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites5.1 Medium
- spipSPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites5.3 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration5.3 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration5.3 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework IP Exceptions Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam IP DNS Blocklist Domain Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam IP Blocklist Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 POP2Exchange POP3 Server Login Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 General Settings Perimeter SMTP Servers Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Email Management Mail Monitoring Rule Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Anti-Spam Whitelist Description Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSS5.1 Medium
- delinea cloud suiteImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...9.3 Critical
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Attachment Filtering Rule Stored XSS5.1 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 Keyword Filtering Rule Stored XSS5.1 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing5.1 Medium
- vmware spring data geode, spring data gemfire +1 moreSpring Data Geode Insecure Temporary Directory Usage4.8 Medium
- hyland alfresco community (transform core), alfresco transformation service (enterprise), alfresco transform core +1 more +3 moreHyland Alfresco Transformation Service Argument Injection RCE9.3 Critical
- hyland alfresco community (transform core), alfresco transformation service (enterprise), alfresco transform core +1 more +3 moreHyland Alfresco Transformation Service SSRF6.9 Medium
- hyland alfresco community (transform core), alfresco transformation service (enterprise), alfresco transform core +1 more +3 moreHyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF8.8 High
- wcproducttable product table and list builder for woocommerce liteProduct Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter7.5 High
- tomdever wpforo forumwpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection7.5 High
- microsoft semantic kernel, semantic-kernel +1 moreMicrosoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution10.0 Critical
- hyland alfresco community, alfresco enterprise, alfresco content services +2 moreHyland Alfresco Improper Authorization Arbitrary File Read8.7 High
- strongswan strongmanstrongMan vulnerable to private credential recovery due to key and counter reuse8.7 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)8.1 High
- spipSPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area5.1 Medium
- katacontainers kata containers, kata-containers, red hat confidential compute attestation +1 more +3 moreKata Container to Guest micro VM privilege escalation9.4 Critical
- spipSPIP < 4.4.8 Cross-Site Scripting in Public Area8.6 High
- appsheet web (main server)Arbitrary File Read and SSRF in Google AppSheet8.5 High
- svelteSvelte SSR does not validate dynamic element tag names in `<svelte:element>`5.1 Medium
- svelteSvelte affected by cross-site scripting via spread attributes in Svelte SSR5.1 Medium
- svelteSvelte affected by XSS in SSR `<option>` element5.1 Medium
- Show moreLoading…