CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- tanium cloud workloadsUse-after-free in Cloud Workloads4.7 Medium
- tanium assetASSET-77066.3 Medium
- com.ritense.valtimo web, pi-hole web interface +1 morePi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table5.4 Medium
- com.ritense.valtimo web, pi-hole web interface +1 morePi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute5.4 Medium
- opentext directory servicesContent spoofing vulnerability discovered in OpenText™ Directory Services5.3 Medium
- opentext web site management serverStored-XSS vulnerability discovered in OpenText WSM Management Server.7.5 High
- opentext web site management serverCross Site request forgery vulnerability discovered in OpenText WSM Management Server.5.9 Medium
- opentext web site management serverReflected Cross-Site Scripting discovered in OpenText WSM Management Server.7.0 High
- opentext xm faxPath Traversal vulnerability have been discovered in OpenText™ XM Fax.7.1 High
- opentext xm faxSSRF vulnerability have been discovered in OpenText™ XM Fax5.3 Medium
- sigstore cosignCosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked3.7 Low
github.com/centrifugal/centrifugoGo,github.com/centrifugal/centrifugo/v3Go,github.com/centrifugal/centrifugo/v4Go +2 more +4 moreCentrifugo v6.6.0 dependency vulnerabilitiesNo score- openclawOpenClaw File Existence tools.exec.safeBins information exposure4.8 Medium
- microsoft teamsMicrosoft Teams Information Disclosure Vulnerability8.2 High
- openclawOpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags2.0 Low
- zumba json-serializerZumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()8.1 High
github.com/dagu-org/daguGoDagu affected by unauthenticated RCE via inline DAG spec in default configuration9.8 Critical- stalw stalwartStalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages6.5 Medium
- sillytavernSillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services7.1 High
- m2team nanazipNanaZip has ROMFS Archive Infinite Loop5.1 Medium
- openclawOpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths8.7 High
- pallets flaskFlask session does not add `Vary: Cookie` header when accessed in some ways2.3 Low
- m2team nanazipNanZip has ROMFS Archive Infinite Loop / Stack Overflow5.1 Medium
- mpetroff pannellumPannellum has a XSS vulnerability in hot spot attributes5.3 Medium
- bixat rustflyRustFly 2.0.0 Command Injection via UDP Remote Control9.3 Critical
- m2team nanazipNanaZip has DotNet Single file OOB Heap Read5.2 Medium
- saad iqbal mycredWordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- designinvento directorypressWordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability5.4 Medium
- seedprod coming soon page, under construction & maintenance mode by seedprodWordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulnerability5.3 Medium
- 10web photo gallery by 10webWordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- vankarwai airtifactWordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerability7.5 High
- devsblink edublinkWordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerability5.3 Medium
- yaycommerce yaymailWordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability4.3 Medium
- pallets werkzeugWerkzeug safe_join() allows Windows special device names6.3 Medium
- feathersjs feathersFeathers exposes internal headers via unencrypted session cookie8.2 High
- feathersjs feathersFeathers has an origin validation bypass via prefix matching7.6 High
- feathersjs feathersFeathers: Open Redirect in OAuth callback enables account takeover7.4 High
- denoDeno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process8.1 High
- formwork project formworkFormwork Improperly Manages Privileges During User Creation8.8 High
- statamic cms, statamic +1 moreStatamic affected by privilege escalation via stored Cross-site Scripting8.1 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization8.7 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization8.7 High
- sveltejs devalueSvelte devalue: DoS via malformed input5.3 Medium
- man d-tale, man-group dtale +1 moreD-Tale affected by Remote Code Execution through the /save-column-filter endpoint8.1 High
- svelteSvelte SSR attribute spreading includes inherited properties from prototype chain5.3 Medium
- nolimits4web swiperSwiper has a Prototype Pollution Vulnerability9.4 Critical
- yosefhayim ebay-mcpeBay API MCP Server Affected by Environment Variable Injection8.3 High
- honoHono - Timing Attack in basicAuth and bearerAuth Middleware6.3 Medium
- openvpn ovpn-dco-winBuffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by...5.6 Medium
- openclawOpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration8.7 High
- Show moreLoading…