CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- nsasoft spotauditor, nsauditor spotauditor +1 moreSpotAuditor 5.3.1.0 Denial of Service via Registration Name Field6.7 Medium
- part-dbPart-DB 0.4 Authentication Bypass via login.php8.8 High
- delpino73 blue-smiley-organizerdelpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetime8.8 High
- chamilo chamillo lmsChamilo LMS 1.11.8 Arbitrary File Upload via elfinder8.7 High
- linuxfoundation strimzi, strimzi strimzi-kafka-operator +1 moreStrimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters5.9 Medium
- mlflow, red hat openshift ai (rhoai) +1 moreMLflow Use of Default Password Authentication Bypass Vulnerability9.8 Critical
- rustdesk client for windowsRustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability5.5 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +14 more +16 moreGIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreGIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +14 more +16 moreGIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +14 more +16 moreGIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability7.8 High
- tensorflow, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreTensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.0 High
- nagios host, xi +1 moreNagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability7.2 High
- nagios host, xi +1 moreNagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability7.2 High
- nagios host, xi +1 moreNagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability7.2 High
- pdf-xchange editorPDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.3 High
- gfi archiverGFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability7.3 High
- gfi archiverGFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- gfi archiverGFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability7.3 High
- gfi archiverGFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- deciso opnsenseDeciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability6.8 Medium
- sante dicom viewer proSante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability7.8 High
- mlflow, red hat openshift ai (rhoai) +1 moreMLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability8.1 High
- xmindXmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability7.8 High
- openclawOpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs4.8 Medium
- liquidpromptLiquid Prompt arbitrary command injection via crafted Git branch names in gitstatusd backend6.3 Medium
- wrenwren-lang wren Source File wren_compiler.c peekChar out-of-bounds4.8 Medium
- anyscale rayRay: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)5.9 Medium
- wwbn avideoAVideo has Stored Cross-Site Scripting via Markdown Comment Injection5.1 Medium
- lettermint, lettermint lettermint-node +1 moreLettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused4.7 Medium
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik affected by TLS ClientAuth Bypass on HTTP/37.8 High- openclawOpenClaw hardened cron webhook delivery against SSRF6.9 Medium
- openclawOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection4.6 Medium
- lukas12000 photoboothPhotobooth has a XSS vulnerability in user input5.3 Medium
- openclawOpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows2.3 Low
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 Port Forwarding Configuration Endpoint formPortFw sub_423E00 stack-based overflow8.7 High
- it-novum openitcockpitopenITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling7.5 High
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 Filter Configuration Endpoint formFilter sub_424AFC stack-based overflow8.7 High
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 DDNS Settings formDdns sub_4648F0 stack-based overflow8.7 High
- hclsoftware digital experienceHCL Digital Experience is susceptible to stored cross-site scripting (XSS)6.1 Medium
- google cloud vertex ai experimentsBucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.7.7 High
- google cloud vertex ai sdk for python, red hat openshift ai 2.25 +1 moreStored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization8.6 High
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 NTP Configuration Endpoint formNtp sub_4611CC stack-based overflow8.7 High
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 System Log Configuration Endpoint formSysLog sub_462E14 stack-based overflow8.7 High
- yeqifu warehouseyeqifu warehouse Sales Endpoint SalesController.java deleteSales access control5.3 Medium
- static-web-server static web server, static-web-server +1 moreStatic Web Server: Timing-Based Username Enumeration in Basic Authentication5.3 Medium
ficklingPyPIFickling has a detection bypass via stdlib network-protocol constructors2.3 Low- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names9.3 Critical
- phpscriptsmall fiverr clone scriptFiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.php5.1 Medium
- phpscriptsmall fiverr clone scriptFiverr Clone Script 1.2.2 SQL Injection via page Parameter8.8 High
- Show moreLoading…