CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- tenda a21, a21 firmware +1 moreTenda A21 MAC Filtering Configuration Endpoint setBlackRule set_device_name stack-based overflow8.7 High
- tenda a21, a21 firmware +1 moreTenda A21 SetIpMacBind fromSetIpMacBind stack-based overflow8.7 High
- tenda a21, a21 firmware +1 moreTenda A21 formSetQosBand set_qosMib_list stack-based overflow8.7 High
- janet-lang janetjanet-lang janet handleattr specials.c janetc_varset out-of-bounds4.8 Medium
- admerc vehicle management systemitsourcecode Vehicle Management System billaction.php sql injection6.9 Medium
- thimpress learnpress – backup & migration toolLearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion4.8 Medium
- karnop realtime-collaboration-platformCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure7.4 High
- hackerbay oneuptimeOneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE10.0 Critical
- wedevs wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerceweMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion6.5 Medium
- ellite wallosWallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch7.7 High
- zoneminderZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields8.8 High
- metabaseMetabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE7.7 High
- adonesevangelista agri-trading online shopping systemitsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection6.9 Medium
- feng ha ha ssm-erp, production ssm +1 morefeng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal5.3 Medium
- isso-comments issoIsso: Stored XSS via comment website field6.1 Medium
- bigbluebuttonBigBlueButton: Audio from participants to the server initially unmuted2.0 Low
- bigbluebuttonBigBlueButton: Exposed ClamAV port enables Denial of Service7.2 High
- kovah linkaceLinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description8.7 High
- jonathanwilbur asn1-tsASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer9.2 Critical
- frappe erpnextERP: Document access through endpoints due to missing validation9.3 Critical
- feng ha ha ssm-erp, production ssm +1 morefeng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversal5.3 Medium
- foswikiFoswiki Changes/Viewfile/Oops information disclosure6.9 Medium
- moodleMoodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service6.5 Medium
- moodleMoodle: moodle: improper input sanitization in tex filter administration setting7.2 High
- moodleMoodle: moodle: improper validation in file restore functionality leading to remote code execution7.2 High
- cloudhypervisor cloud hypervisor, cloud-hypervisor +1 moreCloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse9.1 Critical
- getsentry sentrySentry: Improper Authentication on SAML SSO process allows user identity linking9.1 Critical
- feng ha ha ssm-erp, production ssm +1 morefeng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization5.3 Medium
- apache airflowApache Airflow: Disclosure of secrets to UI via kwargs6.5 Medium
libicalOSS-FuzzHeap-use-after-free in vcardproperty_get_valueNo score- opensiftOpenSift: Race-prone local persistence could cause state corruption/loss6.6 Medium
- opensiftOpenSift: SSRF risk in URL ingestion endpoint7.1 High
- opensiftOpenSift: Persistent XSS Chat Tool Rendering8.9 High
- happyseafox sailSAIL: Heap-based Buffer Overflow in Sail-codecs-xwd8.8 High
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability8.8 High
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreUnauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories8.7 High
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)6.9 Medium
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads7.1 High
- linuxfoundation strimzi kafka operator, red hat streams for apache kafka 2, streams for apache kafka 3 +1 more +3 moreStrimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication8.1 High
- phpmoadminphpMoAdmin 1.1.5 Stored Cross-Site Scripting via collection Parameter5.3 Medium
- phpmoadminphpMoAdmin 1.1.5 Reflected Cross-Site Scripting via moadmin.php5.1 Medium
- phpmoadminphpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.php5.3 Medium
- orientdbOrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint5.1 Medium
- orientdbOrientDB 3.0.17 Stored Cross-Site Scripting via User Creation5.1 Medium
- orientdbOrientDB 3.0.17 Cross-Site Request Forgery5.3 Medium
- kostasmitroglou thesystemthesystem 1.0 Command Injection via run_command endpoint9.3 Critical
- agilebio labcollectorLabCollector 5.423 SQL Injection via login.php8.8 High
- foscam video management systemFoscam Video Management System 1.1.6.6 Buffer Overflow Denial of Service6.7 Medium
- sricam deviceviewerSricam DeviceViewer 3.12.0.1 Password Change Security Bypass5.1 Medium
- sricam deviceviewerSricam DeviceViewer 3.12.0.1 Local Buffer Overflow DEP Bypass8.4 High
- Show moreLoading…