CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- No product listed07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting4.8 Medium
- order up online ordering systemSQL injection vulnerability in Order Up Online Ordering System9.8 Critical
- higuma web-audio-recorder-js, webaudiorecorder.js +1 morehiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution2.3 Low
- jinher oa c6Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection5.3 Medium
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 Scheduled Reboot Configuration Endpoint formDateReboot sub_460F30 stack-based overflow8.7 High
wasmtimeOSS-FuzzUNKNOWN WRITE in <wasmtime::runtime::func::Func>::call_unchecked_raw::<No score- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 VPN Configuration Endpoint formVpnConfigSetup sub_4196C4 stack-based overflow8.7 High
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 formDhcpv6s sub_468D64 stack-based overflow8.7 High
- kashipara society management system portalStored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society...6.1 Medium
- akamai ghostAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by...4.0 Medium
- No product listedImproper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to...8.1 High
- totolink x5000r firmwareTOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the...8.0 High
- totolink x6000r firmwareTOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the...8.8 High
- totolink x5000r firmwareTOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the...9.8 Critical
- ymfe yapiyapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent7.4 High
- jxcore jxmAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm...7.4 High
- fofolee utools-quickcommandAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools...6.5 Medium
- No product listedAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To...9.1 Critical
- tenda fh1203 firmwareTenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the...7.5 High
- tencent pcmanagerA privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on...7.4 High
- tencent ioaA privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on...7.4 High
- struktur libde265strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the...6.2 Medium
- saitoha libsixelsaitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component...4.0 Medium
- libtifflibtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.5.0 Medium
- libtifflibtiff up to v4.7.1 was discovered to contain a stack overflow via the...7.3 High
- libtifflibtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component...5.5 Medium
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 formNewSchedule sub_44E0F8 stack-based overflow8.7 High
- d-link dwr-m960, dlink dwr-m960 firmware +1 moreD-Link DWR-M960 formWsc sub_457C5C stack-based overflow8.7 High
- timlegge crypt::nacl::sodium, crypt\ +1 moreCrypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems9.1 Critical
- dst-admin project dst-adminqinming99 dst-admin File BackupController.java deleteBackup denial of service5.3 Medium
- dst-admin project dst-adminqinming99 dst-admin restore revertBackup command injection5.3 Medium
- dromara ujcmsDromara UJCMS ImportDataController import-channel importChanel injection5.3 Medium
- web-ofisi rent a carWeb Ofisi Rent a Car v3 SQL Injection via klima Parameter8.8 High
- web-ofisi platinum e-ticaret, ticaret +1 moreWeb Ofisi Platinum E-Ticaret v5 SQL Injection via ajax/productsFilterSearch8.8 High
- web-ofisi platinum e-ticaret, ticaret +1 moreWeb Ofisi Platinum E-Ticaret v5 SQL Injection via q Parameter8.8 High
- web-ofisi emlakWeb Ofisi Emlak V2 SQL Injection via emlak-ara.html8.8 High
- web-ofisi firma rehberiWeb Ofisi Firma Rehberi v1 SQL Injection via firmalar.html8.8 High
- web-ofisi firmaWeb Ofisi Firma v13 SQL Injection via oz Parameter8.8 High
- web-ofisi emlakWeb Ofisi Emlak v2 SQL Injection via ara Parameter8.8 High
- web-ofisi e-ticaret, ticaret +1 moreWeb Ofisi E-Ticaret v3 SQL Injection via ara.html8.8 High
- dromara ujcmsDromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal5.3 Medium
- vaelsysVaelsys HTTP POST Request tree_server.php os command injection6.9 Medium
- ashopsoftware ashop shopping cart softwareAshop Shopping Cart Software Lastest Latest SQL Injection via bannedcustomers.php8.8 High
- microasp (portal+) cmsmicroASP Portal+ CMS SQL Injection via pagina.phtml8.8 High
- webincorp erpWebIncorp ERP Every version SQL Injection via product_detail.php8.8 High
- novismart cmsNoviSmart CMS SQL Injection via Referer HTTP Header8.8 High
- xoops cmsXOOPS CMS 2.5.9 SQL Injection via gerar_pdf.php8.8 High
- rymcu forestrymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting5.1 Medium
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM 10.0.1 SQL Injection via elemid8.8 High
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM 10.0.1 SQL Injection via card.php7.1 High
- Show moreLoading…