CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- libvipslibvips csvload.c vips_foreign_load_csv_build heap-based overflow4.8 Medium
- spip referer spamSPIP referer_spam < 1.3.0 Unauthenticated SQL Injection9.3 Critical
- spip ticketsSPIP tickets < 4.3.3 Unauthenticated RCE9.3 Critical
- spip interface traduction objetsSPIP interface_traduction_objets < 2.2.2 Authenticated RCE8.7 High
- spip jeuxSPIP jeux < 4.1.1 Reflected XSS via index Parameters5.1 Medium
- spip interface traduction objetsSPIP interface_traduction_objets < 2.2.2 Authenticated SQL Injection7.1 High
- libvipslibvips matrixload.c vips_foreign_load_matrix_header null pointer dereference4.8 Medium
- hitachi configuration manager, device manager, ops center api configuration manager +2 moreInformation Exposure Vulnerability in Hitachi Configuration Manager, Hitachi Ops Center API Configuration Manager5.2 Medium
- talisharTalishar Vulnerable to Cross-Site Request Forgery (CSRF)2.6 Low
- inventreeInvenTree Vulnerable to Server Side Template Injection (SSTI)5.9 Medium
- py-pdf pypdfpypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams1.2 Low
- olivetinOliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks10.0 Critical
- denpiligrim repostatRepostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard6.1 Medium
- opnsense core, typicms +1 moreTypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload6.8 Medium
- alex4ssb adb-explorer, adb explorer +1 moreADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE)8.8 High
- bugsinkBugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering9.3 Critical
- gtsteffaniak filebrowser, filebrowser quantum +1 moreFileBrowser Quantum: Password Protection Not Enforced on Shared File Links7.1 High
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard has incomplete authentication on AI Agent endpoint9.9 Critical
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions7.0 High
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Missing CSRF Protection on Agent Endpoint8.3 High
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Missing Authorization on Agent Endpoint9.3 Critical
- rustfsRust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover9.1 Critical
- rustfsRustFS's Missing Post Policy Validation leads to Arbitrary Object Write8.1 High
- rollup, red hat openshift pipelines, openshift service mesh 3 +26 more +28 moreRollup 4 has Arbitrary File Write via Path Traversal8.8 High
- open-emr openemrOpenEMR's location resource for Group.$export operation returns entire patient/user population contact information4.5 Medium
- libvipslibvips matrixload.c vips_foreign_load_matrix_header memory corruption4.8 Medium
- open-emr openemrOpenEMR has Broken Access Control in Procedures Configuration8.8 High
- open-emr openemrOpenEMR has Broken Access Control on Care Coordination Module7.0 High
- open-emr openemrOpenEMR has Broken Access Control in Report/Clients/Message List CSV Export6.5 Medium
- open-emr openemrOpenEMR has Broken Access Control that allows unauthorized access to EDI Logs6.5 Medium
- open-emr openemrOpenEMR Arbitrary File Read Vulnerability10.0 Critical
- open-emr openemrOpenEMR has Open Redirect in Eye Exam Form6.1 Medium
- cyberark endpoint privilege manager, cyberark software, a palo alto networks company endpoint privilege manager agent +1 moreCyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized...8.5 High
- open-emr openemrOpenEMR allows inconsistent escaping of translation function output1.2 Low
- open-emr openemrOpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation8.7 High
- open-emr openemrOpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal7.2 High
- open-emr openemrOpenEMR Has Disabled SSL Certificate Verification in HTTP Client8.1 High
- code-projects food ordering systemCodeAstro Food Ordering System food_ordering.exe stack-based overflow4.8 Medium
- open-emr openemrOpenEMR has Stored XSS in ub04 helper8.5 High
libicalOSS-FuzzHeap-buffer-overflow in vcardstructured_new_from_stringNo scoregpsdOSS-FuzzGlobal-buffer-overflow in navcom_parseNo scoregrokOSS-FuzzHeap-use-after-free in tf::Executor::_invokeNo scorecoturnOSS-FuzzUse-of-uninitialized-value in BIO_new_fileNo scorepcapplusplusOSS-FuzzUse-of-uninitialized-value in pcpp::IPv6Extension::getExtensionLenNo scoregpsdOSS-FuzzUNKNOWN WRITE in nmeaid_to_prnNo score- clive 21 news portal projectitsourcecode News Portal Project add-category.php sql injection6.9 Medium
richiePyPIOpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function4.8 Medium- killergerbah asbplayerAn arbitrary file upload vulnerability in the subtitle loading function of asbplayer v1.13.0...9.6 Critical
- clive 21 news portal projectitsourcecode News Portal Project edit-category.php sql injection6.9 Medium
- admerc document management systemitsourcecode Document Management System Login loging.php sql injection6.9 Medium
- Show moreLoading…