CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- feiyuchuixue sz-boot-parentfeiyuchuixue sz-boot-parent API Endpoint sys-message authorization6.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on...2.3 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions...8.8 High
- epati antikor next generation firewall, epati cyber security technologies inc. antikor next generation firewall (ngfw) +1 moreAuthentication Bypass in ePati's Antikor NGFW9.8 Critical
- grafanaAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by Name2.6 Low
- octopus serverIn affected version of Octopus Deploy it was possible to remove files and/or contents of files on...5.9 Medium
- redhat developer hub, red hat developer hub 1.8, developer hub 1.9 +2 moreRhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin6.5 Medium
- opensuse sdbootutilAn Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create...7.0 High
- freedesktop udisks, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreUdisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api5.5 Medium
- freedesktop udisks, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreUdisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api7.1 High
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute6.4 Medium
- metaphor creations post duplicatorPost Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter4.3 Medium
- themeisle disable admin notices – hide dashboard notificationsDisable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure4.3 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting5.1 Medium
- cyberhobo geo mashupGeo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter7.5 High
- mihail-barinov advanced woo labels – product labels & badges for woocommerceAdvanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter8.8 High
- javmah wpgsi: spreadsheet integrationWPGSI: Spreadsheet Integration <= 3.8.3 - Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via Forged Base64 Token7.5 High
- dfactory responsive lightbox & galleryResponsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload5.0 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting4.8 Medium
- tenda f453, f453 firmware +1 moreTenda F453 httpd SafeEmailFilter fromSafeEmailFilter buffer overflow8.7 High
- tenda f453, f453 firmware +1 moreTenda F453 httpd NatStaticSetting fromNatStaticSetting buffer overflow8.7 High
- tenda f453, f453 firmware +1 moreTenda F453 httpd webtypelibrary formWebTypeLibrary buffer overflow8.7 High
- eaglethemes rise blocks – a complete gutenberg page builderRise Blocks – A Complete Gutenberg Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes6.4 Medium
- tenda f453, f453 firmware +1 moreTenda F453 httpd RouteStatic fromRouteStatic buffer overflow8.7 High
- tenda f453, f453 firmware +1 moreTenda F453 httpd AdvSetWrlsafeset fromSetWifiGusetBasic buffer overflow8.7 High
- clive 21 news portal projectitsourcecode News Portal Project contactus.php sql injection6.9 Medium
- motex lanscope endpoint manager, motex inc. lanscope endpoint manager (on-premises) sub-manager server +1 morePath traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server...9.3 Critical
- asustor adm, data master +1 moreA path traversal vulnerability was found in the FTP Backup on the ADM.9.2 Critical
- asustor adm, data master +1 moreAn improper certificate validation vulnerability was found in the FTP Backup on the ADM.8.3 High
- remyandrade website link extractorSourceCodester Website Link Extractor URL file_get_contents server-side request forgery5.3 Medium
- admerc document management systemitsourcecode Document Management System register.php sql injection6.9 Medium
- angeljudesuarez college management systemitsourcecode College Management System teacher-salary.php sql injection6.9 Medium
- angeljudesuarez college management systemitsourcecode College Management System login.php sql injection6.9 Medium
- angeljudesuarez college management systemitsourcecode College Management System display-teacher.php sql injection5.3 Medium
- hitachi configuration manager, ops center api configuration manager +1 moreInformation Exposure Vulnerability in Hitachi Configuration Manager, Hitachi Ops Center API Configuration Manager4.7 Medium
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs8.6 High
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response6.1 Medium
- coturnCoturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL7.2 High
- angeljudesuarez college management systemitsourcecode College Management System asign-single-student-subjects.php sql injection5.3 Medium
- haben-cs9 simple and nice shopping cart scriptSourceCodester Simple and Nice Shopping Cart Script signup.php sql injection6.9 Medium
- agentfront enclave@enclave-vm/core is vulnerable to Sandbox Escape10.0 Critical
- jugmac00 flask-reuploadedFlask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection9.8 Critical
- oocx tfplan2mdtfplan2md has Sensitive Value Exposure in Generated Reports8.5 High
- karakeep-app karakeepKarakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS8.2 High
- dbarzin mercatorMercator vulnerable to stored XSS via unescaped Blade directives in display templates8.5 High
- freescoutFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache8.8 High
- freescoutFreeScout's Predictable Authentication Token Enables Account Takeover9.8 Critical
- Show moreLoading…