CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- imagemagick, dlemstra magick.net +1 moreImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images4.0 Medium
- broadcom vmware aria operations, vmware aria operations, cloud foundation +3 more +5 moreVMware Aria Operations command injection vulnerability8.1 High
- imagemagickImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization2.1 Low
- imagemagickImageMagick - Memory Leak in Raw Pixel Data Coders6.3 Medium
- imagemagickImageMagick - Memory Leak in TXT File Processing via Texture Attribute6.9 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick - Command Injection via SVG Decoder9.2 Critical
- imagemagickImageMagick - Heap Out-of-Bounds Read in PCD Decoder6.3 Medium
- imagemagickImageMagick - Use-After-Free Write in PDB Decoder6.3 Medium
- imagemagickImageMagick - Heap Use-After-Free in Meta Coder6.3 Medium
- craftcms cmsCraft CMS - Stored XSS in Table Field via Row Heading Column Type4.6 Medium
- cern rucioRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function7.3 High
- microsoft windows osDenial of Service in Microsoft OS5.5 Medium
- cern rucioRucio WebUI has Username Enumeration via Login Error Message5.3 Medium
- cern rucioRucio WebUI has a Reflected Cross-site Scripting Vulnerability8.1 High
- drupal responsive faviconsResponsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0194.8 Medium
- drupal saml sso - service providerSAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-0186.1 Medium
- drupal canvasDrupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-0175.0 Medium
- drupal islandoraIslandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-0165.4 Medium
- open-emr openemrOpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms6.5 Medium
- arnabdotorg captchaCAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-0156.5 Medium
- open-emr openemrOpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval6.5 Medium
- cleantalk anti-spam, drupal anti-spam by cleantalk +1 moreAnti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0144.7 Medium
- drupal tagifyTagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0135.4 Medium
- drupal theme negotiation by rulesTheme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-0124.3 Medium
- drupal material iconsMaterial Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-0115.3 Medium
- open-emr openemrOpenEMR Missing Authorization Checks in DICOM Viewer State API7.1 High
- open-emr openemrOpenEMR has SQL Injection Vulnerability8.8 High
- swaldman c3p0, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +15 more +17 morec3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property8.9 High
- open-emr openemrOpenEMR has Stored XSS in Questionnaire answers7.2 High
- openkruise kruiseOpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field0.0 None
- devolutions serverSensitive user account information is not encrypted in the database in Devolutions Server 2025.3...4.9 Medium
- open-emr openemrOpenEMR has Session Timeout Bypass via skip_timeout_reset7.5 High
- open-emr openemrOpenEMR Messages "Show All" Not Restricted to Admins5.7 Medium
- open-emr openemrOpenEMR's Document and Insurance REST Endpoints Skip ACL8.1 High
- open-emr openemrOpenEMR has SQL Injection in Patient API Sort Parameter10.0 Critical
- withastro astro, astro \@astrojs\/node +1 moreAstro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize6.5 Medium
- open-emr openemrOpenEMR Portal Users Can Forge Provider Signatures8.1 High
- open-emr openemrOpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource5.7 Medium
- open-emr openemrOpenEMR has SQL Injection in Immunization Search/Report7.4 High
github.com/bishopfox/sliverGoSliver has Potential Zip Bomb Denial of Service in GzipEncoder7.7 High- langchain community, langchain-ai langchainjs +1 moreLangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader4.1 Medium
- chia blockchainChia Blockchain RPC Server Master Passphrase get_private_key missing authentication2.0 Low
- juniper junos os evolvedJunos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root9.3 Critical
- linksys mr9600, mx4200 +1 moreImproper verification in Linksys MR9600, Linksys MX42007.5 High
- opensipsOpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass8.3 High
- langchain-ai langgraph-checkpointLangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution6.6 Medium
- angular @nguniversal/common, @nguniversal/express-engine, angular-cli +2 moreAngular SSR is vulnerable to SSRF and Header Injection via request handling pipeline9.2 Critical
- angular angular-cliAngular SSR has an Open Redirect via X-Forwarded-Prefix6.9 Medium
redisopenSUSESecurity update for redisNo score- chia blockchainChia Blockchain send_transaction cross-site request forgery2.3 Low
- Show moreLoading…