CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- parse-community parse-serverParse Server: Account takeover via JWT algorithm confusion in Google auth adapter9.3 Critical
- maximmasiutin tinywebCGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)10.0 Critical
- n8nn8n Vulnerable to Stored XSS via Various Nodes8.5 High
- n8nn8n: Expression Sandbox Escape Leads to RCE9.4 Critical
- n8nn8n has Arbitrary Command Execution via File Write and Git Operations9.0 Critical
- storybook, red hat enterprise linux 10, enterprise linux 9 +2 more +4 moreStorybook Dev Server Vulnerable to WebSocket Hijacking8.9 High
- go-vikunja vikunjaVikunja has Path Traversal in CLI Restore7.2 High
- go-vikunja vikunjaVikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure7.3 High
- go-vikunja vikunjaVijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change9.1 Critical
- go-vikunja vikunjaVikunja has Reflected HTML Injection via filter Parameter in Projects Module6.1 Medium
- aces lorisLORIS vulnerable to path traversal in electrophysiology_browser8.1 High
- stellarwp the events calendarThe Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API5.4 Medium
- n8nn8n has Potential Remote Code Execution via Merge Node9.4 Critical
- n8nn8n has a Sandbox Escape in its JavaScript Task Runner9.4 Critical
- n8nn8n has Arbitrary File Read via Python Code Node Sandbox Escape7.1 High
- n8nn8n has Unauthenticated Expression Evaluation via Form Node9.5 Critical
- aces lorisLORIS media module vulnerable to remote code execution8.7 High
- freerdpFreeRDP has possible Integer overflow in Stream_EnsureCapacity5.3 Medium
- freerdpFreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File5.5 Medium
- freerdpFreeRDP has heap-use-after-free in rail_window_free5.5 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has Out-of-bounds Write8.8 High
pgvectorDebian,postgresql13-pgvectoropenSUSE,postgresql14-pgvectoropenSUSE +4 more +6 morepgvector buffer overflow in parallel HNSW index build8.1 High- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has Out-of-bounds Write8.8 High
- freerdpFreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)5.0 Medium
- freerdpBuffer Overread in FreeRDP Icon Processing5.5 Medium
- freerdpFreeRDP has heap-use-after-free in xf_clipboard_format_equal5.5 Medium
- freerdpFreeRDP has heap-use-after-free in xf_cliprdr_provide_data_5.5 Medium
- servicenow ai platformRemote Code Execution in ServiceNow AI Platform9.2 Critical
- freerdpFreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)5.5 Medium
- freerdpFreeRDP has heap-use-after-free in xf_rail_server_local_move_size5.5 Medium
- freerdpFreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)5.5 Medium
- freerdpFreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo5.5 Medium
- gitlabImproper Validation of Specified Quantity in Input in GitLab7.5 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.0 High
- gitlabInefficient Regular Expression Complexity in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab4.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- z-9527 adminz-9527 admin user.js getUsers sql injection6.9 Medium
- freerdpFreeRDP has global-buffer-overflow in xf_rail_server_execute_result5.5 Medium
- vmware aria operations, cloud foundation, telco cloud infrastructure +1 more +3 moreVMware Aria Operations privilege escalation vulnerability6.2 Medium
- freerdpFreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read4.3 Medium
- cern rucioRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute6.1 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- vmware aria operations, cloud foundation, telco cloud infrastructure +2 more +4 moreVMware Aria Operations stored cross-site scripting vulnerability8.0 High
- cern rucioRucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name6.1 Medium
- cern rucioRucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata6.1 Medium
- imagemagick, dlemstra magick.net +1 moreImageMagick has a heap Buffer Over-read in its DJVU image format handler4.0 Medium
- Show moreLoading…