CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- 9001 copypartyCopyparty vulnerable to eflected cross-site scripting via setck parameter5.4 Medium
- open-emr openemrOpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership6.5 Medium
- tgrk custom logoCustom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting4.4 Medium
- livemesh addons for beaver builderLivemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes6.4 Medium
- bulktheme wp social metaWP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings4.4 Medium
- readymadeweb tp2wp importerTP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea4.4 Medium
- stuartbates wp responsive imagesWP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src7.5 High
- motahar1 em cost calculatorEM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'6.1 Medium
- naturalintelligence fast-xml-parserfast-xml-parser has stack overflow in XMLBuilder with preserveOrder2.7 Low
- openlit, openlit software development kit +1 moreOpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows10.0 Critical
- wp-graphqlWPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow7.7 High
- isaacs minimatchminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 High
- isaacs minimatchminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments7.5 High
- svelteSvelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers5.3 Medium
- svelteSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`5.3 Medium
- spinframework containerd-shim-spin, spin, spinkube +2 moreSpin has memory leaks in various WIT interfaces6.9 Medium
- linode terraform-provider-linode, terraform linode provider +1 moreTerraform Provider Debug Logs Vulnerable to Sensitive Information Exposure5.0 Medium
- h44z wg-portal, wgportal wireguard portal +1 moreWireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update8.8 High
- bitnami sealed-secretssealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations4.9 Medium
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +3 more +5 moreMCP Go SDK Vulnerable to Improper Handling of Case Sensitivity7.0 High
- py-pdf pypdfpypdf: Manipulated FlateDecode XFA streams can exhaust RAM6.6 Medium
- pennyw0rth netexecNetExec vulnerable to arbitrary file write via path traversal in spider_plus module5.3 Medium
- zitadelZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API8.2 High
- zitadelZITADEL has potential SSRF via Actions2.1 Low
- zitadelZITADEL's truncated opaque tokens are still valid4.3 Medium
- dottie project dottie, mickhansen dottie.js +1 moreDottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()6.3 Medium
libicalOSS-FuzzUNKNOWN READ in strncasecmpNo score- bluedragonsecurity rldnsrldns Vulnerable to Heap-based Out-of-Bounds Read7.5 High
- gpacGPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow7.7 High
- fleetdm fleetFleet has a SQL injection via backtick escape in ORDER BY parameter5.1 Medium
- terria terriajs-serverTerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist8.7 High
- sub2apiSub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover8.0 High
- xjd2020 fastcmsAn issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the...7.8 High
- No product listedImproper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows...8.2 High
- No product listedA reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of...5.4 Medium
- No product listedZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control...9.8 Critical
- psd-toolspsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps6.8 Medium
- axllent mailpitMailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API5.8 Medium
- lfprojects model context protocol servers, modelcontextprotocol servers +1 moremcp-server-git : Path traversal in git_add allows staging files outside repository boundaries6.4 Medium
- m2team nanazipNanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length5.1 Medium
- m2team nanazipNanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)5.1 Medium
- m2team nanazipNanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength5.1 Medium
- zedZed Extension Sandbox Escape via Tar Symlink Following8.8 High
- zedSymlink Escape in Agent File Tools7.1 High
- zedZed has Zip Slip Path Traversal in Extension Archive Extraction7.4 High
- manyfoldManyfold vulnerable to session hijack via cookie leakage in proxy caches6.8 Medium
- manyfoldManyfold vulnerable to OS command injection via ZIP filename in f3d render7.5 High
- maximmasiutin tinywebTinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)8.7 High
- maximmasiutin tinywebTinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)8.7 High
- fosrl pangolinfosrl Pangolin Role verifyApiKeyRoleAccess access control5.3 Medium
- Show moreLoading…