CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- discourseDiscourse has IDOR vulnerability in the directory items endpoint7.5 High
- discourseDIscourse's discourse-policy plugin lacks post access check5.4 Medium
- discourseDiscourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint7.5 High
- discourseDiscourse doesn't ensure webhooks require a token6.5 Medium
- flairDeserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to...8.4 High
- google cloud vertex ai workbenchSensitive Data Exposure in Google Cloud Vertex AI Workbench8.4 High
- a3facturaMultiple vulnerabilities in A3factura software4.8 Medium
- a3facturaMultiple vulnerabilities in A3factura software4.8 Medium
- a3facturaMultiple vulnerabilities in A3factura software4.8 Medium
- a3facturaMultiple vulnerabilities in A3factura software4.8 Medium
- dokuzsoft technology ltd. e-commerce productReflected XSS in Dokuzsoft Technology's E-Commerce Product7.6 High
tracing_checkscrates.io`tracing_checks` was removed from crates.io for transitively including malicious codeNo scoretracingscrates.io`tracings` was removed from crates.io for malicious codeNo scorehivexcrates.ioHive has Double-free and Use After Free VulnerabilitiesNo score- simple sa simple.erpSQL Injection in SIMPLE.ERP8.6 High
- checkmkCross-site scripting in HTML logs of Synthetic Monitoring test services7.3 High
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability7.2 High
- veronalabs wp smsWordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability7.6 High
- villatheme woocommerce photo reviewsWordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability5.3 Medium
- wpvibes elementor addon elementsWordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability6.5 Medium
- ux-themes flatsomeWordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- arcinfo pcvueHTTP Host header vulnerability in WebClient and WebScheduler web apps5.3 Medium
- arcinfo pcvueUse of unsecure cookies for GraphicalData web service and WebClient web app5.3 Medium
- arcinfo pcvueMissing security HTTP headers2.3 Low
- arcinfo pcvueXSS vulnerability upon unsuccessful authentication5.3 Medium
- arcinfo pcvueServer configuration details in HTTP headers2.3 Low
- arcinfo pcvueUse of vulnerable Resource Owner Password Credentials flow5.3 Medium
- arcinfo pcvueMissing origin validation in GraphicalData web service requests5.3 Medium
- digital arts inc. finalcode ver.5 series, finalcode ver.6 series +1 moreThe installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL...8.4 High
- digital arts inc. finalcode ver.5 series, finalcode ver.6 series +1 moreThe installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default...8.5 High
- bearsthemes worry proof backupWorry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload8.8 High
- fleetdm fleetFleet: Sensitive Google Calendar credentials disclosed to low-privileged users1.3 Low
- fleetdm fleetFleet: Authorization Bypass in certificate template batch deletion for team administrators1.2 Low
- fleetdm fleetFleet: Device lock PIN can be predicted if lock time is known0.6 Low
- fleetdm fleetFleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint1.7 Low
- ajentiAjenti has a potential Remote Code Execution8.1 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.2 - Authentication Bypass8.1 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion5.3 Medium
- advplyr audiobookshelf-app, audiobookshelf mobile app +1 moreAudiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player)4.8 Medium
- advplyr audiobookshelfAudiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata4.8 Medium
- advplyr audiobookshelf, audiobookshelf-app, audiobookshelf mobile app +2 moreAudiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App)4.0 Medium
- angular, red hat advanced cluster management for kubernetes 2, enterprise linux 10 +5 more +7 moreAngular i18n vulnerable to Cross-Site Scripting (XSS)7.6 High
- packistryPackistry accepts expired access tokens4.3 Medium
- langflowLangflow has Remote Code Execution in CSV Agent9.8 Critical
- linuxfoundation vitessVitess users with backup storage access can write to arbitrary file paths on restore9.3 Critical
- linuxfoundation vitessVitess users with backup storage access can gain unauthorized access to production deployment environments8.4 High
- koajs koa, red hat developer hub, openshift ai (rhoai) +4 more +6 moreKoa has Host Header Injection via `ctx.hostname`7.5 High
- livehelperchat live helper chat, livehelperchat +1 moreLiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints4.9 Medium
- agenta-ai agentaAgenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE8.8 High
- agenta-ai agenta-api, agentatech agenta +1 moreAgenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)8.8 High
- Show moreLoading…