CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- go2ismail free-crmgo2ismail Free-CRM Administrative redirect5.3 Medium
- wgerwger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data4.3 Medium
- umbraco umbraco.engage.formsUmbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints7.5 High
- zulipZulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users7.1 High
- go2ismail asp.net-core-inventory-order-management-systemgo2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization5.3 Medium
- discourseDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category1.2 Low
- discoursePrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners1.3 Low
- discourseDiscourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution5.3 Medium
- discourseDiscourse has XSS when editing a malicious post1.3 Low
- discourseDiscourse doesn't prevent moderators from exporting user Chat DMs1.3 Low
- go2ismail asp.net-core-inventory-order-management-systemgo2ismail Asp.Net-Core-Inventory-Order-Management-System Administrative redirect5.3 Medium
- itsourcecode school management systemitsourcecode School Management System Setting index.php sql injection6.9 Medium
- volcengine openvikingOpenViking Missing root_api_key Allows Anonymous ROOT Access9.3 Critical
- amd athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 7001 series processors, epyc™ 7002 series processors +30 more +32 moreImproper handling of direct memory writes in the input-output memory management unit could allow...8.3 High
- spipSPIP < 4.4.10 Authentication Bypass via PHP Type Juggling8.7 High
- spipSPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags8.7 High
- discourseDIscourse has DM communication-preference bypass when adding members1.3 Low
- discourseDIscourse doesn't prevent whispers to leak in excerpts4.9 Medium
- discourseDiscourse doesn't validate destination topic when moving posts1.3 Low
- discourseDiscourse doesn't ensure guardian check when creating QueryGroupBookmark1.3 Low
- discourseDiscourse has SQL injection in PM tag filtering4.9 Medium
- discourseDiscourse: Poll voters endpoint lacked post visibility checks6.9 Medium
- weblateWeblate: Missing access control for the AddonViewSet API exposes all addon configurations4.3 Medium
- hex hexpmPath Traversal in Local File Store Backend6.9 Medium
- discourseDiscourse: TL4 users are able to change status of restricted topics0.0 None
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload8.8 High
- pelco, inc. sarix professional ibp 3 series, sarix professional imp 3 series, sarix professional iwp 3 series +1 more +3 moreAuthentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP Cameras8.7 High
- discourseDiscourse doesn't scope reviewable notes to user-visible reviewables4.3 Medium
- unitree go2 firmware, unitreerobotics unitree go2 +1 moreUnitree Go2 Mobile Program Tampering Enables Root RCE6.4 Medium
- unitree go2 firmware, unitreerobotics unitree go2, unitree go2 edu firmware +2 moreUnitree Go2 Missing DDS Authentication Enables Adjacent RCE8.5 High
- vmware workstationVMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash6.1 Medium
- vmware fusion, workstation +1 moreVMware Workstation/Fusion NAT vulnerability5.9 Medium
- golang.org/x/net golang.org/x/net/http2Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net7.5 High
- elastic kibanaImproper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)8.6 High
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- videolan vlc for androidVLC for Android < 3.7.0 Remote Access OTP Authentication Bypass6.3 Medium
- golioth pouchGolioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow7.2 High
- golioth firmware sdkGolioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read2.1 Low
- golioth firmware sdkGolioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read6.3 Medium
- golioth firmware sdkGolioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow6.3 Medium
- elastic kibanaInefficient Regular Expression Complexity in Kibana Leading to Denial of Service4.9 Medium
- elastic kibanaImproper Input Validation in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service6.5 Medium
- elastic packetbeatImproper Validation of Array Index in Packetbeat Leading to Denial of Service5.7 Medium
- n8nn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger6.3 Medium
- n8nn8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGvfs: gvfs ftp backend: information disclosure via untrusted pasv responses4.3 Medium
- videolan vlc for androidVLC for Android < 3.7.0 Remote Access Path Traversal2.3 Low
redis7openSUSESecurity update for redis7No score- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths4.3 Medium
- Show moreLoading…