CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- tenda f453, f453 firmware +1 moreTenda F453 httpd DhcpListClient fromDhcpListClient buffer overflow8.7 High
- tenda f453, f453 firmware +1 moreTenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflow8.7 High
- clevertap web sdkCleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage8.3 High
- clevertap web sdkCleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function8.3 High
- publiccmsPublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain...8.7 High
- switch ev swtchenergy.comSWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts8.7 High
- switch ev swtchenergy.comSWITCH EV swtchenergy.com Missing Authentication for Critical Function9.3 Critical
- ev2go ev2go.ioEV2GO ev2go.io Insufficiently Protected Credentials6.9 Medium
- ev2go ev2go.ioEV2GO ev2go.io Insufficient Session Expiration6.9 Medium
- ev2go ev2go.ioEV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts8.7 High
- ev2go ev2go.ioEV2GO ev2go.io Missing Authentication for Critical Function9.3 Critical
- canon inc. ij scan utilityAn unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions...8.4 High
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Insufficiently Protected Credentials6.9 Medium
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Insufficient Session Expiration6.9 Medium
- grichter apache::sessionx, apache\ +1 moreApache::SessionX versions through 2.01 for Perl create insecure session id8.2 High
- psi-probe psi probepsi-probe PSI Probe Whois Whois.java lookup server-side request forgery5.3 Medium
- psi-probe psi probepsi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of service5.3 Medium
- leont crypt::sysrandom::xs, crypt\ +1 moreCrypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()7.5 High
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts8.7 High
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Missing Authentication for Critical Function9.3 Critical
- chargemap chargemap.comChargemap chargemap.com Insufficiently Protected Credentials6.9 Medium
- chargemap chargemap.comChargemap chargemap.com Insufficient Session Expiration6.9 Medium
- chargemap chargemap.comChargemap chargemap.com Improper Restriction of Excessive Authentication Attempts8.7 High
- chargemap chargemap.comChargemap chargemap.com Missing Authentication for Critical Function9.3 Critical
- psi-probe psi probepsi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control5.3 Medium
- jmpsec osctrl`osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List6.1 Medium
- jmpsec osctrl`osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration7.4 High
- morelitea initiativeInitiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint7.5 High
- morelitea initiativeInitiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)8.1 High
- morelitea initiativeInitiative Vulnerable to Token Theft via Stored XSS in Document Uploads8.7 High
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core has an OS Command Injection5.9 Medium
- steve-community steveIn SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)5.7 Medium
github.com/filecoin-project/curioGoCurio exposes database credentials to users with network access through verbose HTTP error responses7.1 High- n8nn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger6.3 Medium
- n8nn8n - Guardrail Node Bypass via Crafted Input6.3 Medium
- n8nn8n - Authentication Bypass in Chat Trigger Node6.3 Medium
- n8nn8n - SSO Enforcement Bypass via API6.0 Medium
- phishing.club phishing club, phishingclub +1 morePhishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing6.5 Medium
- manyfoldManyfold has IDOR in ModelFilesController5.3 Medium
- hoppscotchIDOR in GraphQL userCollection Query Exposes Other Users' Private Collections6.5 Medium
- hoppscotchhoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment8.3 High
- hoppscotchhoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover9.1 Critical
- go2ismail free-crmgo2ismail Free-CRM Security API improper authorization5.3 Medium
- evershopEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response9.8 Critical
- cyrilleb79 nvda-dev-test-toolboxArbitrary code execution in log reader via untrusted log file7.8 High
- junrarJunrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix5.9 Medium
- z-libs zen-c, zenc-lang zen c +1 moreZen-C Vulnerable to Command Injection via Malicious Output Filename6.6 Medium
- actualbudget actualActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode5.7 Medium
- wgerwger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup4.3 Medium
- wgerwger: IDOR via user-unscoped cache keys on routine API actions exposes workout data3.1 Low
- Show moreLoading…