CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- centreon open tickets on central server, web +1 moreCommand Injection via CLAPI generatetraps9.1 Critical
gitUbuntugit regressionNo score- datocms web previewsAuthenticated DatoCMS Web Previews Plugin Iframe Injection4.8 Medium
- pro3w cmsSQL Injection in Pro3W CMS9.3 Critical
- centreon web on central server, web +1 moreBlind SQL Injection8.3 High
- haproxy aloha, haproxy, haproxy enterprise +2 moreHAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because...3.7 Low
- google web designerZip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web Designer8.4 High
- eduasistReflected XSS in Knowhy's EduAsist6.3 Medium
- signum technology promotion and training inc. windesk.fmSQLi in Signum Technologies' windesk.fm9.8 Critical
- dayneks software industry and trade inc. e-commerce platform, daynex woyio +1 moreSQLi in Dayneks Software's E-Commerce Platform9.8 Critical
kernel-livepatch-SLE16_Update_5SUSESecurity update for the initial kernel livepatchNo scorekernel-livepatch-SLE16-RT_Update_5SUSE,kernel-livepatch-SLE16_Update_5SUSE +1 moreSecurity update for the initial kernel livepatchNo score- pluxml, pluxml cms +1 moreSession Fixation in PluXml CMS4.8 Medium
- pluxml, pluxml cms +1 moreStored XSS in PluXml CMS5.1 Medium
- pluxml, pluxml cms +1 moreStored XSS in PluXml CMS5.1 Medium
- pierrelannoy mailarchiverMailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter4.9 Medium
- politechnika warszawska omega-psirReflected XSS in Omega-PSIR5.1 Medium
- red hat pen drive powered by red hat lightspeed, 3scale api management platform 2, enterprise linux 10 +5 more +7 moreRedis: redis: out-of-bounds read via crafted cluster bus packets7.1 High
- shoheitanaka japanized for woocommerceJapanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation5.3 Medium
- electriccode electric enquiriesElectric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute6.4 Medium
- moneytigo ovri paymentOVRI Payment 1.7.0 - Malicious .htaccess directive6.5 Medium
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware6.9 Medium
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion8.7 High
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- sick lms1000 firmware, mrs1000 firmware, sick ag lms1000 +1 more +3 moreAn attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service...6.5 Medium
- sick lms1000 firmware, mrs1000 firmware, sick ag lms1000 +1 more +3 moreAn attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to...6.5 Medium
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- mra13 simple download monitorSimple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field6.4 Medium
- joedolson wp accessibilityWP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute6.4 Medium
- xerox freeflow coreXML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)7.5 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +3 more +5 moreOrg.keycloak/keycloak-services: webauthn attestation statement verification bypass3.1 Low
- xerox freeflow corePath Traversal leading to Remote Code Execution (RCE)9.8 Critical
- intra-mart accel platform, ntt data intramart corporation intra-mart accel platform +1 moreIM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue....8.6 High
- logicminds rubyipmi, redhat satellite, red hat satellite 6 +4 more +6 moreRubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username8.3 High
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators4.9 Medium
- vivo health, health module +1 moreInsufficient protection mechanisms in the Health Module may lead to partial information disclosure.5.1 Medium
- vivo smartremote, smartremote module +1 moreThe SmartRemote module has insufficient restrictions on loading URLs, which may lead to some...7.1 High
- xpro addons — 140+ widgets for elementorXpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link6.4 Medium
- dreamstechnologies listeeListee <= 1.1.6 - Unauthenticated Privilege Escalation9.8 Critical
- themesuite automotive car dealership business wordpress themeAutomotive Car Dealership Business WordPress Theme <= 13.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields6.4 Medium
- remyandrade doctor appointment systemSourceCodester Doctor Appointment System Sign Up register.php cross site scripting5.3 Medium
- soliton securebrowser for onegate, securebrowser ii, secureworkspace +1 more +3 moreThe installers for multiple products provided by Soliton Systems K.K. contain an issue with...5.4 Medium
- totolink n300rh, n300rh firmware +1 moreTotolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection9.3 Critical
- snowflake jdbc, snowflakedb snowflake-jdbc +1 moresnowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos4.8 Medium
- jizhicmsjizhiCMS Batch Model.php findAll sql injection5.3 Medium
- openstack vitrageOpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection9.1 Critical
- brechtvds wp recipe makerWP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter5.3 Medium
- publiccmsSanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal5.3 Medium
- Show moreLoading…