CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- pmdPMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages6.8 Medium
- difyDify has a user enumeration issue5.5 Medium
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Email Protection Gateway has a Cross-site Scripting vulnerability8.1 High
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)6.5 Medium
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core has an Unrestricted Upload of File with Dangerous Type4.9 Medium
- go-vikunja vikunjaVikunja Vulnerable to Account Takeover via Password Reset Token Reuse9.8 Critical
- tokuhirom http::session2, http\ +1 moreHTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend6.5 Medium
- bigcat88 pillow-heif, pillow heif +1 morepillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read5.5 Medium
- tokuhirom http::session2, http\ +1 moreHTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function6.5 Medium
- phpmyfaqphpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint7.5 High
- intermesh group-office, groupoffice +1 moreGroup-Office Vulnerable to Remote Code Execution (RCE)9.4 Critical
- intermesh group-office, groupoffice +1 moreGroup-Office Has Authenticated SQL Injection in advancedQueryData.comparator7.1 High
- calibre-ebook calibrecalibre has IP Ban Bypass via X-Forwarded-For Header Spoofing5.3 Medium
- calibre-ebook calibrecalibre Vulnerable to HTTP Response Header Injection6.4 Medium
- beszelBeszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID6.5 Medium
- seerrSeerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials6.5 Medium
- seerrSeerr missing authentication on pushSubscription endpoints5.4 Medium
- seerrPlex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint7.3 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 has IDOR in Collection Item Management5.7 Medium
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 has Stored XSS via Collection name2.0 Low
- vmware workstationVMware Workstation out-of-bound read vulnerability2.7 Low
- vmware workstationVMware Workstation out-of-bounds write vulnerability5.0 Medium
- @fastify/middie, fastify fastify\/middie +1 more@fastify/middie has an improper path normalization vulnerability8.2 High
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections5.1 Medium
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change7.1 High
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management Interface5.1 Medium
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID9.3 Critical
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation6.9 Medium
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting6.9 Medium
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Cleartext Credential Transmission8.2 High
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials9.3 Critical
- erlang rebar3, hex, hex core +1 more +3 moreUnsafe Deserialization of Erlang Terms in hex_core2.0 Low
- oscommerceosCommerce 2.3.4.1 SQL Injection via currency Parameter8.8 High
- oscommerceosCommerce 2.3.4.1 SQL Injection via products_id Parameter8.8 High
- oscommerceosCommerce 2.3.4.1 SQL Injection via reviews_id Parameter8.8 High
- doditsolutions airbnb clone script, homey bnb (airbnb clone script) +1 moreHomey BNB V4 SQL Injection Authentication Bypass via Admin Panel8.8 High
- doditsolutions airbnb clone script, homey bnb (airbnb clone script) +1 moreHomey BNB V4 SQL Injection via getrecord.php8.8 High
- doditsolutions airbnb clone script, homey bnb (airbnb clone script) +1 moreHomey BNB V4 SQL Injection via getcmsdata.php8.8 High
- doditsolutions airbnb clone script, homey bnb (airbnb clone script) +1 moreHomey BNB V4 SQL Injection via cms_getpagetitle.php8.8 High
- doditsolutions airbnb clone script, homey bnb (airbnb clone script) +1 moreHomey BNB V4 SQL Injection via admin edit.php8.8 High
- doditsolutions airbnb clone script, homey bnb (airbnb clone script) +1 moreHomey BNB V4 SQL Injection via ajax_refresh_subtotal8.8 High
- open-emr openemrOpenEMR's Portal Payment Endpoint Trusts User-Controlled pid7.1 High
- open-emr openemrOpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint6.5 Medium
- nest.js, nestjs nest, red hat developer hub +1 more +3 moreNestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass8.2 High
awscliPyPI,rootio-awscliRoot +1 moreAWS CLI: cli_history database does not restrict file permissions on Unix systems5.9 Medium- expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 moreMulter vulnerable to Denial of Service via incomplete cleanup8.7 High
- expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 moreMulter vulnerable to Denial of Service via resource exhaustion8.7 High
gpg2SUSESecurity update for gpg2No score- devolutions powershell universalThe OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3...6.5 Medium
- centreon open ticketsPath traversal in Centreon Open Tickets9.9 Critical
- Show moreLoading…