CVEs published February 5, 2026
117 CVEs were published on February 5, 2026: 6 critical, 33 high.
- Published
- 117
- Critical
- 6
- High
- 33
- Medium
- 71
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 56
Most affected products
- Tanium Threat Response
- 5
- WeKan
- 5
- Tanium Appliance
- 4
- 10-Strike Software Network Inventory Explorer
- 2
- EDIMAX Technology EW-7438RPn Mini
- 2
- EmTec ZOC Terminal
- 2
- golang.org/x/net/html · golang.org/x/net
- 2
- metagauss ProfileGrid – User Profiles, Groups and Communiti…
- 2
- microweber/microweber
- 2
- Moxa UC-1200A Series
- 2
Critical 6
- CVE-2026-24300Azure Front Door Elevation of Privilege VulnerabilityMicrosoft Azure Front Door
- CVE-2026-0106In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check.Google Android
- CVE-2025-68121Unexpected session resumption in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2020-37125Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code ExecutionEDIMAX Technology EW-7438RPn Mini
- CVE-2020-37123Pinger 1.0 - Remote Code Executionwcchandler Pinger
- CVE-2025-68723Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface.
High 33
- CVE-2025-32393AutoGPT has a DoS vulnerability in ReadRSSFeedBlockSignificant-Gravitas AutoGPT
- CVE-2026-21532Azure Function Information Disclosure VulnerabilityMicrosoft Azure Functions
- CVE-2026-24302Azure Arc Elevation of Privilege VulnerabilityMicrosoft Azure ARC
- CVE-2025-15311Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.Tanium Appliance
- CVE-2025-15330Tanium addressed an improper input validation vulnerability in Deploy.Tanium Deploy
- CVE-2025-15557Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle AttackTP-Link Systems Tapo H100 · TP-Link Systems Tapo P100
- CVE-2026-1707Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)pgadmin.org pgAdmin · pgadmin4
- CVE-2026-0715Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device.Moxa UC-1200A Series
- CVE-2026-0714A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial LiMoxa UC-1200A Series
- CVE-2020-37150Edimax Technology EW-7438RPn-v3 Mini 1.27 - Unauthorized Access: Wi-Fi Password DisclosureEDIMAX Technology EW-7438RPn-v3 Mini
- CVE-2020-3714210-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)10-Strike Software Network Inventory Explorer
- CVE-2020-3713810-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP)10-Strike Software Network Inventory Explorer
- CVE-2020-37137PHP-Fusion 9.03.50 - 'panels.php' Eval InjectionPHP Fusion
- CVE-2020-37129Memu Play 7.1.3 - Insecure Folder PermissionsMicrovirt Memu Play
- CVE-2020-37126Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)Drive Software Company Free Desktop Clock
- CVE-2020-37124B64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter)4Mhz B64dec
- CVE-2020-37120Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH)Rubo Medical Imaging Rubo DICOM Viewer
- CVE-2020-37119Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite))Nsasoft Nsauditor
- CVE-2020-37117jizhiCMS 1.6.7 - Arbitrary File DownloadjizhiCMS
- CVE-2020-37151phpMyChat Plus 1.98 'deluser.php' SQL InjectionCiprianmp phpMyChat Plus
- CVE-2025-13379A SQL Injection vulnerability has been addressed in IBM Aspera ConsoleIBM Aspera Console
- CVE-2026-1523Path Traversal in Digitek from Grupo AzkoyenPRIMION DIGITEK Digitek ADT1100 · PRIMION DIGITEK Digitek D…
- CVE-2026-23572Improper Access Control in TeamViewer clientsTeamViewer Remote · TeamViewer Tensor +1
- CVE-2026-1294All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpointbplugins All In One Image Viewer Block – Gutenberg block to…
- CVE-2026-1953Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2Nukegraphic CMS
- CVE-2025-15080Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA productsMitsubishi Electric MELSEC iQ-R Series R08PCPU · Mitsubi… +2
- CVE-2025-61732Potential code smuggling via doc comments in cmd/cgoGo toolchain cmd/cgo · toolchain
- CVE-2025-10314Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for WindowsMitsubishi Electric FREQSHIP-mini for Windows
- CVE-2025-11730A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versiZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2025-68721Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface.
- CVE-2025-68722Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin inter
- CVE-2025-69906Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.
- CVE-2025-70073An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function
Medium, low and unrated 78
- CVE-2026-23623Collabora Online vulnerable to Authorization BypassCollaboraOnline online
- CVE-2025-68157webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirectswebpack
- CVE-2025-68458webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorwebpack
- CVE-2026-0391Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-1970Edimax BR-6258n formStaDrvSetup redirectEdimax BR-6258n
- CVE-2026-1964WeKan REST Endpoint boards.js BoardTitleRESTBleed access controlWeKan
- CVE-2026-25815Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild fFortinet FortiOS
- CVE-2026-1963WeKan Attachment Storage attachments.js MoveStorageBleed access controlWeKan
- CVE-2026-1962WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access controlWeKan
- CVE-2025-12131Truncated 802.15.4 packet leads to denial of servicesilabs.com EmberZNet SDK
- CVE-2026-1301Out-of-bounds Write in o6 Automation GmbH Open62541o6 Automation Open62541
- CVE-2025-15312Tanium addressed an improper output sanitization vulnerability in TanOS.Tanium Appliance
- CVE-2025-15324Tanium addressed a local privilege escalation vulnerability in Engage.Tanium Engage
- CVE-2025-15325Tanium addressed an improper input validation vulnerability in Discover.Tanium Discover
- CVE-2025-15326Tanium addressed an improper access controls vulnerability in Patch.Tanium Patch
- CVE-2025-15327Tanium addressed an improper access controls vulnerability in Deploy.Tanium Deploy
- CVE-2025-15328Tanium addressed an improper link resolution before file access vulnerability in Enforce.Tanium Enforce
- CVE-2025-15331Tanium addressed an uncontrolled resource consumption vulnerability in Connect.Tanium Connect
- CVE-2025-15329Tanium addressed an information disclosure vulnerability in Threat Response.Tanium Threat Response
- CVE-2025-15332Tanium addressed an information disclosure vulnerability in Threat Response.Tanium Threat Response
- CVE-2025-15321Tanium addressed an improper input validation vulnerability in Tanium Appliance.Tanium Appliance
- CVE-2025-15333Tanium addressed an information disclosure vulnerability in Threat Response.Tanium Threat Response
- CVE-2025-15334Tanium addressed an information disclosure vulnerability in Threat Response.Tanium Threat Response
- CVE-2025-15335Tanium addressed an information disclosure vulnerability in Threat Response.Tanium Threat Response
- CVE-2025-15341Tanium addressed an incorrect default permissions vulnerability in Benchmark.Tanium Benchmark
- CVE-2025-15339Tanium addressed an incorrect default permissions vulnerability in Discover.Tanium Discover
- CVE-2025-15340Tanium addressed an incorrect default permissions vulnerability in Comply.Tanium Comply
- CVE-2025-15338Tanium addressed an incorrect default permissions vulnerability in Partner Integration.Tanium Partner Integration
- CVE-2025-15336Tanium addressed an incorrect default permissions vulnerability in Performance.Tanium Performance
- CVE-2025-15337Tanium addressed an incorrect default permissions vulnerability in Patch.Tanium Patch
- CVE-2025-15342Tanium addressed an improper access controls vulnerability in Reputation.Tanium Reputation
- CVE-2025-15323Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.Tanium Appliance
- CVE-2025-15343Tanium addressed an incorrect default permissions vulnerability in Enforce.Tanium Enforce
- CVE-2025-15289Tanium addressed an improper access controls vulnerability in Interact.Tanium Interact
- CVE-2025-58190Infinite parsing loop in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2025-47911Quadratic parsing complexity in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2025-15551LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845NTP-Link Systems Archer MR200 · TP-Link Systems Archer C20 +2
- CVE-2020-37148P5 FNIP-8x16A/FNIP-4xSH 1.0.20, 1.0.11 - Stored Cross-Site Scripting (XSS)P5 FNIP-8x16A · P5 FNIP-4xSH
- CVE-2020-37152PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)PHP-Fusion
- CVE-2020-37149Edimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command ExecutionEDIMAX Technology EW-7438RPn Mini
- CVE-2020-37145HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)HRSALE
- CVE-2020-37144Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)Exagate Sysguard
- CVE-2020-37143ProficySCADA for iOS 5.0.25920 - 'Password' Denial of ServiceGE Intelligent Platforms ProficySCADA for iOS
- CVE-2020-37140Everest 5.50.2100 - 'Open File' Denial of ServiceFinalWire Everest
- CVE-2020-37139Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of ServiceOdin-Secure-Ftp-Expert Odin Secure FTP Expert
- CVE-2020-37136ZOC Terminal v7.25.5 - 'Private key file' Denial of ServiceEmTec ZOC Terminal
- CVE-2020-37134UltraVNC Viewer 1.2.4.0 - 'VNCServer' Denial of ServiceUltraVNC Team UltraVNC Viewer
- CVE-2020-37133UltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of ServiceUltraVNC Team UltraVNC Launcher
- CVE-2020-37132UltraVNC Launcher 1.2.4.0 - 'Password' Denial of ServiceUltraVNC Team UltraVNC Launcher
- CVE-2020-37131Product Key Explorer 4.2.2.0 - 'Key' Denial of ServiceNsauditor Product Key Explorer
- CVE-2020-37130Nsauditor 3.2.0.0 - 'Name' Denial of ServiceNsauditor
- CVE-2020-37128ZOC Terminal 7.25.5 - 'Script' Denial of ServiceEmTec ZOC Terminal
- CVE-2020-37127dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Servicednsmasq-utils
- CVE-2020-37121CODE::BLOCKS 16.01 - Buffer Overflow (SEH) UNICODECode::Blocks
- CVE-2020-37118P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)P5 FNIP-8x16A
- CVE-2025-14150IBM webMethods Integration Sever is affected byIBM webMethods Integration (on prem) - Integration Server
- CVE-2025-13491IBM App Connect Enterprise Certified Container Information DisclosureIBM App Connect Enterprise Certified Container
- CVE-2026-1927GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_csswpsoul Greenshift – animation and page builder blocks
- CVE-2026-1517iomad Company Admin Block sql injectioniomad
- CVE-2026-1966YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UIYugabyteDB Anywhere
- CVE-2026-23796Session Fixation in Quick.CartOpenSolution Quick.Cart
- CVE-2026-23797Plaintext password display in Quick.CartOpenSolution Quick.Cart
- CVE-2026-1654Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']pkthree Peter’s Date Countdown
- CVE-2026-1271ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modificationmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2025-14079ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Updateelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-13416ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspensionmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-1319Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Fieldthemeisle Robin Image Optimizer – Unlimited Image Optimizat…
- CVE-2026-25198web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability.web2py
- CVE-2025-10258A time-based SQL Injection vulnerability in Infinera DNANokia Infinera DNA
- CVE-2026-1268Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Fieldbrechtvds Dynamic Widget Content
- CVE-2026-0867Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodescatchthemes Essential Widgets
- CVE-2026-1246ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' ParameterShortPixel Image Optimizer – Optimize Images, Convert WebP…
- CVE-2026-1898WeKan LDAP User Sync syncUser.js SyncLDAPBleed access controlWeKan
- CVE-2026-1897WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorizationWeKan
- CVE-2025-68643Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter.
- CVE-2025-69619A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
- CVE-2025-70791Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.microweber/microweber
- CVE-2025-70792Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.microweber/microweber