# CVEs published 2026-02-05

117 CVEs were published on February 5, 2026: 6 critical, 33 high. Days are UTC.

- [CVE-2026-23623](https://cve.now/CVE-2026-23623.md): Collabora Online vulnerable to Authorization Bypass (CVSS 5.3, CollaboraOnline online)
- [CVE-2025-68157](https://cve.now/CVE-2025-68157.md): webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects (CVSS 3.7, webpack)
- [CVE-2025-68458](https://cve.now/CVE-2025-68458.md): webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior (CVSS 3.7, webpack)
- [CVE-2025-32393](https://cve.now/CVE-2025-32393.md): AutoGPT has a DoS vulnerability in ReadRSSFeedBlock (CVSS 8.7, Significant-Gravitas AutoGPT)
- [CVE-2026-0391](https://cve.now/CVE-2026-0391.md): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-24300](https://cve.now/CVE-2026-24300.md): Azure Front Door Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Azure Front Door)
- [CVE-2026-21532](https://cve.now/CVE-2026-21532.md): Azure Function Information Disclosure Vulnerability (CVSS 8.2, Microsoft Azure Functions)
- [CVE-2026-24302](https://cve.now/CVE-2026-24302.md): Azure Arc Elevation of Privilege Vulnerability (CVSS 8.6, Microsoft Azure ARC)
- [CVE-2026-1970](https://cve.now/CVE-2026-1970.md): Edimax BR-6258n formStaDrvSetup redirect (CVSS 5.1, Edimax BR-6258n)
- [CVE-2026-1964](https://cve.now/CVE-2026-1964.md): WeKan REST Endpoint boards.js BoardTitleRESTBleed access control (CVSS 5.3, WeKan)
- [CVE-2026-25815](https://cve.now/CVE-2026-25815.md): Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild f (CVSS 3.2, Fortinet FortiOS)
- [CVE-2026-1963](https://cve.now/CVE-2026-1963.md): WeKan Attachment Storage attachments.js MoveStorageBleed access control (CVSS 5.3, WeKan)
- [CVE-2026-1962](https://cve.now/CVE-2026-1962.md): WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control (CVSS 5.3, WeKan)
- [CVE-2026-0106](https://cve.now/CVE-2026-0106.md): In vpu\_mmap of vpu\_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. (CVSS 9.3, Google Android)
- [CVE-2025-12131](https://cve.now/CVE-2025-12131.md): Truncated 802.15.4 packet leads to denial of service (CVSS 5.3, silabs.com EmberZNet SDK)
- [CVE-2026-1301](https://cve.now/CVE-2026-1301.md): Out-of-bounds Write in o6 Automation GmbH Open62541 (CVSS 6.8, o6 Automation Open62541)
- [CVE-2025-15311](https://cve.now/CVE-2025-15311.md): Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. (CVSS 7.8, Tanium Appliance)
- [CVE-2025-15312](https://cve.now/CVE-2025-15312.md): Tanium addressed an improper output sanitization vulnerability in TanOS. (CVSS 6.6, Tanium Appliance)
- [CVE-2025-15324](https://cve.now/CVE-2025-15324.md): Tanium addressed a local privilege escalation vulnerability in Engage. (CVSS 6.6, Tanium Engage)
- [CVE-2025-15325](https://cve.now/CVE-2025-15325.md): Tanium addressed an improper input validation vulnerability in Discover. (CVSS 6.3, Tanium Discover)
- [CVE-2025-15326](https://cve.now/CVE-2025-15326.md): Tanium addressed an improper access controls vulnerability in Patch. (CVSS 4.3, Tanium Patch)
- [CVE-2025-15327](https://cve.now/CVE-2025-15327.md): Tanium addressed an improper access controls vulnerability in Deploy. (CVSS 4.3, Tanium Deploy)
- [CVE-2025-15328](https://cve.now/CVE-2025-15328.md): Tanium addressed an improper link resolution before file access vulnerability in Enforce. (CVSS 5.0, Tanium Enforce)
- [CVE-2025-15330](https://cve.now/CVE-2025-15330.md): Tanium addressed an improper input validation vulnerability in Deploy. (CVSS 8.8, Tanium Deploy)
- [CVE-2025-15331](https://cve.now/CVE-2025-15331.md): Tanium addressed an uncontrolled resource consumption vulnerability in Connect. (CVSS 4.3, Tanium Connect)
- [CVE-2025-15329](https://cve.now/CVE-2025-15329.md): Tanium addressed an information disclosure vulnerability in Threat Response. (CVSS 4.9, Tanium Threat Response)
- [CVE-2025-15332](https://cve.now/CVE-2025-15332.md): Tanium addressed an information disclosure vulnerability in Threat Response. (CVSS 4.9, Tanium Threat Response)
- [CVE-2025-15321](https://cve.now/CVE-2025-15321.md): Tanium addressed an improper input validation vulnerability in Tanium Appliance. (CVSS 2.7, Tanium Appliance)
- [CVE-2025-15333](https://cve.now/CVE-2025-15333.md): Tanium addressed an information disclosure vulnerability in Threat Response. (CVSS 4.3, Tanium Threat Response)
- [CVE-2025-15334](https://cve.now/CVE-2025-15334.md): Tanium addressed an information disclosure vulnerability in Threat Response. (CVSS 4.3, Tanium Threat Response)
- [CVE-2025-15335](https://cve.now/CVE-2025-15335.md): Tanium addressed an information disclosure vulnerability in Threat Response. (CVSS 4.3, Tanium Threat Response)
- [CVE-2025-15341](https://cve.now/CVE-2025-15341.md): Tanium addressed an incorrect default permissions vulnerability in Benchmark. (CVSS 6.5, Tanium Benchmark)
- [CVE-2025-15339](https://cve.now/CVE-2025-15339.md): Tanium addressed an incorrect default permissions vulnerability in Discover. (CVSS 6.5, Tanium Discover)
- [CVE-2025-15340](https://cve.now/CVE-2025-15340.md): Tanium addressed an incorrect default permissions vulnerability in Comply. (CVSS 6.5, Tanium Comply)
- [CVE-2025-15338](https://cve.now/CVE-2025-15338.md): Tanium addressed an incorrect default permissions vulnerability in Partner Integration. (CVSS 6.5, Tanium Partner Integration)
- [CVE-2025-15336](https://cve.now/CVE-2025-15336.md): Tanium addressed an incorrect default permissions vulnerability in Performance. (CVSS 6.5, Tanium Performance)
- [CVE-2025-15337](https://cve.now/CVE-2025-15337.md): Tanium addressed an incorrect default permissions vulnerability in Patch. (CVSS 6.5, Tanium Patch)
- [CVE-2025-15342](https://cve.now/CVE-2025-15342.md): Tanium addressed an improper access controls vulnerability in Reputation. (CVSS 4.3, Tanium Reputation)
- [CVE-2025-15323](https://cve.now/CVE-2025-15323.md): Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. (CVSS 3.7, Tanium Appliance)
- [CVE-2025-15343](https://cve.now/CVE-2025-15343.md): Tanium addressed an incorrect default permissions vulnerability in Enforce. (CVSS 6.5, Tanium Enforce)
- [CVE-2025-15289](https://cve.now/CVE-2025-15289.md): Tanium addressed an improper access controls vulnerability in Interact. (CVSS 3.1, Tanium Interact)
- [CVE-2025-58190](https://cve.now/CVE-2025-58190.md): Infinite parsing loop in golang.org/x/net (CVSS 5.3, golang.org/x/net/html · golang.org/x/net)
- [CVE-2025-47911](https://cve.now/CVE-2025-47911.md): Quadratic parsing complexity in golang.org/x/net/html (CVSS 5.3, golang.org/x/net/html · golang.org/x/net)
- [CVE-2025-68121](https://cve.now/CVE-2025-68121.md): Unexpected session resumption in crypto/tls (CVSS 9.1, Go standard library crypto/tls · stdlib)
- [CVE-2025-15557](https://cve.now/CVE-2025-15557.md): Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack (CVSS 7.5, TP-Link Systems Tapo H100 · TP-Link Systems Tapo P100)
- [CVE-2026-1707](https://cve.now/CVE-2026-1707.md): Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) (CVSS 7.4, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-15551](https://cve.now/CVE-2025-15551.md): LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N (CVSS 5.9, TP-Link Systems Archer MR200 · TP-Link Systems Archer C20 +2)
- [CVE-2026-0715](https://cve.now/CVE-2026-0715.md): Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. (CVSS 7.0, Moxa UC-1200A Series)
- [CVE-2026-0714](https://cve.now/CVE-2026-0714.md): A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Li (CVSS 7.0, Moxa UC-1200A Series)
- [CVE-2020-37148](https://cve.now/CVE-2020-37148.md): P5 FNIP-8x16A/FNIP-4xSH 1.0.20, 1.0.11 - Stored Cross-Site Scripting (XSS) (CVSS 5.1, P5 FNIP-8x16A · P5 FNIP-4xSH)
- [CVE-2020-37152](https://cve.now/CVE-2020-37152.md): PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS) (CVSS 5.1, PHP-Fusion)
- [CVE-2020-37150](https://cve.now/CVE-2020-37150.md): Edimax Technology EW-7438RPn-v3 Mini 1.27 - Unauthorized Access: Wi-Fi Password Disclosure (CVSS 8.7, EDIMAX Technology EW-7438RPn-v3 Mini)
- [CVE-2020-37149](https://cve.now/CVE-2020-37149.md): Edimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command Execution (CVSS 5.1, EDIMAX Technology EW-7438RPn Mini)
- [CVE-2020-37145](https://cve.now/CVE-2020-37145.md): HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin) (CVSS 5.1, HRSALE)
- [CVE-2020-37144](https://cve.now/CVE-2020-37144.md): Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin) (CVSS 5.1, Exagate Sysguard)
- [CVE-2020-37143](https://cve.now/CVE-2020-37143.md): ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (CVSS 4.6, GE Intelligent Platforms ProficySCADA for iOS)
- [CVE-2020-37142](https://cve.now/CVE-2020-37142.md): 10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH) (CVSS 8.4, 10-Strike Software Network Inventory Explorer)
- [CVE-2020-37140](https://cve.now/CVE-2020-37140.md): Everest 5.50.2100 - 'Open File' Denial of Service (CVSS 4.6, FinalWire Everest)
- [CVE-2020-37139](https://cve.now/CVE-2020-37139.md): Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (CVSS 4.6, Odin-Secure-Ftp-Expert Odin Secure FTP Expert)
- [CVE-2020-37138](https://cve.now/CVE-2020-37138.md): 10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP) (CVSS 8.4, 10-Strike Software Network Inventory Explorer)
- [CVE-2020-37137](https://cve.now/CVE-2020-37137.md): PHP-Fusion 9.03.50 - 'panels.php' Eval Injection (CVSS 8.6, PHP Fusion)
- [CVE-2020-37136](https://cve.now/CVE-2020-37136.md): ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (CVSS 6.7, EmTec ZOC Terminal)
- [CVE-2020-37134](https://cve.now/CVE-2020-37134.md): UltraVNC Viewer 1.2.4.0 - 'VNCServer' Denial of Service (CVSS 4.6, UltraVNC Team UltraVNC Viewer)
- [CVE-2020-37133](https://cve.now/CVE-2020-37133.md): UltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of Service (CVSS 6.7, UltraVNC Team UltraVNC Launcher)
- [CVE-2020-37132](https://cve.now/CVE-2020-37132.md): UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service (CVSS 6.7, UltraVNC Team UltraVNC Launcher)
- [CVE-2020-37131](https://cve.now/CVE-2020-37131.md): Product Key Explorer 4.2.2.0 - 'Key' Denial of Service (CVSS 6.7, Nsauditor Product Key Explorer)
- [CVE-2020-37130](https://cve.now/CVE-2020-37130.md): Nsauditor 3.2.0.0 - 'Name' Denial of Service (CVSS 6.7, Nsauditor)
- [CVE-2020-37129](https://cve.now/CVE-2020-37129.md): Memu Play 7.1.3 - Insecure Folder Permissions (CVSS 8.5, Microvirt Memu Play)
- [CVE-2020-37128](https://cve.now/CVE-2020-37128.md): ZOC Terminal 7.25.5 - 'Script' Denial of Service (CVSS 6.7, EmTec ZOC Terminal)
- [CVE-2020-37127](https://cve.now/CVE-2020-37127.md): dnsmasq-utils 2.79-1 - 'dhcp\_release' Denial of Service (CVSS 6.9, dnsmasq-utils)
- [CVE-2020-37126](https://cve.now/CVE-2020-37126.md): Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH) (CVSS 8.4, Drive Software Company Free Desktop Clock)
- [CVE-2020-37125](https://cve.now/CVE-2020-37125.md): Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution (CVSS 9.3, EDIMAX Technology EW-7438RPn Mini)
- [CVE-2020-37124](https://cve.now/CVE-2020-37124.md): B64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter) (CVSS 8.4, 4Mhz B64dec)
- [CVE-2020-37123](https://cve.now/CVE-2020-37123.md): Pinger 1.0 - Remote Code Execution (CVSS 9.3, wcchandler Pinger)
- [CVE-2020-37121](https://cve.now/CVE-2020-37121.md): CODE::BLOCKS 16.01 - Buffer Overflow (SEH) UNICODE (CVSS 6.7, Code::Blocks)
- [CVE-2020-37120](https://cve.now/CVE-2020-37120.md): Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH) (CVSS 8.4, Rubo Medical Imaging Rubo DICOM Viewer)
- [CVE-2020-37119](https://cve.now/CVE-2020-37119.md): Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite)) (CVSS 8.4, Nsasoft Nsauditor)
- [CVE-2020-37118](https://cve.now/CVE-2020-37118.md): P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin) (CVSS 5.1, P5 FNIP-8x16A)
- [CVE-2020-37117](https://cve.now/CVE-2020-37117.md): jizhiCMS 1.6.7 - Arbitrary File Download (CVSS 8.6, jizhiCMS)
- [CVE-2020-37151](https://cve.now/CVE-2020-37151.md): phpMyChat Plus 1.98 'deluser.php' SQL Injection (CVSS 8.8, Ciprianmp phpMyChat Plus)
- [CVE-2025-14150](https://cve.now/CVE-2025-14150.md): IBM webMethods Integration Sever is affected by (CVSS 6.5, IBM webMethods Integration (on prem) - Integration Server)
- [CVE-2025-13491](https://cve.now/CVE-2025-13491.md): IBM App Connect Enterprise Certified Container Information Disclosure (CVSS 5.1, IBM App Connect Enterprise Certified Container)
- [CVE-2025-13379](https://cve.now/CVE-2025-13379.md): A SQL Injection vulnerability has been addressed in IBM Aspera Console (CVSS 8.6, IBM Aspera Console)
- [CVE-2026-1927](https://cve.now/CVE-2026-1927.md): GreenShift - Animation and Page Builder Blocks \<= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom\_css (CVSS 5.4, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-1523](https://cve.now/CVE-2026-1523.md): Path Traversal in Digitek from Grupo Azkoyen (CVSS 8.7, PRIMION DIGITEK Digitek ADT1100 · PRIMION DIGITEK Digitek D…)
- [CVE-2026-1517](https://cve.now/CVE-2026-1517.md): iomad Company Admin Block sql injection (CVSS 5.1, iomad)
- [CVE-2026-23572](https://cve.now/CVE-2026-23572.md): Improper Access Control in TeamViewer clients (CVSS 7.2, TeamViewer Remote · TeamViewer Tensor +1)
- [CVE-2026-1966](https://cve.now/CVE-2026-1966.md): YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI (CVSS 2.4, YugabyteDB Anywhere)
- [CVE-2026-23796](https://cve.now/CVE-2026-23796.md): Session Fixation in Quick.Cart (CVSS 4.8, OpenSolution Quick.Cart)
- [CVE-2026-23797](https://cve.now/CVE-2026-23797.md): Plaintext password display in Quick.Cart (CVSS 6.9, OpenSolution Quick.Cart)
- [CVE-2026-1654](https://cve.now/CVE-2026-1654.md): Peter's Date Countdown \<= 2.0.0 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, pkthree Peter’s Date Countdown)
- [CVE-2026-1294](https://cve.now/CVE-2026-1294.md): All In One Image Viewer Block \<= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint (CVSS 7.2, bplugins All In One Image Viewer Block – Gutenberg block to…)
- [CVE-2026-1271](https://cve.now/CVE-2026-1271.md): ProfileGrid \<= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification (CVSS 5.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2025-14079](https://cve.now/CVE-2025-14079.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 5.3, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2025-13416](https://cve.now/CVE-2025-13416.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2026-1319](https://cve.now/CVE-2026-1319.md): Robin Image Optimizer \<= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field (CVSS 6.4, themeisle Robin Image Optimizer – Unlimited Image Optimizat…)
- [CVE-2026-25198](https://cve.now/CVE-2026-25198.md): web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. (CVSS 4.7, web2py)
- [CVE-2025-10258](https://cve.now/CVE-2025-10258.md): A time-based SQL Injection vulnerability in Infinera DNA (CVSS 6.3, Nokia Infinera DNA)
- [CVE-2026-1268](https://cve.now/CVE-2026-1268.md): Dynamic Widget Content \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field (CVSS 6.4, brechtvds Dynamic Widget Content)
- [CVE-2026-0867](https://cve.now/CVE-2026-0867.md): Essential Widgets \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, catchthemes Essential Widgets)
- [CVE-2026-1246](https://cve.now/CVE-2026-1246.md): ShortPixel Image Optimizer \<= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter (CVSS 4.9, ShortPixel Image Optimizer – Optimize Images, Convert WebP…)
- [CVE-2026-1953](https://cve.now/CVE-2026-1953.md): Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2 (CVSS 8.2, Nukegraphic CMS)
- [CVE-2025-15080](https://cve.now/CVE-2025-15080.md): Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products (CVSS 8.8, Mitsubishi Electric MELSEC iQ-R Series R08PCPU · Mitsubi… +2)
- [CVE-2025-61732](https://cve.now/CVE-2025-61732.md): Potential code smuggling via doc comments in cmd/cgo (CVSS 8.6, Go toolchain cmd/cgo · toolchain)
- [CVE-2025-10314](https://cve.now/CVE-2025-10314.md): Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows (CVSS 8.8, Mitsubishi Electric FREQSHIP-mini for Windows)
- [CVE-2025-11730](https://cve.now/CVE-2025-11730.md): A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versi (CVSS 7.2, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2)
- [CVE-2026-1898](https://cve.now/CVE-2026-1898.md): WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control (CVSS 5.3, WeKan)
- [CVE-2026-1897](https://cve.now/CVE-2026-1897.md): WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization (CVSS 5.3, WeKan)
- [CVE-2025-68643](https://cve.now/CVE-2025-68643.md): Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. (CVSS 5.4)
- [CVE-2025-68721](https://cve.now/CVE-2025-68721.md): Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. (CVSS 8.1)
- [CVE-2025-68722](https://cve.now/CVE-2025-68722.md): Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin inter (CVSS 8.8)
- [CVE-2025-68723](https://cve.now/CVE-2025-68723.md): Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. (CVSS 9.0)
- [CVE-2025-69619](https://cve.now/CVE-2025-69619.md): A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage. (CVSS 5.5)
- [CVE-2025-69906](https://cve.now/CVE-2025-69906.md): Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. (CVSS 8.8)
- [CVE-2025-70073](https://cve.now/CVE-2025-70073.md): An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function (CVSS 7.2)
- [CVE-2025-70791](https://cve.now/CVE-2025-70791.md): Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. (CVSS 6.1, microweber/microweber)
- [CVE-2025-70792](https://cve.now/CVE-2025-70792.md): Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. (CVSS 6.1, microweber/microweber)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.