CVEs published February 7, 2026
62 CVEs were published on February 7, 2026: 1 critical, 14 high.
- Published
- 62
- Critical
- 1
- High
- 14
- Medium
- 47
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- WeKan
- 10
- yeqifu warehouse
- 8
- boldthemes Bold Page Builder
- 4
- itsourcecode Society Management System
- 4
- D-Link DIR-823X
- 3
- SourceCodester Online Class Record System
- 3
- jsbroks COCO Annotator
- 2
- simonfairbairn The Bucketlister
- 2
- UTT HiPER
- 2
- alexdtn Subitem AL Slider
- 1
Critical 1
High 14
- CVE-2026-25859WeKan < 8.20 Migration Functionality Insufficient Permission ChecksWeKan
- CVE-2026-25568WeKan < 8.19 allowPrivateOnly Setting Enforcement BypassWeKan
- CVE-2026-25566WeKan < 8.19 Cross-board Card Move Without Destination AuthorizationWeKan
- CVE-2026-25565WeKan < 8.19 Read-only Board Roles Can Update CardsWeKan
- CVE-2026-25564WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationWeKan
- CVE-2026-25563WeKan < 8.19 Checklist Creation Cross-Board IDORWeKan
- CVE-2026-25561WeKan < 8.19 Attachment Upload Object Relationship Validation BypassWeKan
- CVE-2026-25560WeKan < 8.19 LDAP Authentication Filter InjectionWeKan
- CVE-2026-25857Tenda G300-F Command Injection via formSetWanDiagShenzhen Tenda Technology Tenda G300-F
- CVE-2026-2086UTT HiPER 810G Management formFireWall strcpy buffer overflowUTT HiPER
- CVE-2026-2085D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injectionD-Link DWR-M921
- CVE-2026-2084D-Link DIR-823X set_language os command injectionD-Link DIR-823X
- CVE-2026-2080UTT HiPER 810 formUser setSysAdm command injectionUTT HiPER
- CVE-2026-2071UTT 进取 520W formP2PLimitConfig strcpy buffer overflowUTT 进取
Medium, low and unrated 47
- CVE-2026-2117itsourcecode Society Management System edit_activity.php sql injectionitsourcecode Society Management System
- CVE-2026-2116itsourcecode Society Management System edit_expenses.php sql injectionitsourcecode Society Management System
- CVE-2026-2115itsourcecode Society Management System delete_expenses.php sql injectionitsourcecode Society Management System
- CVE-2026-2114itsourcecode Society Management System edit_admin.php sql injectionitsourcecode Society Management System
- CVE-2026-25567WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorIdWeKan
- CVE-2026-25562WeKan < 8.19 Attachments Publication Information DisclosureWeKan
- CVE-2025-15564Mapnik value.cpp operator divide by zeroMapnik
- CVE-2026-2113yuan1994 tpadmin WebUploader preview.php deserializationyuan1994 tpadmin
- CVE-2026-2111JeecgBoot Retrieval-Augmented Generation edit path traversalJeecgBoot
- CVE-2026-2110Tasin1025 SwiftBuy login.php excessive authenticationTasin1025 SwiftBuy
- CVE-2026-2109jsbroks COCO Annotator Delete Category undo improper authorizationjsbroks COCO Annotator
- CVE-2026-2108jsbroks COCO Annotator Endpoint long_task denial of servicejsbroks COCO Annotator
- CVE-2026-2107yeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorizationyeqifu warehouse
- CVE-2026-2106yeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorizationyeqifu warehouse
- CVE-2026-2105yeqifu warehouse Department Management DeptController.java deleteDept improper authorizationyeqifu warehouse
- CVE-2026-2090SourceCodester Online Class Record System search.php sql injectionSourceCodester Online Class Record System
- CVE-2026-2089SourceCodester Online Class Record System controller.php sql injectionSourceCodester Online Class Record System
- CVE-2026-2088PHPGurukul Beauty Parlour Management System accepted-appointment.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2026-2087SourceCodester Online Class Record System login.php sql injectionSourceCodester Online Class Record System
- CVE-2026-2083code-projects Social Networking Site delete_post.php sql injectioncode-projects Social Networking Site
- CVE-2026-2082D-Link DIR-823X set_mac_clone os command injectionD-Link DIR-823X
- CVE-2026-2081D-Link DIR-823X set_password os command injectionD-Link DIR-823X
- CVE-2026-2079yeqifu warehouse Menu Management MenuController.java deleteMenu improper authorizationyeqifu warehouse
- CVE-2025-15476The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modificationsimonfairbairn The Bucketlister
- CVE-2025-15477The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributessimonfairbairn The Bucketlister
- CVE-2026-1573OMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeomi-mexico OMIGO
- CVE-2026-1613Wonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemrlister1 Wonka Slide
- CVE-2026-1611Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodejmrukkers Wikiloops Track Player
- CVE-2026-1082TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Updatearkapravamajumder TITLE ANIMATOR
- CVE-2026-0555Premmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX EndpointPremmerce
- CVE-2026-1608Video Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetigor4eg Video Onclick
- CVE-2026-1634Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']alexdtn Subitem AL Slider
- CVE-2026-1675Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Keybrstefanovic Advanced Country Blocker
- CVE-2026-1643MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scriptingariagle MP-Ukagaka
- CVE-2026-1570Simple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedannycarlton Simple Bible Verse via Shortcode
- CVE-2026-2078yeqifu warehouse Permission Management PermissionController.java deletePermission improper authorizationyeqifu warehouse
- CVE-2026-2077yeqifu warehouse Role Management RoleController.java deleteRole improper authorizationyeqifu warehouse
- CVE-2026-2076yeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorizationyeqifu warehouse
- CVE-2025-15491Post Slides <= 1.0.1 - Contributor+ Local File InclusionPost Slides
- CVE-2025-12159Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeboldthemes Bold Page Builder
- CVE-2025-13463Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Gridboldthemes Bold Page Builder
- CVE-2025-12803Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcodeboldthemes Bold Page Builder
- CVE-2025-15267Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcodeboldthemes Bold Page Builder
- CVE-2026-2075yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access controlyeqifu warehouse
- CVE-2026-2074O2OA HTTP POST Request check xml external entity referenceO2OA
- CVE-2026-2073itsourcecode School Management System index.php sql injectionitsourcecode School Management System
- CVE-2025-31990HCL DevOps Velocity is susceptible to a Denial of Service vulnerabilityHCLSoftware HCL DevOps Velocity