# CVEs published 2026-02-07

62 CVEs were published on February 7, 2026: 1 critical, 14 high. Days are UTC.

- [CVE-2026-2117](https://cve.now/CVE-2026-2117.md): itsourcecode Society Management System edit\_activity.php sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2026-2116](https://cve.now/CVE-2026-2116.md): itsourcecode Society Management System edit\_expenses.php sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2026-2115](https://cve.now/CVE-2026-2115.md): itsourcecode Society Management System delete\_expenses.php sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2026-2114](https://cve.now/CVE-2026-2114.md): itsourcecode Society Management System edit\_admin.php sql injection (CVSS 6.9, itsourcecode Society Management System)
- [CVE-2026-25859](https://cve.now/CVE-2026-25859.md): WeKan \< 8.20 Migration Functionality Insufficient Permission Checks (CVSS 7.1, WeKan)
- [CVE-2026-25568](https://cve.now/CVE-2026-25568.md): WeKan \< 8.19 allowPrivateOnly Setting Enforcement Bypass (CVSS 7.1, WeKan)
- [CVE-2026-25567](https://cve.now/CVE-2026-25567.md): WeKan \< 8.19 Card Comment Author Spoofing via User-controlled authorId (CVSS 5.3, WeKan)
- [CVE-2026-25566](https://cve.now/CVE-2026-25566.md): WeKan \< 8.19 Cross-board Card Move Without Destination Authorization (CVSS 7.1, WeKan)
- [CVE-2026-25565](https://cve.now/CVE-2026-25565.md): WeKan \< 8.19 Read-only Board Roles Can Update Cards (CVSS 7.1, WeKan)
- [CVE-2026-25564](https://cve.now/CVE-2026-25564.md): WeKan \< 8.19 Checklist Deletion IDOR via Missing Relationship Validation (CVSS 7.1, WeKan)
- [CVE-2026-25563](https://cve.now/CVE-2026-25563.md): WeKan \< 8.19 Checklist Creation Cross-Board IDOR (CVSS 7.1, WeKan)
- [CVE-2026-25562](https://cve.now/CVE-2026-25562.md): WeKan \< 8.19 Attachments Publication Information Disclosure (CVSS 5.3, WeKan)
- [CVE-2026-25561](https://cve.now/CVE-2026-25561.md): WeKan \< 8.19 Attachment Upload Object Relationship Validation Bypass (CVSS 7.1, WeKan)
- [CVE-2026-25560](https://cve.now/CVE-2026-25560.md): WeKan \< 8.19 LDAP Authentication Filter Injection (CVSS 8.7, WeKan)
- [CVE-2026-25858](https://cve.now/CVE-2026-25858.md): macrozheng mall \<= 1.0.3 Unauthenticated Password Reset via OTP Disclosure (CVSS 9.3, macrozheng mall)
- [CVE-2026-25857](https://cve.now/CVE-2026-25857.md): Tenda G300-F Command Injection via formSetWanDiag (CVSS 8.6, Shenzhen Tenda Technology Tenda G300-F)
- [CVE-2025-15564](https://cve.now/CVE-2025-15564.md): Mapnik value.cpp operator divide by zero (CVSS 4.8, Mapnik)
- [CVE-2026-2113](https://cve.now/CVE-2026-2113.md): yuan1994 tpadmin WebUploader preview.php deserialization (CVSS 6.9, yuan1994 tpadmin)
- [CVE-2026-2111](https://cve.now/CVE-2026-2111.md): JeecgBoot Retrieval-Augmented Generation edit path traversal (CVSS 5.3, JeecgBoot)
- [CVE-2026-2110](https://cve.now/CVE-2026-2110.md): Tasin1025 SwiftBuy login.php excessive authentication (CVSS 6.3, Tasin1025 SwiftBuy)
- [CVE-2026-2109](https://cve.now/CVE-2026-2109.md): jsbroks COCO Annotator Delete Category undo improper authorization (CVSS 5.3, jsbroks COCO Annotator)
- [CVE-2026-2108](https://cve.now/CVE-2026-2108.md): jsbroks COCO Annotator Endpoint long\_task denial of service (CVSS 6.9, jsbroks COCO Annotator)
- [CVE-2026-2107](https://cve.now/CVE-2026-2107.md): yeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2106](https://cve.now/CVE-2026-2106.md): yeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2105](https://cve.now/CVE-2026-2105.md): yeqifu warehouse Department Management DeptController.java deleteDept improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2090](https://cve.now/CVE-2026-2090.md): SourceCodester Online Class Record System search.php sql injection (CVSS 6.9, SourceCodester Online Class Record System)
- [CVE-2026-2089](https://cve.now/CVE-2026-2089.md): SourceCodester Online Class Record System controller.php sql injection (CVSS 6.9, SourceCodester Online Class Record System)
- [CVE-2026-2088](https://cve.now/CVE-2026-2088.md): PHPGurukul Beauty Parlour Management System accepted-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2026-2087](https://cve.now/CVE-2026-2087.md): SourceCodester Online Class Record System login.php sql injection (CVSS 6.9, SourceCodester Online Class Record System)
- [CVE-2026-2086](https://cve.now/CVE-2026-2086.md): UTT HiPER 810G Management formFireWall strcpy buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2026-2085](https://cve.now/CVE-2026-2085.md): D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub\_419F20 command injection (CVSS 8.6, D-Link DWR-M921)
- [CVE-2026-2084](https://cve.now/CVE-2026-2084.md): D-Link DIR-823X set\_language os command injection (CVSS 8.6, D-Link DIR-823X)
- [CVE-2026-2083](https://cve.now/CVE-2026-2083.md): code-projects Social Networking Site delete\_post.php sql injection (CVSS 6.9, code-projects Social Networking Site)
- [CVE-2026-2082](https://cve.now/CVE-2026-2082.md): D-Link DIR-823X set\_mac\_clone os command injection (CVSS 5.1, D-Link DIR-823X)
- [CVE-2026-2081](https://cve.now/CVE-2026-2081.md): D-Link DIR-823X set\_password os command injection (CVSS 5.1, D-Link DIR-823X)
- [CVE-2026-2080](https://cve.now/CVE-2026-2080.md): UTT HiPER 810 formUser setSysAdm command injection (CVSS 8.6, UTT HiPER)
- [CVE-2026-2079](https://cve.now/CVE-2026-2079.md): yeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2025-15476](https://cve.now/CVE-2025-15476.md): The Bucketlister \<= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification (CVSS 4.3, simonfairbairn The Bucketlister)
- [CVE-2025-15477](https://cve.now/CVE-2025-15477.md): The Bucketlister \<= 0.1.5 - Authenticated (Contributor+) SQL Injection via \`category\` and \`id\` Shortcode Attributes (CVSS 6.5, simonfairbairn The Bucketlister)
- [CVE-2026-1573](https://cve.now/CVE-2026-1573.md): OMIGO \<= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, omi-mexico OMIGO)
- [CVE-2026-1613](https://cve.now/CVE-2026-1613.md): Wonka Slide \<= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, mrlister1 Wonka Slide)
- [CVE-2026-1611](https://cve.now/CVE-2026-1611.md): Wikiloops Track Player \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, jmrukkers Wikiloops Track Player)
- [CVE-2026-1082](https://cve.now/CVE-2026-1082.md): TITLE ANIMATOR \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, arkapravamajumder TITLE ANIMATOR)
- [CVE-2026-0555](https://cve.now/CVE-2026-0555.md): Premmerce \<= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce\_wizard\_actions' AJAX Endpoint (CVSS 6.4, Premmerce)
- [CVE-2026-1608](https://cve.now/CVE-2026-1608.md): Video Onclick \<= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, tigor4eg Video Onclick)
- [CVE-2026-1634](https://cve.now/CVE-2026-1634.md): Subitem AL Slider \<= 1.0.0 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, alexdtn Subitem AL Slider)
- [CVE-2026-1675](https://cve.now/CVE-2026-1675.md): Advanced Country Blocker \<= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key (CVSS 5.3, brstefanovic Advanced Country Blocker)
- [CVE-2026-1643](https://cve.now/CVE-2026-1643.md): MP-Ukagaka \<= 1.5.2 - Reflected Cross-Site Scripting (CVSS 6.1, ariagle MP-Ukagaka)
- [CVE-2026-1570](https://cve.now/CVE-2026-1570.md): Simple Bible Verse via Shortcode \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, dannycarlton Simple Bible Verse via Shortcode)
- [CVE-2026-2078](https://cve.now/CVE-2026-2078.md): yeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2077](https://cve.now/CVE-2026-2077.md): yeqifu warehouse Role Management RoleController.java deleteRole improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2076](https://cve.now/CVE-2026-2076.md): yeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization (CVSS 5.3, yeqifu warehouse)
- [CVE-2025-15491](https://cve.now/CVE-2025-15491.md): Post Slides \<= 1.0.1 - Contributor+ Local File Inclusion (CVSS 5.5, Post Slides)
- [CVE-2025-12159](https://cve.now/CVE-2025-12159.md): Bold Page Builder \<= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2025-13463](https://cve.now/CVE-2025-13463.md): Bold Page Builder \<= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2025-12803](https://cve.now/CVE-2025-12803.md): Bold Builder \<= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_tabs Shortcode (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2025-15267](https://cve.now/CVE-2025-15267.md): Bold Page Builder \<= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_accordion\_item Shortcode (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2026-2075](https://cve.now/CVE-2026-2075.md): yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-2074](https://cve.now/CVE-2026-2074.md): O2OA HTTP POST Request check xml external entity reference (CVSS 5.3, O2OA)
- [CVE-2026-2073](https://cve.now/CVE-2026-2073.md): itsourcecode School Management System index.php sql injection (CVSS 6.9, itsourcecode School Management System)
- [CVE-2025-31990](https://cve.now/CVE-2025-31990.md): HCL DevOps Velocity is susceptible to a Denial of Service vulnerability (CVSS 6.8, HCLSoftware HCL DevOps Velocity)
- [CVE-2026-2071](https://cve.now/CVE-2026-2071.md): UTT 进取 520W formP2PLimitConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.