# CVEs published 2026-02-08 75 CVEs were published on February 8, 2026: 1 critical, 24 high. Days are UTC. - [CVE-2026-2195](https://cve.now/CVE-2026-2195.md): code-projects Online Reviewer System questions-view.php sql injection (CVSS 6.9, code-projects Online Reviewer System) - [CVE-2026-2194](https://cve.now/CVE-2026-2194.md): D-Link DI-7100G C1 start\_proxy\_client\_email command injection (CVSS 5.3, D-Link DI-7100G C1) - [CVE-2026-2193](https://cve.now/CVE-2026-2193.md): D-Link DI-7100G C1 set\_jhttpd\_info command injection (CVSS 5.3, D-Link DI-7100G C1) - [CVE-2026-2192](https://cve.now/CVE-2026-2192.md): Tenda AC9 formGetRebootTimer stack-based overflow (CVSS 8.6, Tenda AC9) - [CVE-2026-2191](https://cve.now/CVE-2026-2191.md): Tenda AC9 formGetDdosDefenceList stack-based overflow (CVSS 8.6, Tenda AC9) - [CVE-2026-2190](https://cve.now/CVE-2026-2190.md): itsourcecode School Management System controller.php sql injection (CVSS 6.9, itsourcecode School Management System) - [CVE-2026-2189](https://cve.now/CVE-2026-2189.md): itsourcecode School Management System index.php sql injection (CVSS 6.9, itsourcecode School Management System) - [CVE-2026-2188](https://cve.now/CVE-2026-2188.md): UTT 进取 521G formPdbUpConfig sub\_446B18 os command injection (CVSS 8.6, UTT 进取) - [CVE-2026-2187](https://cve.now/CVE-2026-2187.md): Tenda RX3 formSetQosBand set\_qosMib\_list stack-based overflow (CVSS 8.7, Tenda RX3) - [CVE-2026-2186](https://cve.now/CVE-2026-2186.md): Tenda RX3 SetIpMacBind fromSetIpMacBind stack-based overflow (CVSS 8.7, Tenda RX3) - [CVE-2026-2185](https://cve.now/CVE-2026-2185.md): Tenda RX3 MAC Filtering Configuration Endpoint setBlackRule set\_device\_name stack-based overflow (CVSS 8.7, Tenda RX3) - [CVE-2026-2184](https://cve.now/CVE-2026-2184.md): Great Developers Certificate Generation System csv.php os command injection (CVSS 6.9, Great Developers Certificate Generation System) - [CVE-2026-2183](https://cve.now/CVE-2026-2183.md): Great Developers Certificate Generation System csv.php unrestricted upload (CVSS 5.3, Great Developers Certificate Generation System) - [CVE-2026-2182](https://cve.now/CVE-2026-2182.md): UTT 进取 521G setSysAdm doSystem command injection (CVSS 8.6, UTT 进取) - [CVE-2026-2181](https://cve.now/CVE-2026-2181.md): Tenda RX3 openSchedWifi stack-based overflow (CVSS 8.7, Tenda RX3) - [CVE-2026-2180](https://cve.now/CVE-2026-2180.md): Tenda RX3 fast\_setting\_wifi\_set stack-based overflow (CVSS 8.7, Tenda RX3) - [CVE-2026-2179](https://cve.now/CVE-2026-2179.md): PHPGurukul Hospital Management System manage-users.php sql injection (CVSS 5.1, PHPGurukul Hospital Management System) - [CVE-2026-2178](https://cve.now/CVE-2026-2178.md): r-huijts xcode-mcp-server run\_lldb index.ts registerXcodeTools command injection (CVSS 5.3, r-huijts xcode-mcp-server · xcode-mcp-server) - [CVE-2026-2177](https://cve.now/CVE-2026-2177.md): SourceCodester Prison Management System Login session fixiation (CVSS 6.9, SourceCodester Prison Management System) - [CVE-2026-2176](https://cve.now/CVE-2026-2176.md): code-projects Contact Management System index.py sql injection (CVSS 5.3, code-projects Contact Management System) - [CVE-2026-2175](https://cve.now/CVE-2026-2175.md): D-Link DIR-823X set\_upnp sub\_420618 os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2026-2174](https://cve.now/CVE-2026-2174.md): code-projects Contact Management System CRUD Endpoint improper authentication (CVSS 6.9, code-projects Contact Management System) - [CVE-2026-2173](https://cve.now/CVE-2026-2173.md): code-projects Online Examination System login.php sql injection (CVSS 6.9, code-projects Online Examination System) - [CVE-2026-2172](https://cve.now/CVE-2026-2172.md): code-projects Online Application System for Admission Login Endpoint index.php sql injection (CVSS 6.9, code-projects Online Application System for Admission) - [CVE-2026-2171](https://cve.now/CVE-2026-2171.md): code-projects Online Student Management System Login accounts.php sql injection (CVSS 6.9, code-projects Online Student Management System) - [CVE-2026-2169](https://cve.now/CVE-2026-2169.md): D-Link DWR-M921 formLtefotaUpgradeFibocom command injection (CVSS 5.3, D-Link DWR-M921) - [CVE-2026-2168](https://cve.now/CVE-2026-2168.md): D-Link DWR-M921 formLtefotaUpgradeQuectel sub\_419920 command injection (CVSS 5.3, D-Link DWR-M921) - [CVE-2026-2167](https://cve.now/CVE-2026-2167.md): Totolink WA300 cstecgi.cgi setAPNetwork os command injection (CVSS 5.3, Totolink WA300) - [CVE-2026-2166](https://cve.now/CVE-2026-2166.md): code-projects Online Reviewer System Login index.php sql injection (CVSS 6.9, code-projects Online Reviewer System) - [CVE-2026-2165](https://cve.now/CVE-2026-2165.md): detronetdip E-commerce Account Creation Endpoint add\_seller.php missing authentication (CVSS 6.9, detronetdip E-commerce) - [CVE-2026-2164](https://cve.now/CVE-2026-2164.md): detronetdip E-commerce addadhar.php unrestricted upload (CVSS 6.9, detronetdip E-commerce) - [CVE-2026-2163](https://cve.now/CVE-2026-2163.md): D-Link DIR-600 ssdp.cgi command injection (CVSS 5.1, D-Link DIR-600) - [CVE-2026-2162](https://cve.now/CVE-2026-2162.md): itsourcecode News Portal Project aboutus.php sql injection (CVSS 5.1, itsourcecode News Portal Project) - [CVE-2026-2161](https://cve.now/CVE-2026-2161.md): itsourcecode Directory Management System forget-password.php sql injection (CVSS 6.9, itsourcecode Directory Management System) - [CVE-2026-2160](https://cve.now/CVE-2026-2160.md): SourceCodester Simple Responsive Tourism Website Master.php cross site scripting (CVSS 5.3, SourceCodester Simple Responsive Tourism Website) - [CVE-2026-2159](https://cve.now/CVE-2026-2159.md): SourceCodester Simple Responsive Tourism Website Registration Master.php cross site scripting (CVSS 5.3, SourceCodester Simple Responsive Tourism Website) - [CVE-2026-2158](https://cve.now/CVE-2026-2158.md): code-projects Student Web Portal check\_user.php sql injection (CVSS 6.9, code-projects Student Web Portal) - [CVE-2026-2157](https://cve.now/CVE-2026-2157.md): D-Link DIR-823X set\_static\_route\_table sub\_4175CC os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2026-2156](https://cve.now/CVE-2026-2156.md): code-projects Online Student Management System Announcement Management index.php cross site scripting (CVSS 4.8, code-projects Online Student Management System) - [CVE-2026-2155](https://cve.now/CVE-2026-2155.md): D-Link DIR-823X Configuration set\_dmz sub\_4208A0 os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2026-2154](https://cve.now/CVE-2026-2154.md): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System Patient Registration registration.php cross site scripting (CVSS 5.3, SourceCodester Patients Waiting Area Queue Management Syste…) - [CVE-2026-2153](https://cve.now/CVE-2026-2153.md): mwielgoszewski doorman views.py is\_safe\_url redirect (CVSS 5.3, mwielgoszewski doorman) - [CVE-2026-2152](https://cve.now/CVE-2026-2152.md): D-Link DIR-615 Web Configuration adv\_routing.php os command injection (CVSS 8.6, D-Link DIR-615) - [CVE-2026-2151](https://cve.now/CVE-2026-2151.md): D-Link DIR-615 DMZ Host Feature adv\_firewall.php os command injection (CVSS 8.6, D-Link DIR-615) - [CVE-2026-2150](https://cve.now/CVE-2026-2150.md): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scripting (CVSS 5.3, SourceCodester Patients Waiting Area Queue Management Syste…) - [CVE-2026-2149](https://cve.now/CVE-2026-2149.md): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scripting (CVSS 5.3, SourceCodester Patients Waiting Area Queue Management Syste…) - [CVE-2026-2148](https://cve.now/CVE-2026-2148.md): Tenda AC21 Web Management DownloadFlash information disclosure (CVSS 6.9, Tenda AC21) - [CVE-2026-2147](https://cve.now/CVE-2026-2147.md): Tenda AC21 Web Management DownloadLog information disclosure (CVSS 6.9, Tenda AC21) - [CVE-2026-2146](https://cve.now/CVE-2026-2146.md): guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload (CVSS 5.3, guchengwuyue yshopmall) - [CVE-2026-2145](https://cve.now/CVE-2026-2145.md): cym1102 nginxWebUI Web Management check cross site scripting (CVSS 5.1, cym1102 nginxWebUI) - [CVE-2026-2143](https://cve.now/CVE-2026-2143.md): D-Link DIR-823X DDNS Service set\_ddns os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2026-2142](https://cve.now/CVE-2026-2142.md): D-Link DIR-823X set\_qos sub\_420688 os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2026-2141](https://cve.now/CVE-2026-2141.md): WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization (CVSS 5.3, WuKongOpenSource WukongCRM) - [CVE-2026-2140](https://cve.now/CVE-2026-2140.md): Tenda TX9 setMacFilterCfg sub\_4223E0 buffer overflow (CVSS 8.7, Tenda TX9) - [CVE-2026-2139](https://cve.now/CVE-2026-2139.md): Tenda TX9 fast\_setting\_wifi\_set sub\_432580 buffer overflow (CVSS 8.7, Tenda TX9) - [CVE-2026-2138](https://cve.now/CVE-2026-2138.md): Tenda TX9 SetStaticRouteCfg sub\_42D03C buffer overflow (CVSS 8.7, Tenda TX9) - [CVE-2026-2137](https://cve.now/CVE-2026-2137.md): Tenda TX3 SetIpMacBind buffer overflow (CVSS 8.7, Tenda TX3) - [CVE-2026-2136](https://cve.now/CVE-2026-2136.md): projectworlds Online Food Ordering System view-ticket.php sql injection (CVSS 6.9, projectworlds Online Food Ordering System) - [CVE-2026-2135](https://cve.now/CVE-2026-2135.md): UTT HiPER 810 formPdbUpConfig sub\_43F020 command injection (CVSS 5.3, UTT HiPER) - [CVE-2026-2134](https://cve.now/CVE-2026-2134.md): PHPGurukul Hospital Management System manage-doctors.php sql injection (CVSS 5.1, PHPGurukul Hospital Management System) - [CVE-2026-2133](https://cve.now/CVE-2026-2133.md): code-projects Online Music Site AdminUpdateCategory.php unrestricted upload (CVSS 6.9, code-projects Online Music Site) - [CVE-2026-2132](https://cve.now/CVE-2026-2132.md): code-projects Online Music Site AdminUpdateCategory.php sql injection (CVSS 6.9, code-projects Online Music Site) - [CVE-2026-2131](https://cve.now/CVE-2026-2131.md): XixianLiang HarmonyOS-mcp-server input\_text os command injection (CVSS 5.3, XixianLiang HarmonyOS-mcp-server) - [CVE-2026-2130](https://cve.now/CVE-2026-2130.md): BurtTheCoder mcp-maigret search\_username index.ts command injection (CVSS 5.3, BurtTheCoder mcp-maigret · mcp-maigret) - [CVE-2026-2129](https://cve.now/CVE-2026-2129.md): D-Link DIR-823X set\_ac\_status os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2025-15100](https://cve.now/CVE-2025-15100.md): JAY Login & Register \<= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay\_panel\_ajax\_update\_profile (CVSS 8.8, jayarsiech JAY Login & Register) - [CVE-2025-15027](https://cve.now/CVE-2025-15027.md): JAY Login & Register \<= 2.6.03 - Unauthenticated Privilege Escalation via jay\_login\_register\_ajax\_create\_final\_user (CVSS 9.8, jayarsiech JAY Login & Register) - [CVE-2026-2209](https://cve.now/CVE-2026-2209.md): WeKan Custom Translation translationBody.js setCreateTranslation improper authorization (CVSS 5.3, WeKan) - [CVE-2026-2208](https://cve.now/CVE-2026-2208.md): WeKan Rules rules.js RulesBleed authorization (CVSS 5.3, WeKan) - [CVE-2026-2207](https://cve.now/CVE-2026-2207.md): WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure (CVSS 6.9, WeKan) - [CVE-2026-2206](https://cve.now/CVE-2026-2206.md): WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control (CVSS 5.3, WeKan) - [CVE-2026-2205](https://cve.now/CVE-2026-2205.md): WeKan Meteor Publication cards.js CardPubSubBleed information disclosure (CVSS 5.3, WeKan) - [CVE-2026-2122](https://cve.now/CVE-2026-2122.md): Xiaopi Panel WAF Firewall demo.php sql injection (CVSS 5.3, Xiaopi Panel) - [CVE-2026-2120](https://cve.now/CVE-2026-2120.md): D-Link DIR-823X Configuration Parameter set\_server\_settings os command injection (CVSS 8.6, D-Link DIR-823X) - [CVE-2026-2118](https://cve.now/CVE-2026-2118.md): UTT HiPER 810 rehttpd formReleaseConnect sub\_4407D4 command injection (CVSS 8.6, UTT HiPER) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2026-02-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.