CVEs published February 9, 2026
166 CVEs were published on February 9, 2026: 20 critical, 52 high.
- Published
- 166
- Critical
- 20
- High
- 52
- Medium
- 88
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 94
Most affected products
- Yokogawa Electric FAST/TOOLS
- 15
- FreeRDP
- 12
- code-projects Online Reviewer System
- 9
- Praskla-Technology assessment-placipy
- 9
- craftcms cms · craftcms/cms
- 7
- frangoteam FUXA · fuxa-server
- 6
- PowerDNS Recursor
- 4
- WAGO 0852-1322 · WAGO 0852-1328
- 4
- Birtech Information Technologies Industry and Trade Ltd. Se…
- 3
- code-projects Online Music Site
- 3
Critical 20
- CVE-2026-25895FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIfrangoteam FUXA · fuxa-server
- CVE-2026-25894FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configurationfrangoteam FUXA · fuxa-server
- CVE-2026-25893FUXA Unauthenticated Remote Code Execution via Admin JWT Mintingfrangoteam FUXA · fuxa-server
- CVE-2026-25939FUXA Unauthenticated Remote Arbitrary Scheduler Writefrangoteam FUXA · fuxa-server
- CVE-2026-25938FUXA Unauthenticated Remote Code Execution in Node-RED Integrationfrangoteam FUXA · fuxa-server
- CVE-2026-25885PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chatspolarnl PolarLearn
- CVE-2026-25881@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)nyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-25875PlaciPy Admin Privilege Escalation via Trusted JWT ClaimsPraskla-Technology assessment-placipy
- CVE-2026-25814NoSQL Injection Risk via Unsanitized Query ParametersPraskla-Technology assessment-placipy
- CVE-2026-25812PlaciPy is Missing CSRF Protection on State-Changing EndpointsPraskla-Technology assessment-placipy
- CVE-2026-25057Zip Slip in MarkUs config upload allowing RCEMarkUsProject Markus
- CVE-2025-66630Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failuregofiber fiber · github.com/gofiber/fiber/v2 +1
- CVE-2025-6830SQLi in Xpoda Türkiye Information Technology's Password ModuleXpoda Türkiye Information Technology Password Module
- CVE-2026-25848In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possibleJetBrains Hub
- CVE-2026-22906Hardcoded Key Allows Credential DisclosureWAGO 0852-1322 · WAGO 0852-1328
- CVE-2026-22904Stack Overflow via Oversized Cookie Fields in lighttpdWAGO 0852-1322 · WAGO 0852-1328
- CVE-2026-22903Stack Overflow via SESSIONID Cookie in lighttpdWAGO 0852-1322 · WAGO 0852-1328
- CVE-2026-2234HGiga｜C&Cm@il - Missing AuthenticationHGiga C&Cm@il package olln-base
- CVE-2026-1868Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayGitLab AI Gateway
- CVE-2026-1615Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path exjsonpath · org.webjars.npm:jsonpath
High 52
- CVE-2026-0845WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Updatewclovers WCFM – Frontend Manager for WooCommerce
- CVE-2025-15310Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.Tanium Patch Endpoint Tools
- CVE-2025-15319Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.Tanium Patch Endpoint Tools
- CVE-2026-25958Cube privilege escalation via a specially crafted requestcube-js cube · @cubejs-backend/server-core
- CVE-2026-25951FUXA has a Path Traversal Sanitization Bypassfrangoteam FUXA · fuxa-server
- CVE-2026-25931vscode-spell-checker has a workspace-trust bypass Code Executionstreetsidesoftware vscode-spell-checker
- CVE-2026-25925PowerDocu Affected by Remote Code Execution via Insecure Deserializationmodery PowerDocu
- CVE-2026-25923Phar Deserialization leading to Arbitrary File Deletion in my little forumMy-Little-Forum mylittleforum
- CVE-2026-25808Hollo DMs get leaked and can be seen on Webfinger Browserfedify-dev hollo
- CVE-2026-25807Unauthenticated Remote Code Execution via P2P Sharing in ZAI-ShellTaklaXBR zai-shell
- CVE-2026-25961SumatraPDF Update MITM -> Arbitrary Code Executionsumatrapdfreader sumatrapdf
- CVE-2026-25892Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpointvrana adminer · vrana/adminer
- CVE-2026-25890File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-25880Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)sumatrapdfreader sumatrapdf
- CVE-2026-25813PlaciPy Exposes Sensitive Data via Application LogsPraskla-Technology assessment-placipy
- CVE-2026-25791Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of ServiceBishopFox sliver · github.com/bishopfox/sliver
- CVE-2026-25761Command injection via crafted filenames in Super-linter Actionsuper-linter
- CVE-2026-25639Axios affected by Denial of Service via __proto__ Key in mergeConfigaxios
- CVE-2026-25498Craft has a potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms cms · craftcms/cms
- CVE-2026-25497Craft has a GraphQL Asset Mutation Privilege Escalationcraftcms cms · craftcms/cms
- CVE-2026-25495Craft has a SQL Injection in Element Indexes via criteria[orderBy]craftcms cms · craftcms/cms
- CVE-2026-25478Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originslitestar-org litestar · litestar
- CVE-2026-1529Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-1486Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grantRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-25231FileRise affected by an Unauthenticated File Read Due to Insufficient Access Controlerror311 FileRise
- CVE-2026-24684FreeRDP has a Heap-use-after-free in play_threadFreeRDP
- CVE-2026-24683FreeRDP has a heap-use-after-free in ainput_send_input_eventFreeRDP
- CVE-2026-24682FreeRDP has a Heap-buffer-overflow in audio_formats_freeFreeRDP
- CVE-2026-24681FreeRDP has a heap-use-after-free in urb_bulk_transfer_cbFreeRDP
- CVE-2026-24680FreeRDP has a heap-use-after-free in update_pointer_new(SDL)FreeRDP
- CVE-2026-24679FreeRDP has a heap-buffer-overflow in urb_select_interfaceFreeRDP
- CVE-2026-24678FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_threadFreeRDP
- CVE-2026-24677FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264FreeRDP
- CVE-2026-24676FreeRDP has a heap-use-after-free in audio_format_compatibleFreeRDP
- CVE-2026-24675FreeRDP has a Heap-use-after-free in urb_select_interfaceFreeRDP
- CVE-2026-24491FreeRDP has a heap-use-after-free in video_timerFreeRDP
- CVE-2025-59023Crafted delegations or IP fragments can poison cached delegations in RecursorPowerDNS Recursor
- CVE-2025-10465Unrestricted File Upload in Birtech Information Technologies' SensawayBirtech Information Technologies Industry and Trade Ltd. Se…
- CVE-2025-10463Improper Authentication in Birtech Information Technologies' SensawayBirtech Information Technologies Industry and Trade Ltd. Se…
- CVE-2026-25847In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possibleJetBrains PyCharm
- CVE-2025-7799Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting WebsiteZirve Information Technologies e-Taxpayer Accounting Website
- CVE-2026-22905Authentication Bypass via URI TraversalWAGO 0852-1322 · WAGO 0852-1328
- CVE-2026-2236HGiga｜C&Cm@il - SQL InjectionHGiga C&Cm@il package olln-base
- CVE-2026-2235HGiga｜C&Cm@il - SQL InjectionHGiga C&Cm@il package olln-base
- CVE-2026-0870GIGABYTE｜MacroHub - Local Privilege EscalationGIGABYTE MacroHub
- CVE-2025-66597A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66598A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66600A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66608A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2026-2210D-Link DIR-823X set_filtering sub_4211C8 os command injectionD-Link DIR-823X
- CVE-2026-2203Tenda AC8 Embedded Httpd Service fast_setting_wifi_set buffer overflowTenda AC8
- CVE-2026-2202Tenda AC8 httpd WifiGuestSet fromSetWifiGusetBasic buffer overflowTenda AC8
Medium, low and unrated 94
- CVE-2025-15147WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Paymentwclovers WCFM Membership – WooCommerce Memberships for Mult…
- CVE-2025-15314Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.Tanium end-user-cx
- CVE-2025-15313Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.Tanium EUSS
- CVE-2025-15318Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.Tanium End-User Notifications Endpoint Tools
- CVE-2026-25957Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted requestcube-js cube · @cubejs-backend/server-core
- CVE-2026-25934go-git improperly verifies data integrity values for .idx and .pack filesgo-git · github.com/go-git/go-git +2
- CVE-2025-15315Tanium addressed a local privilege escalation vulnerability in Tanium Module Server.Tanium Module Server
- CVE-2025-15316Tanium addressed a local privilege escalation vulnerability in Tanium Server.Tanium Server
- CVE-2025-15317Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server.Tanium Server
- CVE-2026-25920SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressorsumatrapdfreader sumatrapdf
- CVE-2026-25918unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)RageAgainstThePixel unity-cli · @rage-against-the-pixel/uni…
- CVE-2026-25889File Browser has an Authentication Bypass in User Password Updatefilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-25811PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)Praskla-Technology assessment-placipy
- CVE-2026-25809PlaciPy Code Execution Allowed Without Assessment Active State ValidationPraskla-Technology assessment-placipy
- CVE-2026-25878FroshAdminer Adminer UI is accessible without admin sessionFriendsOfShopware FroshPlatformAdminer · frosh/adminer-plat…
- CVE-2026-25806PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)Praskla-Technology assessment-placipy
- CVE-2026-25810PlaciPy is Missing Object-Level Authorization in student.submission.routes.tsPraskla-Technology assessment-placipy
- CVE-2026-25876PlaciPy is Missing Authorization on Assessment Results EndpointPraskla-Technology assessment-placipy
- CVE-2026-25765Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_urllostisland faraday · faraday
- CVE-2026-25740Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS moduleNixOS nixpkgs
- CVE-2026-25528LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injectionlangchain-ai langsmith-sdk · langsmith
- CVE-2026-25496Craft has a stored XSS in Number Prefix & Suffix Fieldscraftcms cms · craftcms/cms
- CVE-2026-25494Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notationcraftcms cms · craftcms/cms
- CVE-2026-25493Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirectcraftcms cms · craftcms/cms
- CVE-2026-25492Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostcraftcms cms · craftcms/craft
- CVE-2026-2246AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruptionAprilRobotics apriltag
- CVE-2026-25491Craft has a Stored XSS in Entry Types Namecraftcms cms · craftcms/cms
- CVE-2026-2245CCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-boundsCCExtractor
- CVE-2026-25598Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)step-security harden-runner
- CVE-2025-14778Keycloak: incorrect ownership checks in /uma-policy/Red Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-25480FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)litestar-org litestar · litestar
- CVE-2026-25479Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patternslitestar-org litestar · litestar
- CVE-2026-24900MarkUs has a submission-view IDOR exposes all student submissionsMarkUsProject Markus
- CVE-2026-25230FileRise affected by HTML Injection using color property in file tagserror311 FileRise
- CVE-2026-24777OpenProject has Improper Access Control on User Management allows user managers to lock admin accountsopf openproject
- CVE-2026-23948FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()FreeRDP
- CVE-2026-2242janet-lang janet specials.c janetc_if out-of-boundsjanet-lang janet
- CVE-2026-21419Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following'Dell Display and Peripheral Manager
- CVE-2025-7432DPA countermeasures not reseeded under certain conditionssilabs.com Simplicity SDK
- CVE-2026-2241janet-lang janet os.c os_strftime out-of-boundsjanet-lang janet
- CVE-2026-2240janet-lang janet compile.c janetc_pop_funcdef out-of-boundsjanet-lang janet
- CVE-2026-24095Missing Permission Check on Analyze Configuration PageCheckmk
- CVE-2025-14831Gnutls: gnutls: denial of service via excessive resource consumption during certificate verificationgnutls · Red Hat Enterprise Linux +9
- CVE-2025-59024Crafted delegations or IP fragments can poison cached delegations in RecursorPowerDNS Recursor
- CVE-2026-24027Crafted zones can lead to increased incoming network trafficPowerDNS Recursor
- CVE-2026-0398Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in RecursorPowerDNS Recursor
- CVE-2025-10464Cleartext password storage in Birtech Information Technologies' SensawayBirtech Information Technologies Industry and Trade Ltd. Se…
- CVE-2025-7708Sensitive Data Exposure in Atlas Software's k12netAtlas Educational Software Industry Ltd. k12net
- CVE-2026-1960Stored Cross-Site Scripting (XSS) vulnerability in Loggro PymesLoggro Pymes
- CVE-2026-1959Stored Cross-Site Scripting (XSS) vulnerability in Loggro PymesLoggro Pymes
- CVE-2026-0632Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'techjewel Fluent Forms Pro Add On Pack
- CVE-2026-25846In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logsJetBrains YouTrack
- CVE-2026-22922Apache Airflow: Airflow externalLogUrl Permission BypassApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-24098Apache Airflow: Assigning single DAG permission leaked all DAGs Import ErrorsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-2227D-Link DCS-931L setSystemAdmin doSystem command injectionD-Link DCS-931L
- CVE-2026-2226DouPHP ZIP File file.php unrestricted uploadDouPHP
- CVE-2026-23903Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystemsApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-2225itsourcecode News Portal Project Administrator Login index.php sql injectionitsourcecode News Portal Project
- CVE-2026-25905Lack of isolation in mcp-run-python leads to MCP server takeovermcp-run-python
- CVE-2026-25904Overly permissive Deno configuration in mcp-run-python leads to SSRFmcp-run-python
- CVE-2026-2224code-projects Online Reviewer System btn_functions.php cross site scriptingcode-projects Online Reviewer System
- CVE-2026-25916Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.Roundcube Webmail
- CVE-2026-2223code-projects Online Reviewer System index.php sql injectioncode-projects Online Reviewer System
- CVE-2026-2222code-projects Online Reviewer System btn_functions.php cross site scriptingcode-projects Online Reviewer System
- CVE-2026-2221code-projects Online Reviewer System Login index.php sql injectioncode-projects Online Reviewer System
- CVE-2026-24466Products provided by Oki Electric Industry Co., Ltd.Oki Electric Industry Co. See "References" section · Ric… +1
- CVE-2026-2220code-projects Online Reviewer System btn_functions.php sql injectioncode-projects Online Reviewer System
- CVE-2026-2218D-Link DCS-933L alphapd setSystemAdmin command injectionD-Link DCS-933L
- CVE-2026-22613The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacEaton Network M3
- CVE-2026-2217itsourcecode Event Management System manage_user.php sql injectionitsourcecode Event Management System
- CVE-2026-2216rachelos WeRSS we-mp-rss tools.py download_export_file path traversalrachelos WeRSS we-mp-rss
- CVE-2026-2215rachelos WeRSS we-mp-rss JWT auth.py default keyrachelos WeRSS we-mp-rss
- CVE-2026-2214code-projects for Plugin AdminAddAlbum.php cross site scriptingcode-projects for Plugin
- CVE-2025-66594A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66595A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66596A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2026-2213code-projects Online Music Site AdminAddAlbum.php unrestricted uploadcode-projects Online Music Site
- CVE-2025-66599A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66601A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66602A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66603A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66604A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66605A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66607A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2025-66606A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.Yokogawa Electric FAST/TOOLS
- CVE-2026-2212code-projects Online Music Site AdminEditCategory.php sql injectioncode-projects Online Music Site
- CVE-2026-2211code-projects Online Music Site AdminDeleteCategory.php sql injectioncode-projects Online Music Site
- CVE-2026-2201ZeroWdd studentmanager LeaveController.java addLeave cross site scriptingZeroWdd studentmanager
- CVE-2026-2200heyewei JFinalCMS API Endpoint save cross site scriptingheyewei JFinalCMS
- CVE-2026-2199code-projects Online Reviewer System user-delete.php sql injectioncode-projects Online Reviewer System
- CVE-2026-2198code-projects Online Reviewer System loaddata.php sql injectioncode-projects Online Reviewer System
- CVE-2026-2197code-projects Online Reviewer System exam-delete.php sql injectioncode-projects Online Reviewer System
- CVE-2026-2196code-projects Online Reviewer System exam-update.php sql injectioncode-projects Online Reviewer System
- CVE-2025-63354Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter.