# CVEs published 2026-02-09

166 CVEs were published on February 9, 2026: 20 critical, 52 high. Days are UTC.

- [CVE-2025-15147](https://cve.now/CVE-2025-15147.md): WCFM Membership – WooCommerce Memberships for Multivendor Marketplace \<= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment (CVSS 4.3, wclovers WCFM Membership – WooCommerce Memberships for Mult…)
- [CVE-2026-0845](https://cve.now/CVE-2026-0845.md): WCFM - WooCommerce Frontend Manager \<= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update (CVSS 7.2, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2025-15314](https://cve.now/CVE-2025-15314.md): Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. (CVSS 5.5, Tanium end-user-cx)
- [CVE-2025-15313](https://cve.now/CVE-2025-15313.md): Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. (CVSS 5.5, Tanium EUSS)
- [CVE-2025-15310](https://cve.now/CVE-2025-15310.md): Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. (CVSS 7.8, Tanium Patch Endpoint Tools)
- [CVE-2025-15318](https://cve.now/CVE-2025-15318.md): Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. (CVSS 5.1, Tanium End-User Notifications Endpoint Tools)
- [CVE-2025-15319](https://cve.now/CVE-2025-15319.md): Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. (CVSS 7.8, Tanium Patch Endpoint Tools)
- [CVE-2026-25958](https://cve.now/CVE-2026-25958.md): Cube privilege escalation via a specially crafted request (CVSS 7.7, cube-js cube · @cubejs-backend/server-core)
- [CVE-2026-25957](https://cve.now/CVE-2026-25957.md): Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request (CVSS 6.5, cube-js cube · @cubejs-backend/server-core)
- [CVE-2026-25895](https://cve.now/CVE-2026-25895.md): FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API (CVSS 9.5, frangoteam FUXA · fuxa-server)
- [CVE-2026-25894](https://cve.now/CVE-2026-25894.md): FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration (CVSS 9.5, frangoteam FUXA · fuxa-server)
- [CVE-2026-25893](https://cve.now/CVE-2026-25893.md): FUXA Unauthenticated Remote Code Execution via Admin JWT Minting (CVSS 10.0, frangoteam FUXA · fuxa-server)
- [CVE-2026-25951](https://cve.now/CVE-2026-25951.md): FUXA has a Path Traversal Sanitization Bypass (CVSS 8.6, frangoteam FUXA · fuxa-server)
- [CVE-2026-25939](https://cve.now/CVE-2026-25939.md): FUXA Unauthenticated Remote Arbitrary Scheduler Write (CVSS 9.3, frangoteam FUXA · fuxa-server)
- [CVE-2026-25938](https://cve.now/CVE-2026-25938.md): FUXA Unauthenticated Remote Code Execution in Node-RED Integration (CVSS 9.5, frangoteam FUXA · fuxa-server)
- [CVE-2026-25934](https://cve.now/CVE-2026-25934.md): go-git improperly verifies data integrity values for .idx and .pack files (CVSS 4.3, go-git · github.com/go-git/go-git +2)
- [CVE-2026-25931](https://cve.now/CVE-2026-25931.md): vscode-spell-checker has a workspace-trust bypass Code Execution (CVSS 7.8, streetsidesoftware vscode-spell-checker)
- [CVE-2026-25925](https://cve.now/CVE-2026-25925.md): PowerDocu Affected by Remote Code Execution via Insecure Deserialization (CVSS 7.8, modery PowerDocu)
- [CVE-2026-25923](https://cve.now/CVE-2026-25923.md): Phar Deserialization leading to Arbitrary File Deletion in my little forum (CVSS 8.7, My-Little-Forum mylittleforum)
- [CVE-2026-25808](https://cve.now/CVE-2026-25808.md): Hollo DMs get leaked and can be seen on Webfinger Browser (CVSS 7.5, fedify-dev hollo)
- [CVE-2025-15315](https://cve.now/CVE-2025-15315.md): Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. (CVSS 6.7, Tanium Module Server)
- [CVE-2025-15316](https://cve.now/CVE-2025-15316.md): Tanium addressed a local privilege escalation vulnerability in Tanium Server. (CVSS 6.7, Tanium Server)
- [CVE-2026-25807](https://cve.now/CVE-2026-25807.md): Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell (CVSS 8.8, TaklaXBR zai-shell)
- [CVE-2025-15317](https://cve.now/CVE-2025-15317.md): Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. (CVSS 6.5, Tanium Server)
- [CVE-2026-25961](https://cve.now/CVE-2026-25961.md): SumatraPDF Update MITM -\> Arbitrary Code Execution (CVSS 7.5, sumatrapdfreader sumatrapdf)
- [CVE-2026-25920](https://cve.now/CVE-2026-25920.md): SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor (CVSS 5.5, sumatrapdfreader sumatrapdf)
- [CVE-2026-25918](https://cve.now/CVE-2026-25918.md): unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command) (CVSS 5.9, RageAgainstThePixel unity-cli · @rage-against-the-pixel/uni…)
- [CVE-2026-25892](https://cve.now/CVE-2026-25892.md): Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint (CVSS 7.5, vrana adminer · vrana/adminer)
- [CVE-2026-25890](https://cve.now/CVE-2026-25890.md): File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL (CVSS 8.1, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-25889](https://cve.now/CVE-2026-25889.md): File Browser has an Authentication Bypass in User Password Update (CVSS 5.4, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-25885](https://cve.now/CVE-2026-25885.md): PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats (CVSS 10.0, polarnl PolarLearn)
- [CVE-2026-25881](https://cve.now/CVE-2026-25881.md): @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) (CVSS 9.1, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-25880](https://cve.now/CVE-2026-25880.md): Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows) (CVSS 7.8, sumatrapdfreader sumatrapdf)
- [CVE-2026-25875](https://cve.now/CVE-2026-25875.md): PlaciPy Admin Privilege Escalation via Trusted JWT Claims (CVSS 9.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25814](https://cve.now/CVE-2026-25814.md): NoSQL Injection Risk via Unsanitized Query Parameters (CVSS 9.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25813](https://cve.now/CVE-2026-25813.md): PlaciPy Exposes Sensitive Data via Application Logs (CVSS 8.7, Praskla-Technology assessment-placipy)
- [CVE-2026-25812](https://cve.now/CVE-2026-25812.md): PlaciPy is Missing CSRF Protection on State-Changing Endpoints (CVSS 9.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25811](https://cve.now/CVE-2026-25811.md): PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) (CVSS 5.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25809](https://cve.now/CVE-2026-25809.md): PlaciPy Code Execution Allowed Without Assessment Active State Validation (CVSS 5.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25878](https://cve.now/CVE-2026-25878.md): FroshAdminer Adminer UI is accessible without admin session (CVSS 6.9, FriendsOfShopware FroshPlatformAdminer · frosh/adminer-plat…)
- [CVE-2026-25806](https://cve.now/CVE-2026-25806.md): PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR) (CVSS 5.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25810](https://cve.now/CVE-2026-25810.md): PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts (CVSS 5.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25876](https://cve.now/CVE-2026-25876.md): PlaciPy is Missing Authorization on Assessment Results Endpoint (CVSS 5.3, Praskla-Technology assessment-placipy)
- [CVE-2026-25791](https://cve.now/CVE-2026-25791.md): Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service (CVSS 7.5, BishopFox sliver · github.com/bishopfox/sliver)
- [CVE-2026-25765](https://cve.now/CVE-2026-25765.md): Faraday affected by SSRF via protocol-relative URL host override in build\_exclusive\_url (CVSS 5.8, lostisland faraday · faraday)
- [CVE-2026-25761](https://cve.now/CVE-2026-25761.md): Command injection via crafted filenames in Super-linter Action (CVSS 8.8, super-linter)
- [CVE-2026-25740](https://cve.now/CVE-2026-25740.md): Privilege escalation to the \`CAP\_NET\_RAW\` capability via the \`programs.captive-browser\` NixOS module (CVSS 5.8, NixOS nixpkgs)
- [CVE-2026-25639](https://cve.now/CVE-2026-25639.md): Axios affected by Denial of Service via \_\_proto\_\_ Key in mergeConfig (CVSS 7.5, axios)
- [CVE-2026-25528](https://cve.now/CVE-2026-25528.md): LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection (CVSS 5.8, langchain-ai langsmith-sdk · langsmith)
- [CVE-2026-25498](https://cve.now/CVE-2026-25498.md): Craft has a potential authenticated Remote Code Execution via malicious attached Behavior (CVSS 8.6, craftcms cms · craftcms/cms)
- [CVE-2026-25497](https://cve.now/CVE-2026-25497.md): Craft has a GraphQL Asset Mutation Privilege Escalation (CVSS 8.6, craftcms cms · craftcms/cms)
- [CVE-2026-25496](https://cve.now/CVE-2026-25496.md): Craft has a stored XSS in Number Prefix & Suffix Fields (CVSS 4.8, craftcms cms · craftcms/cms)
- [CVE-2026-25495](https://cve.now/CVE-2026-25495.md): Craft has a SQL Injection in Element Indexes via criteria\[orderBy\] (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-25494](https://cve.now/CVE-2026-25494.md): Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-25493](https://cve.now/CVE-2026-25493.md): Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-25492](https://cve.now/CVE-2026-25492.md): Craft has a save\_images\_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host (CVSS 5.3, craftcms cms · craftcms/craft)
- [CVE-2026-2246](https://cve.now/CVE-2026-2246.md): AprilRobotics apriltag apriltag.c apriltag\_detector\_detect memory corruption (CVSS 4.8, AprilRobotics apriltag)
- [CVE-2026-25491](https://cve.now/CVE-2026-25491.md): Craft has a Stored XSS in Entry Types Name (CVSS 1.9, craftcms cms · craftcms/cms)
- [CVE-2026-25057](https://cve.now/CVE-2026-25057.md): Zip Slip in MarkUs config upload allowing RCE (CVSS 9.1, MarkUsProject Markus)
- [CVE-2026-2245](https://cve.now/CVE-2026-2245.md): CCExtractor MPEG-TS File ts\_tables.c parse\_PMT out-of-bounds (CVSS 4.8, CCExtractor)
- [CVE-2026-25598](https://cve.now/CVE-2026-25598.md): Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier) (CVSS 6.3, step-security harden-runner)
- [CVE-2025-14778](https://cve.now/CVE-2025-14778.md): Keycloak: incorrect ownership checks in /uma-policy/ (CVSS 5.4, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-25480](https://cve.now/CVE-2026-25480.md): FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) (CVSS 6.5, litestar-org litestar · litestar)
- [CVE-2026-25479](https://cve.now/CVE-2026-25479.md): Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns (CVSS 6.5, litestar-org litestar · litestar)
- [CVE-2026-25478](https://cve.now/CVE-2026-25478.md): Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins (CVSS 7.4, litestar-org litestar · litestar)
- [CVE-2026-24900](https://cve.now/CVE-2026-24900.md): MarkUs has a submission-view IDOR exposes all student submissions (CVSS 6.5, MarkUsProject Markus)
- [CVE-2026-1529](https://cve.now/CVE-2026-1529.md): Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation (CVSS 8.1, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-1486](https://cve.now/CVE-2026-1486.md): Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant (CVSS 8.8, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-25231](https://cve.now/CVE-2026-25231.md): FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control (CVSS 7.5, error311 FileRise)
- [CVE-2026-25230](https://cve.now/CVE-2026-25230.md): FileRise affected by HTML Injection using color property in file tags (CVSS 4.6, error311 FileRise)
- [CVE-2026-24777](https://cve.now/CVE-2026-24777.md): OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts (CVSS 6.7, opf openproject)
- [CVE-2026-24684](https://cve.now/CVE-2026-24684.md): FreeRDP has a Heap-use-after-free in play\_thread (CVSS 8.7, FreeRDP)
- [CVE-2026-24683](https://cve.now/CVE-2026-24683.md): FreeRDP has a heap-use-after-free in ainput\_send\_input\_event (CVSS 8.7, FreeRDP)
- [CVE-2026-24682](https://cve.now/CVE-2026-24682.md): FreeRDP has a Heap-buffer-overflow in audio\_formats\_free (CVSS 8.7, FreeRDP)
- [CVE-2026-24681](https://cve.now/CVE-2026-24681.md): FreeRDP has a heap-use-after-free in urb\_bulk\_transfer\_cb (CVSS 8.7, FreeRDP)
- [CVE-2026-24680](https://cve.now/CVE-2026-24680.md): FreeRDP has a heap-use-after-free in update\_pointer\_new(SDL) (CVSS 8.7, FreeRDP)
- [CVE-2026-24679](https://cve.now/CVE-2026-24679.md): FreeRDP has a heap-buffer-overflow in urb\_select\_interface (CVSS 8.7, FreeRDP)
- [CVE-2026-24678](https://cve.now/CVE-2026-24678.md): FreeRDP has a Heap-use-after-free in cam\_v4l\_stream\_capture\_thread (CVSS 8.7, FreeRDP)
- [CVE-2026-24677](https://cve.now/CVE-2026-24677.md): FreeRDP has a heap-buffer-overflow in ecam\_encoder\_compress\_h264 (CVSS 8.7, FreeRDP)
- [CVE-2026-24676](https://cve.now/CVE-2026-24676.md): FreeRDP has a heap-use-after-free in audio\_format\_compatible (CVSS 7.7, FreeRDP)
- [CVE-2026-24675](https://cve.now/CVE-2026-24675.md): FreeRDP has a Heap-use-after-free in urb\_select\_interface (CVSS 7.7, FreeRDP)
- [CVE-2026-24491](https://cve.now/CVE-2026-24491.md): FreeRDP has a heap-use-after-free in video\_timer (CVSS 7.7, FreeRDP)
- [CVE-2026-23948](https://cve.now/CVE-2026-23948.md): FreeRDP has a NULL Pointer Dereference in rdp\_write\_logon\_info\_v2() (CVSS 6.9, FreeRDP)
- [CVE-2025-66630](https://cve.now/CVE-2025-66630.md): Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure (CVSS 9.2, gofiber fiber · github.com/gofiber/fiber/v2 +1)
- [CVE-2026-2242](https://cve.now/CVE-2026-2242.md): janet-lang janet specials.c janetc\_if out-of-bounds (CVSS 4.8, janet-lang janet)
- [CVE-2026-21419](https://cve.now/CVE-2026-21419.md): Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following' (CVSS 6.6, Dell Display and Peripheral Manager)
- [CVE-2025-7432](https://cve.now/CVE-2025-7432.md): DPA countermeasures not reseeded under certain conditions (CVSS 1.0, silabs.com Simplicity SDK)
- [CVE-2026-2241](https://cve.now/CVE-2026-2241.md): janet-lang janet os.c os\_strftime out-of-bounds (CVSS 4.8, janet-lang janet)
- [CVE-2026-2240](https://cve.now/CVE-2026-2240.md): janet-lang janet compile.c janetc\_pop\_funcdef out-of-bounds (CVSS 4.8, janet-lang janet)
- [CVE-2026-24095](https://cve.now/CVE-2026-24095.md): Missing Permission Check on Analyze Configuration Page (CVSS 5.3, Checkmk)
- [CVE-2025-14831](https://cve.now/CVE-2025-14831.md): Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification (CVSS 5.3, gnutls · Red Hat Enterprise Linux +9)
- [CVE-2025-59024](https://cve.now/CVE-2025-59024.md): Crafted delegations or IP fragments can poison cached delegations in Recursor (CVSS 6.5, PowerDNS Recursor)
- [CVE-2025-59023](https://cve.now/CVE-2025-59023.md): Crafted delegations or IP fragments can poison cached delegations in Recursor (CVSS 8.2, PowerDNS Recursor)
- [CVE-2026-24027](https://cve.now/CVE-2026-24027.md): Crafted zones can lead to increased incoming network traffic (CVSS 5.3, PowerDNS Recursor)
- [CVE-2026-0398](https://cve.now/CVE-2026-0398.md): Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor (CVSS 5.3, PowerDNS Recursor)
- [CVE-2025-10465](https://cve.now/CVE-2025-10465.md): Unrestricted File Upload in Birtech Information Technologies' Sensaway (CVSS 8.8, Birtech Information Technologies Industry and Trade Ltd. Se…)
- [CVE-2025-10464](https://cve.now/CVE-2025-10464.md): Cleartext password storage in Birtech Information Technologies' Sensaway (CVSS 6.5, Birtech Information Technologies Industry and Trade Ltd. Se…)
- [CVE-2025-10463](https://cve.now/CVE-2025-10463.md): Improper Authentication in Birtech Information Technologies' Sensaway (CVSS 7.3, Birtech Information Technologies Industry and Trade Ltd. Se…)
- [CVE-2025-7708](https://cve.now/CVE-2025-7708.md): Sensitive Data Exposure in Atlas Software's k12net (CVSS 6.8, Atlas Educational Software Industry Ltd. k12net)
- [CVE-2026-1960](https://cve.now/CVE-2026-1960.md): Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes (CVSS 5.1, Loggro Pymes)
- [CVE-2026-1959](https://cve.now/CVE-2026-1959.md): Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes (CVSS 5.1, Loggro Pymes)
- [CVE-2026-0632](https://cve.now/CVE-2026-0632.md): Fluent Forms Pro Add On Pack \<= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' (CVSS 5.4, techjewel Fluent Forms Pro Add On Pack)
- [CVE-2025-6830](https://cve.now/CVE-2025-6830.md): SQLi in Xpoda Türkiye Information Technology's Password Module (CVSS 9.8, Xpoda Türkiye Information Technology Password Module)
- [CVE-2026-25848](https://cve.now/CVE-2026-25848.md): In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible (CVSS 9.1, JetBrains Hub)
- [CVE-2026-25847](https://cve.now/CVE-2026-25847.md): In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible (CVSS 8.2, JetBrains PyCharm)
- [CVE-2026-25846](https://cve.now/CVE-2026-25846.md): In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs (CVSS 6.5, JetBrains YouTrack)
- [CVE-2026-22922](https://cve.now/CVE-2026-22922.md): Apache Airflow: Airflow externalLogUrl Permission Bypass (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-24098](https://cve.now/CVE-2026-24098.md): Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-2227](https://cve.now/CVE-2026-2227.md): D-Link DCS-931L setSystemAdmin doSystem command injection (CVSS 5.1, D-Link DCS-931L)
- [CVE-2026-2226](https://cve.now/CVE-2026-2226.md): DouPHP ZIP File file.php unrestricted upload (CVSS 5.1, DouPHP)
- [CVE-2026-23903](https://cve.now/CVE-2026-23903.md): Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems (CVSS 5.3, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2026-2225](https://cve.now/CVE-2026-2225.md): itsourcecode News Portal Project Administrator Login index.php sql injection (CVSS 6.9, itsourcecode News Portal Project)
- [CVE-2026-25905](https://cve.now/CVE-2026-25905.md): Lack of isolation in mcp-run-python leads to MCP server takeover (CVSS 5.8, mcp-run-python)
- [CVE-2026-25904](https://cve.now/CVE-2026-25904.md): Overly permissive Deno configuration in mcp-run-python leads to SSRF (CVSS 5.8, mcp-run-python)
- [CVE-2026-2224](https://cve.now/CVE-2026-2224.md): code-projects Online Reviewer System btn\_functions.php cross site scripting (CVSS 5.1, code-projects Online Reviewer System)
- [CVE-2026-25916](https://cve.now/CVE-2026-25916.md): Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. (CVSS 4.3, Roundcube Webmail)
- [CVE-2025-7799](https://cve.now/CVE-2025-7799.md): Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website (CVSS 8.6, Zirve Information Technologies e-Taxpayer Accounting Website)
- [CVE-2026-2223](https://cve.now/CVE-2026-2223.md): code-projects Online Reviewer System index.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-22906](https://cve.now/CVE-2026-22906.md): Hardcoded Key Allows Credential Disclosure (CVSS 9.8, WAGO 0852-1322 · WAGO 0852-1328)
- [CVE-2026-22905](https://cve.now/CVE-2026-22905.md): Authentication Bypass via URI Traversal (CVSS 7.5, WAGO 0852-1322 · WAGO 0852-1328)
- [CVE-2026-22904](https://cve.now/CVE-2026-22904.md): Stack Overflow via Oversized Cookie Fields in lighttpd (CVSS 9.8, WAGO 0852-1322 · WAGO 0852-1328)
- [CVE-2026-22903](https://cve.now/CVE-2026-22903.md): Stack Overflow via SESSIONID Cookie in lighttpd (CVSS 9.8, WAGO 0852-1322 · WAGO 0852-1328)
- [CVE-2026-2222](https://cve.now/CVE-2026-2222.md): code-projects Online Reviewer System btn\_functions.php cross site scripting (CVSS 4.8, code-projects Online Reviewer System)
- [CVE-2026-2236](https://cve.now/CVE-2026-2236.md): HGiga｜C&Cm@il - SQL Injection (CVSS 8.7, HGiga C&Cm@il package olln-base)
- [CVE-2026-2235](https://cve.now/CVE-2026-2235.md): HGiga｜C&Cm@il - SQL Injection (CVSS 7.1, HGiga C&Cm@il package olln-base)
- [CVE-2026-2234](https://cve.now/CVE-2026-2234.md): HGiga｜C&Cm@il - Missing Authentication (CVSS 9.3, HGiga C&Cm@il package olln-base)
- [CVE-2026-2221](https://cve.now/CVE-2026-2221.md): code-projects Online Reviewer System Login index.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-24466](https://cve.now/CVE-2026-24466.md): Products provided by Oki Electric Industry Co., Ltd. (CVSS 6.7, Oki Electric Industry Co. See "References" section · Ric… +1)
- [CVE-2026-1868](https://cve.now/CVE-2026-1868.md): Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway (CVSS 9.9, GitLab AI Gateway)
- [CVE-2026-2220](https://cve.now/CVE-2026-2220.md): code-projects Online Reviewer System btn\_functions.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-0870](https://cve.now/CVE-2026-0870.md): GIGABYTE｜MacroHub - Local Privilege Escalation (CVSS 8.5, GIGABYTE MacroHub)
- [CVE-2026-2218](https://cve.now/CVE-2026-2218.md): D-Link DCS-933L alphapd setSystemAdmin command injection (CVSS 5.3, D-Link DCS-933L)
- [CVE-2026-22613](https://cve.now/CVE-2026-22613.md): The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac (CVSS 5.7, Eaton Network M3)
- [CVE-2026-2217](https://cve.now/CVE-2026-2217.md): itsourcecode Event Management System manage\_user.php sql injection (CVSS 6.9, itsourcecode Event Management System)
- [CVE-2026-2216](https://cve.now/CVE-2026-2216.md): rachelos WeRSS we-mp-rss tools.py download\_export\_file path traversal (CVSS 5.3, rachelos WeRSS we-mp-rss)
- [CVE-2026-1615](https://cve.now/CVE-2026-1615.md): Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path ex (CVSS 9.2, jsonpath · org.webjars.npm:jsonpath)
- [CVE-2026-2215](https://cve.now/CVE-2026-2215.md): rachelos WeRSS we-mp-rss JWT auth.py default key (CVSS 6.3, rachelos WeRSS we-mp-rss)
- [CVE-2026-2214](https://cve.now/CVE-2026-2214.md): code-projects for Plugin AdminAddAlbum.php cross site scripting (CVSS 4.8, code-projects for Plugin)
- [CVE-2025-66594](https://cve.now/CVE-2025-66594.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.9, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66595](https://cve.now/CVE-2025-66595.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.3, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66596](https://cve.now/CVE-2025-66596.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.9, Yokogawa Electric FAST/TOOLS)
- [CVE-2026-2213](https://cve.now/CVE-2026-2213.md): code-projects Online Music Site AdminAddAlbum.php unrestricted upload (CVSS 5.1, code-projects Online Music Site)
- [CVE-2025-66597](https://cve.now/CVE-2025-66597.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 8.8, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66598](https://cve.now/CVE-2025-66598.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 7.1, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66599](https://cve.now/CVE-2025-66599.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.9, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66600](https://cve.now/CVE-2025-66600.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 8.8, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66601](https://cve.now/CVE-2025-66601.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.3, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66602](https://cve.now/CVE-2025-66602.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.9, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66603](https://cve.now/CVE-2025-66603.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 2.1, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66604](https://cve.now/CVE-2025-66604.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 2.1, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66605](https://cve.now/CVE-2025-66605.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 2.1, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66608](https://cve.now/CVE-2025-66608.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 8.7, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66607](https://cve.now/CVE-2025-66607.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 6.3, Yokogawa Electric FAST/TOOLS)
- [CVE-2025-66606](https://cve.now/CVE-2025-66606.md): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. (CVSS 2.1, Yokogawa Electric FAST/TOOLS)
- [CVE-2026-2212](https://cve.now/CVE-2026-2212.md): code-projects Online Music Site AdminEditCategory.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-2211](https://cve.now/CVE-2026-2211.md): code-projects Online Music Site AdminDeleteCategory.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-2210](https://cve.now/CVE-2026-2210.md): D-Link DIR-823X set\_filtering sub\_4211C8 os command injection (CVSS 8.6, D-Link DIR-823X)
- [CVE-2026-2203](https://cve.now/CVE-2026-2203.md): Tenda AC8 Embedded Httpd Service fast\_setting\_wifi\_set buffer overflow (CVSS 8.7, Tenda AC8)
- [CVE-2026-2202](https://cve.now/CVE-2026-2202.md): Tenda AC8 httpd WifiGuestSet fromSetWifiGusetBasic buffer overflow (CVSS 8.7, Tenda AC8)
- [CVE-2026-2201](https://cve.now/CVE-2026-2201.md): ZeroWdd studentmanager LeaveController.java addLeave cross site scripting (CVSS 4.8, ZeroWdd studentmanager)
- [CVE-2026-2200](https://cve.now/CVE-2026-2200.md): heyewei JFinalCMS API Endpoint save cross site scripting (CVSS 4.8, heyewei JFinalCMS)
- [CVE-2026-2199](https://cve.now/CVE-2026-2199.md): code-projects Online Reviewer System user-delete.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-2198](https://cve.now/CVE-2026-2198.md): code-projects Online Reviewer System loaddata.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-2197](https://cve.now/CVE-2026-2197.md): code-projects Online Reviewer System exam-delete.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-2196](https://cve.now/CVE-2026-2196.md): code-projects Online Reviewer System exam-update.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2025-63354](https://cve.now/CVE-2025-63354.md): Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.