# CVEs published 2026-02-10

280 CVEs were published on February 10, 2026: 11 critical, 129 high. 8 are now in CISA KEV. Days are UTC.

- [CVE-2026-25872](https://cve.now/CVE-2026-25872.md): JUNG Smart Panel 5.1 KNX Unauthenticated Path Traversal (CVSS 6.9, ALBRECHT JUNG GMBH & CO. KG JUNG Smart Panel 5.1 KNX)
- [CVE-2026-25870](https://cve.now/CVE-2026-25870.md): DoraCMS \<= 3.1 UEditor Remote Image Fetch SSRF (CVSS 6.9, doramart DoraCMS)
- [CVE-2026-26013](https://cve.now/CVE-2026-26013.md): LangChain affected by SSRF via image\_url token counting in ChatOpenAI.get\_num\_tokens\_from\_messages (CVSS 3.7, langchain-ai langchain · langchain-core)
- [CVE-2026-26007](https://cve.now/CVE-2026-26007.md): cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVSS 8.2, pyca cryptography · cryptography)
- [CVE-2026-26006](https://cve.now/CVE-2026-26006.md): Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt (CVSS 6.5, Significant-Gravitas AutoGPT)
- [CVE-2025-12699](https://cve.now/CVE-2025-12699.md): ZOLL ePCR IOS Mobile Application Insertion of Sensitive Information into Externally-Accessible File or Directory (CVSS 6.7, ZOLL ePCR IOS Mobile Application)
- [CVE-2026-1507](https://cve.now/CVE-2026-1507.md): Uncaught Exception vulnerability in AVEVA PI Data Archive (CVSS 7.5, AVEVA PI Data Archive PI Server)
- [CVE-2026-1495](https://cve.now/CVE-2026-1495.md): Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent (CVSS 6.5, AVEVA PI to CONNECT Agent)
- [CVE-2026-1763](https://cve.now/CVE-2026-1763.md): Enervista UR Setup DLL Hijacking (CVSS 4.6, GE Vernova Enervista)
- [CVE-2026-1762](https://cve.now/CVE-2026-1762.md): Enervista UR Setup Directory Traversal Vulnerability (CVSS 2.9, GE Vernova Enervista)
- [CVE-2025-29951](https://cve.now/CVE-2025-29951.md): A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privile (CVSS 7.3, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ G… +2)
- [CVE-2024-36311](https://cve.now/CVE-2024-36311.md): A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input valid (CVSS 4.6, AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Gr… +4)
- [CVE-2025-48515](https://cve.now/CVE-2025-48515.md): Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overw (CVSS 5.4, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Gr… +4)
- [CVE-2021-26410](https://cve.now/CVE-2021-26410.md): Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memo (CVSS 1.8, AMD Ryzen™ 5000 Series Desktop Processors with Radeon™… +13)
- [CVE-2021-26381](https://cve.now/CVE-2021-26381.md): Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a lar (CVSS 7.1, AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors… +18)
- [CVE-2025-29949](https://cve.now/CVE-2025-29949.md): Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to w (CVSS 4.8, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +20)
- [CVE-2026-21349](https://cve.now/CVE-2026-21349.md): Lightroom Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Desktop)
- [CVE-2026-21348](https://cve.now/CVE-2026-21348.md): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2024-36355](https://cve.now/CVE-2024-36355.md): Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (s (CVSS 7.0, AMD EPYC™ 9004 Series Processors · AMD Ryzen™ Threadrip… +31)
- [CVE-2024-36310](https://cve.now/CVE-2024-36310.md): Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SM (CVSS 4.6, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Serie… +16)
- [CVE-2025-29946](https://cve.now/CVE-2025-29946.md): Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. (CVSS 4.5, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2025-0029](https://cve.now/CVE-2025-0029.md): Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA write (CVSS 1.8, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2025-0031](https://cve.now/CVE-2025-0031.md): A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE\_SOCKET policy on a diffe (CVSS 4.6, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +7)
- [CVE-2025-48514](https://cve.now/CVE-2025-48514.md): Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, pot (CVSS 4.0, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6)
- [CVE-2025-54514](https://cve.now/CVE-2025-54514.md): Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a (CVSS 4.8, AMD EPYC™ 9005 Series Processors · AMD Ryzen™ 9000HX Ser… +8)
- [CVE-2025-48509](https://cve.now/CVE-2025-48509.md): Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of (CVSS 1.8, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6)
- [CVE-2025-52534](https://cve.now/CVE-2025-52534.md): Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrit (CVSS 5.3, AMD EPYC™ 9005 Series Processors)
- [CVE-2025-0012](https://cve.now/CVE-2025-0012.md): Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged (CVSS 6.8, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2025-29939](https://cve.now/CVE-2025-29939.md): Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) du (CVSS 6.9, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6)
- [CVE-2024-21953](https://cve.now/CVE-2024-21953.md): Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integri (CVSS 5.9, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 8004 Series… +1)
- [CVE-2025-29950](https://cve.now/CVE-2025-29950.md): Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary c (CVSS 7.1, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Serie… +17)
- [CVE-2025-29952](https://cve.now/CVE-2025-29952.md): Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP (CVSS 5.9, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2025-52536](https://cve.now/CVE-2025-52536.md): Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting i (CVSS 6.7, AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6)
- [CVE-2025-48517](https://cve.now/CVE-2025-48517.md): Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES gues (CVSS 4.6, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2025-29948](https://cve.now/CVE-2025-29948.md): Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, (CVSS 5.9, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2026-2303](https://cve.now/CVE-2026-2303.md): Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak (CVSS 6.9, MongoDB Go Driver · go.mongodb.org/mongo-driver +1)
- [CVE-2026-2302](https://cve.now/CVE-2026-2302.md): Unsafe Reflection in Mongoid::Criteria.from\_hash (CVSS 6.9, MongoDB Ruby Driver)
- [CVE-2026-26009](https://cve.now/CVE-2026-26009.md): Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution (CVSS 10.0, karutoil catalyst)
- [CVE-2026-25506](https://cve.now/CVE-2026-25506.md): MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVSS 7.7, dun munge)
- [CVE-2026-25613](https://cve.now/CVE-2026-25613.md): An unsafe cast in the MongoDB query planner can result in a segmentation fault. (CVSS 7.1, MongoDB Server)
- [CVE-2026-1849](https://cve.now/CVE-2026-1849.md): Mongod can run out of stack memory when expressions create deeply nested documents (CVSS 7.1, MongoDB Server)
- [CVE-2026-1850](https://cve.now/CVE-2026-1850.md): An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification (CVSS 7.1, MongoDB Server)
- [CVE-2026-25609](https://cve.now/CVE-2026-25609.md): profile command may permit unauthorized configuration (CVSS 5.3, MongoDB Server)
- [CVE-2026-21352](https://cve.now/CVE-2026-21352.md): DNG SDK | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe DNG Software Development Kit)
- [CVE-2026-21354](https://cve.now/CVE-2026-21354.md): DNG SDK | Integer Overflow or Wraparound (CWE-190) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-21353](https://cve.now/CVE-2026-21353.md): DNG SDK | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe DNG Software Development Kit)
- [CVE-2026-21355](https://cve.now/CVE-2026-21355.md): DNG SDK | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-25610](https://cve.now/CVE-2026-25610.md): Invalid $geoNear index hint may cause server crash (CVSS 7.1, MongoDB Server)
- [CVE-2026-21346](https://cve.now/CVE-2026-21346.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-21347](https://cve.now/CVE-2026-21347.md): Bridge | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-1848](https://cve.now/CVE-2026-1848.md): Connections received from the proxy port may not count towards total accepted connections (CVSS 8.2, MongoDB Server)
- [CVE-2026-21344](https://cve.now/CVE-2026-21344.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2026-21343](https://cve.now/CVE-2026-21343.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2026-21341](https://cve.now/CVE-2026-21341.md): Substance3D - Stager | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2026-21345](https://cve.now/CVE-2026-21345.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2026-21342](https://cve.now/CVE-2026-21342.md): Substance3D - Stager | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2026-1847](https://cve.now/CVE-2026-1847.md): MongoDB Server may crash when inserting large documents (CVSS 7.1, MongoDB Server)
- [CVE-2026-21337](https://cve.now/CVE-2026-21337.md): Substance3D - Designer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance 3D Designer)
- [CVE-2026-21335](https://cve.now/CVE-2026-21335.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance 3D Designer)
- [CVE-2026-21339](https://cve.now/CVE-2026-21339.md): Substance3D - Designer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance 3D Designer)
- [CVE-2026-21334](https://cve.now/CVE-2026-21334.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance 3D Designer)
- [CVE-2026-21338](https://cve.now/CVE-2026-21338.md): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance 3D Designer)
- [CVE-2026-21340](https://cve.now/CVE-2026-21340.md): Substance3D - Designer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance 3D Designer)
- [CVE-2026-21336](https://cve.now/CVE-2026-21336.md): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance 3D Designer)
- [CVE-2026-25612](https://cve.now/CVE-2026-25612.md): Internal ResourceId collision may affect unrelated collections (CVSS 7.1, MongoDB Server)
- [CVE-2026-21358](https://cve.now/CVE-2026-21358.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2026-21332](https://cve.now/CVE-2026-21332.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2026-21357](https://cve.now/CVE-2026-21357.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2026-1997](https://cve.now/CVE-2026-1997.md): Certain HP OfficeJet Pro Printers - Information Disclosure (CVSS 6.9, HP OfficeJet Pro 8730 All-in-One Printer · HP OfficeJet… +6)
- [CVE-2026-21329](https://cve.now/CVE-2026-21329.md): After Effects | Use After Free (CWE-416) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21323](https://cve.now/CVE-2026-21323.md): After Effects | Use After Free (CWE-416) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21324](https://cve.now/CVE-2026-21324.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21326](https://cve.now/CVE-2026-21326.md): After Effects | Use After Free (CWE-416) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21322](https://cve.now/CVE-2026-21322.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21318](https://cve.now/CVE-2026-21318.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21328](https://cve.now/CVE-2026-21328.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21319](https://cve.now/CVE-2026-21319.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2026-21350](https://cve.now/CVE-2026-21350.md): After Effects | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe After Effects)
- [CVE-2026-21330](https://cve.now/CVE-2026-21330.md): After Effects | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21325](https://cve.now/CVE-2026-21325.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21327](https://cve.now/CVE-2026-21327.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21320](https://cve.now/CVE-2026-21320.md): After Effects | Use After Free (CWE-416) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21321](https://cve.now/CVE-2026-21321.md): After Effects | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-21351](https://cve.now/CVE-2026-21351.md): After Effects | Use After Free (CWE-416) (CVSS 7.8, Adobe After Effects)
- [CVE-2026-25611](https://cve.now/CVE-2026-25611.md): Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server (CVSS 8.7, MongoDB Server)
- [CVE-2026-26003](https://cve.now/CVE-2026-26003.md): FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack (CVSS 6.9, labring FastGPT)
- [CVE-2026-20841](https://cve.now/CVE-2026-20841.md): Windows Notepad App Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Notepad)
- [CVE-2026-20846](https://cve.now/CVE-2026-20846.md): GDI+ Denial of Service Vulnerability (CVSS 7.5, Microsoft Office for Android · Microsoft Windows)
- [CVE-2026-21222](https://cve.now/CVE-2026-21222.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-21228](https://cve.now/CVE-2026-21228.md): Azure Local Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Azure Local)
- [CVE-2026-21231](https://cve.now/CVE-2026-21231.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21232](https://cve.now/CVE-2026-21232.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21237](https://cve.now/CVE-2026-21237.md): Windows Subsystem for Linux Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-21238](https://cve.now/CVE-2026-21238.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21239](https://cve.now/CVE-2026-21239.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21241](https://cve.now/CVE-2026-21241.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-21240](https://cve.now/CVE-2026-21240.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21243](https://cve.now/CVE-2026-21243.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2026-21244](https://cve.now/CVE-2026-21244.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2026-21245](https://cve.now/CVE-2026-21245.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21249](https://cve.now/CVE-2026-21249.md): Windows NTLM Spoofing Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2026-21250](https://cve.now/CVE-2026-21250.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21251](https://cve.now/CVE-2026-21251.md): Cluster Client Failover (CCF) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2026-21253](https://cve.now/CVE-2026-21253.md): Mailslot File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-21255](https://cve.now/CVE-2026-21255.md): Windows Hyper-V Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-21256](https://cve.now/CVE-2026-21256.md): GitHub Copilot and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio)
- [CVE-2026-21257](https://cve.now/CVE-2026-21257.md): GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Visual Studio)
- [CVE-2026-21261](https://cve.now/CVE-2026-21261.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-21508](https://cve.now/CVE-2026-21508.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-21511](https://cve.now/CVE-2026-21511.md): Microsoft Outlook Spoofing Vulnerability (CVSS 7.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2026-21516](https://cve.now/CVE-2026-21516.md): GitHub Copilot for Jetbrains Remote Code Execution Vulnerability (CVSS 8.8, Microsoft GitHub Copilot Plugin for JetBrains IDEs)
- [CVE-2026-21525](https://cve.now/CVE-2026-21525.md): Windows Remote Access Connection Manager Denial of Service Vulnerability (CVSS 6.2, KEV, Microsoft Windows)
- [CVE-2026-21514](https://cve.now/CVE-2026-21514.md): Microsoft Word Security Feature Bypass Vulnerability (CVSS 7.8, KEV, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2026-21529](https://cve.now/CVE-2026-21529.md): Azure HDInsight Spoofing Vulnerability (CVSS 5.7, Microsoft Azure HDInsight)
- [CVE-2026-21537](https://cve.now/CVE-2026-21537.md): Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Defender for Endpoint for Linux)
- [CVE-2026-21510](https://cve.now/CVE-2026-21510.md): Windows Shell Security Feature Bypass Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2026-21531](https://cve.now/CVE-2026-21531.md): Azure SDK for Python Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Azure AI Language Authoring · azure-ai-language-c…)
- [CVE-2026-21528](https://cve.now/CVE-2026-21528.md): Azure IoT Explorer Information Disclosure Vulnerability (CVSS 6.5, Microsoft Azure IoT Explorer)
- [CVE-2026-21527](https://cve.now/CVE-2026-21527.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 6.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-21522](https://cve.now/CVE-2026-21522.md): Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft ACI Confidential Containers)
- [CVE-2026-21513](https://cve.now/CVE-2026-21513.md): MSHTML Framework Security Feature Bypass Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2026-21533](https://cve.now/CVE-2026-21533.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2026-21229](https://cve.now/CVE-2026-21229.md): Power BI Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Power BI Report Server)
- [CVE-2026-21523](https://cve.now/CVE-2026-21523.md): GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Visual Studio Code CoPilot Chat Extension · Micro…)
- [CVE-2026-23655](https://cve.now/CVE-2026-23655.md): Microsoft ACI Confidential Containers Information Disclosure Vulnerability (CVSS 6.5, Microsoft ACI Confidential Containers)
- [CVE-2026-21218](https://cve.now/CVE-2026-21218.md): .NET Spoofing Vulnerability (CVSS 7.5, Microsoft .NET · System.Security.Cryptography.Cose)
- [CVE-2026-21236](https://cve.now/CVE-2026-21236.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21234](https://cve.now/CVE-2026-21234.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-21235](https://cve.now/CVE-2026-21235.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2026-21242](https://cve.now/CVE-2026-21242.md): Windows Subsystem for Linux Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-21246](https://cve.now/CVE-2026-21246.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-21247](https://cve.now/CVE-2026-21247.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2026-21248](https://cve.now/CVE-2026-21248.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2026-21260](https://cve.now/CVE-2026-21260.md): Microsoft Outlook Spoofing Vulnerability (CVSS 7.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2026-21258](https://cve.now/CVE-2026-21258.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-21259](https://cve.now/CVE-2026-21259.md): Microsoft Excel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-21512](https://cve.now/CVE-2026-21512.md): Azure DevOps Server Cross-Site Scripting Vulnerability (CVSS 6.5, Microsoft Azure DevOps Server)
- [CVE-2026-21517](https://cve.now/CVE-2026-21517.md): Windows App for Mac Installer Elevation of Privilege Vulnerability (CVSS 4.7, Microsoft Windows App for Mac)
- [CVE-2026-21518](https://cve.now/CVE-2026-21518.md): GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Visual Studio Code CoPilot Chat Extension · Micro…)
- [CVE-2026-21519](https://cve.now/CVE-2026-21519.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2026-25992](https://cve.now/CVE-2026-25992.md): SiYuan has a File Read Interface Case Bypass Vulnerability (CVSS 7.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-21316](https://cve.now/CVE-2026-21316.md): Audition | Access of Memory Location After End of Buffer (CWE-788) (CVSS 5.5, Adobe Audition)
- [CVE-2026-21312](https://cve.now/CVE-2026-21312.md): Audition | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Audition)
- [CVE-2026-21315](https://cve.now/CVE-2026-21315.md): Audition | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Audition)
- [CVE-2026-21313](https://cve.now/CVE-2026-21313.md): Audition | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Audition)
- [CVE-2026-21317](https://cve.now/CVE-2026-21317.md): Audition | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Audition)
- [CVE-2026-21314](https://cve.now/CVE-2026-21314.md): Audition | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Audition)
- [CVE-2026-25993](https://cve.now/CVE-2026-25993.md): EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys (CVSS 9.3, evershopcommerce evershop)
- [CVE-2026-25956](https://cve.now/CVE-2026-25956.md): Frappe Affected by XSS and Open Redirect in Sign Up (CVSS 6.1, frappe)
- [CVE-2026-1996](https://cve.now/CVE-2026-1996.md): Certain HP OfficeJet Pro Printers – Denial of Service (CVSS 6.9, HP OfficeJet Pro 8710 All-in-One Printer series)
- [CVE-2026-25947](https://cve.now/CVE-2026-25947.md): Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation (CVSS 8.8, worklenz)
- [CVE-2026-0651](https://cve.now/CVE-2026-0651.md): Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https (CVSS 6.9, TP-Link Systems Tapo C260 · TP-Link Systems Tapo D235 +2)
- [CVE-2026-25805](https://cve.now/CVE-2026-25805.md): Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning. (CVSS 6.4, zed-industries zed)
- [CVE-2026-0652](https://cve.now/CVE-2026-0652.md): Remote Code Execution on TP-Link Tapo C260 by Guest User (CVSS 8.7, TP-Link Systems Tapo C260)
- [CVE-2026-0653](https://cve.now/CVE-2026-0653.md): Insecure Access Control on TP-Link Tapo D235 and C260 (CVSS 7.2, TP-Link Systems Tapo C260 · TP-Link Systems Tapo D235)
- [CVE-2026-25728](https://cve.now/CVE-2026-25728.md): ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition (CVSS 9.3, MacWarrior clipbucket-v5)
- [CVE-2026-25646](https://cve.now/CVE-2026-25646.md): LIBPNG has a heap buffer overflow in png\_set\_quantize (CVSS 8.3, pnggroup libpng)
- [CVE-2026-25577](https://cve.now/CVE-2026-25577.md): Emmett has an Unhandled CookieError Exception Causing Denial of Service (CVSS 7.5, emmett-framework core · emmett-core)
- [CVE-2026-24045](https://cve.now/CVE-2026-24045.md): Docmost Affected by Stored XSS in Public Share Page (CVSS 7.3, docmost)
- [CVE-2026-25530](https://cve.now/CVE-2026-25530.md): Kanboard is missing authorization check in getSwimlane API allows cross-project data access (CVSS 4.3, kanboard)
- [CVE-2026-24885](https://cve.now/CVE-2026-24885.md): Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment (CVSS 5.7, kanboard)
- [CVE-2025-36522](https://cve.now/CVE-2025-36522.md): Incorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later. (CVSS 5.4, Intel(R) Chipset Software)
- [CVE-2025-36511](https://cve.now/CVE-2025-36511.md): Incorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an e (CVSS 5.4, Intel(R) Memory and Storage Tool)
- [CVE-2025-35999](https://cve.now/CVE-2025-35999.md): Incorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) Server Boards and Int (CVSS 5.4, System Firmware Update Utility (SysFwUpdt) for Intel(R) Ser…)
- [CVE-2025-35998](https://cve.now/CVE-2025-35998.md): Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Rin (CVSS 7.0, Intel(R) Platforms)
- [CVE-2025-35992](https://cve.now/CVE-2025-35992.md): Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. (CVSS 5.7, Intel(R) NPU Drivers)
- [CVE-2025-33030](https://cve.now/CVE-2025-33030.md): Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 3: User Applications may allow an escalation of privile (CVSS 2.0, Intel(R) NPU Drivers)
- [CVE-2025-32739](https://cve.now/CVE-2025-32739.md): Improper conditions check in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow (CVSS 2.0, Intel(R) Graphics Drivers and Intel LTS kernels)
- [CVE-2025-32735](https://cve.now/CVE-2025-32735.md): Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. (CVSS 6.8, Intel(R) NPU Drivers)
- [CVE-2025-32467](https://cve.now/CVE-2025-32467.md): Use of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. (CVSS 5.6, TDX Module)
- [CVE-2025-32453](https://cve.now/CVE-2025-32453.md): Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privil (CVSS 5.4, Intel(R) Graphics Driver software)
- [CVE-2025-32452](https://cve.now/CVE-2025-32452.md): Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an escalation of privil (CVSS 5.4, AI Playground)
- [CVE-2025-32092](https://cve.now/CVE-2025-32092.md): Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Applications may allow an (CVSS 5.4, Intel(R) Graphics Software)
- [CVE-2025-32008](https://cve.now/CVE-2025-32008.md): Out-of-bounds write in the firmware for the Intel(R) AMT and Intel(R) Standard Manageability within Ring 3: User Applications may allow a de (CVSS 8.7, Intel(R) AMT and Intel(R) Standard Manageability)
- [CVE-2025-32007](https://cve.now/CVE-2025-32007.md): Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information disclosure. (CVSS 5.6, TDX)
- [CVE-2025-32003](https://cve.now/CVE-2025-32003.md): Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring (CVSS 6.0, 100GbE Intel(R) Ethernet Network Adapter E810)
- [CVE-2025-31944](https://cve.now/CVE-2025-31944.md): Race condition for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow a denial of service. (CVSS 5.6, TDX Module)
- [CVE-2025-31655](https://cve.now/CVE-2025-31655.md): Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of pri (CVSS 5.4, Intel(R) Battery Life Diagnostic Tool)
- [CVE-2025-31648](https://cve.now/CVE-2025-31648.md): Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. (CVSS 1.8, Intel(R) Processor Family may allow an escalation of privil…)
- [CVE-2025-30513](https://cve.now/CVE-2025-30513.md): Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. (CVSS 8.4, TDX Module)
- [CVE-2025-30508](https://cve.now/CVE-2025-30508.md): Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow a denial of servi (CVSS 6.8, Intel(R) Platforms)
- [CVE-2025-27940](https://cve.now/CVE-2025-27940.md): Out-of-bounds read for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. (CVSS 5.6, TDX Module)
- [CVE-2025-27708](https://cve.now/CVE-2025-27708.md): Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel may (CVSS 5.6, Intel(R) Converged Security and Management Engine (CSME) Fi…)
- [CVE-2025-27572](https://cve.now/CVE-2025-27572.md): Exposure of sensitive information during transient execution for some TDX within Ring 0: Hypervisor may allow an information disclosure. (CVSS 5.6, TDX)
- [CVE-2025-27560](https://cve.now/CVE-2025-27560.md): Loop with unreachable exit condition ('infinite loop') for some Intel(R) Platform within Ring 0: Kernel may allow a denial of service. (CVSS 6.7, Intel(R) Platform)
- [CVE-2025-27535](https://cve.now/CVE-2025-27535.md): Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. (CVSS 5.6, Intel(R) Ethernet Connection E825-C.)
- [CVE-2025-27243](https://cve.now/CVE-2025-27243.md): Out-of-bounds write in the firmware for some Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS ma (CVSS 6.7, Intel(R) Ethernet Controller E810)
- [CVE-2025-25210](https://cve.now/CVE-2025-25210.md): Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may all (CVSS 7.1, Server Firmware Update Utility)
- [CVE-2025-25058](https://cve.now/CVE-2025-25058.md): Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) &amp; 2.2.3. (CVSS 2.0, Intel(R) Ethernet 800-Series)
- [CVE-2025-24851](https://cve.now/CVE-2025-24851.md): Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal (CVSS 6.0, 100GbE Intel(R) Ethernet Controller E810)
- [CVE-2025-22885](https://cve.now/CVE-2025-22885.md): Improper buffer restrictions in the firmware for the TDX Module may allow an escalation of privilege. (CVSS 5.6, TDX Module may allow an escalation of privilege. System sof…)
- [CVE-2025-22849](https://cve.now/CVE-2025-22849.md): Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR\_MGMT\_01.00.00.3584, CR\_MGMT\_02.00.00.4 (CVSS 5.4, Intel(R) Optane(TM) PMem management software)
- [CVE-2025-22453](https://cve.now/CVE-2025-22453.md): Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may all (CVSS 7.1, Server Firmware Update Utility)
- [CVE-2025-20106](https://cve.now/CVE-2025-20106.md): Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 20 (CVSS 5.4, VTune(TM) Profiler software and Intel(R) oneAPI Base Toolki…)
- [CVE-2025-20080](https://cve.now/CVE-2025-20080.md): Null pointer dereference in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability within Ring 0: Kernel may allow a denial (CVSS 8.2, Intel(R) AMT and Intel(R) Standard Manageability)
- [CVE-2025-20070](https://cve.now/CVE-2025-20070.md): Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR\_MGMT\_02.00.00.4052, CR\_MGMT\_03.00.00.0538 (CVSS 5.4, Intel(R) Optane(TM) PMem management software)
- [CVE-2025-62439](https://cve.now/CVE-2025-62439.md): An Improper Verification of Source of a Communication Channel vulnerability \[CWE-940\] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, (CVSS 3.8, Fortinet FortiOS)
- [CVE-2025-62676](https://cve.now/CVE-2025-62676.md): An Improper Link Resolution Before File Access ('Link Following') vulnerability \[CWE-59\] vulnerability in Fortinet FortiClientWindows 7.4.0 (CVSS 6.4, Fortinet FortiClientWindows)
- [CVE-2025-68686](https://cve.now/CVE-2025-68686.md): An Exposure of Sensitive Information to an Unauthorized Actor vulnerability \[CWE-200\] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, (CVSS 5.3, KEV, Fortinet FortiOS)
- [CVE-2025-64157](https://cve.now/CVE-2025-64157.md): A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 (CVSS 6.7, Fortinet FortiOS)
- [CVE-2025-55018](https://cve.now/CVE-2025-55018.md): An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7. (CVSS 5.2, Fortinet FortiOS)
- [CVE-2026-22153](https://cve.now/CVE-2026-22153.md): An Authentication Bypass by Primary Weakness vulnerability \[CWE-305\] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unau (CVSS 7.5, Fortinet FortiOS)
- [CVE-2026-21743](https://cve.now/CVE-2026-21743.md): A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenti (CVSS 6.8, Fortinet FortiAuthenticator)
- [CVE-2025-52436](https://cve.now/CVE-2025-52436.md): An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability \[CWE-79\] vulnerability in Fortinet For (CVSS 7.9, Fortinet FortiSandbox)
- [CVE-2026-1774](https://cve.now/CVE-2026-1774.md): CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability. (CVSS 9.8, CASL Ability · @casl/ability)
- [CVE-2025-15572](https://cve.now/CVE-2025-15572.md): wasm3 NewCodePage memory leak (CVSS 4.8, wasm3)
- [CVE-2025-11004](https://cve.now/CVE-2025-11004.md): Reflected XSS vulnerability in Simplicity Device Manager tool (CVSS 7.5, silabs.com Simplicity Device Manager)
- [CVE-2026-1603](https://cve.now/CVE-2026-1603.md): An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored (CVSS 8.6, KEV, Ivanti Endpoint Manager)
- [CVE-2026-1602](https://cve.now/CVE-2026-1602.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-15571](https://cve.now/CVE-2025-15571.md): ckolivas lrzip stream.c ucompthread null pointer dereference (CVSS 4.8, ckolivas lrzip)
- [CVE-2025-7636](https://cve.now/CVE-2025-7636.md): SQLi in Ergosis Security Systems' ZEUS PDKS (CVSS 8.8, Ergosis Security Systems Computer Industry and Trade ZEUS P…)
- [CVE-2025-7347](https://cve.now/CVE-2025-7347.md): IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System (CVSS 8.8, Dinibh Puzzle Software Solutions Dinibh Patrol Tracking Sys…)
- [CVE-2025-6967](https://cve.now/CVE-2025-6967.md): Authentication Bypass in Sarman Soft's CMS (CVSS 8.7, Sarman Soft Software and Technology Services Industry and T…)
- [CVE-2025-15570](https://cve.now/CVE-2025-15570.md): ckolivas lrzip stream.c lzma\_decompress\_buf use after free (CVSS 4.8, ckolivas lrzip)
- [CVE-2025-11537](https://cve.now/CVE-2025-11537.md): Keycloak-services: sensitive headers shown in the http access logs (CVSS 5.0, Red Hat build of Keycloak · org.keycloak:keycloak-quarkus-s…)
- [CVE-2025-15569](https://cve.now/CVE-2025-15569.md): Artifex MuPDF win\_main.c get\_system\_dpi uncontrolled search path (CVSS 7.3, Artifex MuPDF)
- [CVE-2026-25656](https://cve.now/CVE-2026-25656.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0 SP3), User Management Component (UMC) (All versions \< V2.15.2.1). (CVSS 7.8, Siemens SINEC NMS · Siemens User Management Component)
- [CVE-2026-25655](https://cve.now/CVE-2026-25655.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0 SP2). (CVSS 7.8, Siemens SINEC NMS)
- [CVE-2026-23720](https://cve.now/CVE-2026-23720.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512), Simcenter Nastran (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-23719](https://cve.now/CVE-2026-23719.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512), Simcenter Nastran (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-23718](https://cve.now/CVE-2026-23718.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512), Simcenter Nastran (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-23717](https://cve.now/CVE-2026-23717.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512), Simcenter Nastran (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-23716](https://cve.now/CVE-2026-23716.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512), Simcenter Nastran (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-23715](https://cve.now/CVE-2026-23715.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2512), Simcenter Nastran (All versions \< V2512). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-22923](https://cve.now/CVE-2026-22923.md): A vulnerability has been identified in NX (All versions \< V2512), NX (Managed Mode) (All versions \< V2512). (CVSS 7.8, Siemens NX)
- [CVE-2025-40587](https://cve.now/CVE-2025-40587.md): A vulnerability has been identified in Polarion V2404 (All versions \< V2404.5), Polarion V2410 (All versions \< V2410.2). (CVSS 7.6, Siemens Polarion)
- [CVE-2024-52334](https://cve.now/CVE-2024-52334.md): A vulnerability has been identified in syngo.plaza VB30E (All versions \< VB30E\_HF07). (CVSS 5.3, Siemens syngo.plaza VB30E)
- [CVE-2026-24343](https://cve.now/CVE-2026-24343.md): Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions (CVSS 8.8, Apache Software Foundation Apache HertzBeat)
- [CVE-2026-23906](https://cve.now/CVE-2026-23906.md): Apache Druid: Authentication Bypass via LDAP Anonymous Bind (CVSS 9.8, Apache Software Foundation Apache Druid · org.apache.druid.…)
- [CVE-2025-14895](https://cve.now/CVE-2025-14895.md): PopupKit \<= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion (CVSS 5.4, roxnor Popup builder with Gamification, Multi-Step Popups,…)
- [CVE-2026-1922](https://cve.now/CVE-2026-1922.md): The Events Calendar Shortcode & Block \<= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, brianhogg The Events Calendar Shortcode & Block)
- [CVE-2026-1866](https://cve.now/CVE-2026-1866.md): Name Directory \<= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form (CVSS 7.2, jeroenpeters1986 Name Directory)
- [CVE-2026-2268](https://cve.now/CVE-2026-2268.md): Ninja Forms \<= 3.14.0 - Unauthenticated Information Disclosure in nf\_ajax\_submit AJAX Action (CVSS 7.5, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2026-23901](https://cve.now/CVE-2026-23901.md): Apache Shiro: Brute force attack possible to determine valid user names (CVSS 1.0, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2025-11242](https://cve.now/CVE-2025-11242.md): SSRF in Teknolist Computer's Okulistik (CVSS 9.8, Teknolist Computer Systems Software Publishing Industry and…)
- [CVE-2026-1722](https://cve.now/CVE-2026-1722.md): WCFM Marketplace \<= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation (CVSS 5.3, wclovers WCFM Marketplace – Multivendor Marketplace for Woo…)
- [CVE-2026-2099](https://cve.now/CVE-2026-2099.md): Flowring｜AgentFlow - Stored Cross-Site Scripting (CVSS 5.1, Flowring AgentFlow)
- [CVE-2026-2098](https://cve.now/CVE-2026-2098.md): Flowring｜AgentFlow - Reflected Cross-site Scripting (CVSS 5.1, Flowring AgentFlow)
- [CVE-2026-2097](https://cve.now/CVE-2026-2097.md): Flowring｜Agentflow - Arbitrary File Upload (CVSS 8.7, Flowring Agentflow)
- [CVE-2026-2096](https://cve.now/CVE-2026-2096.md): Flowring｜Agentflow - Missing Authenticaton (CVSS 9.3, Flowring Agentflow)
- [CVE-2026-2095](https://cve.now/CVE-2026-2095.md): Flowring｜Agentflow - Authentication Bypass (CVSS 9.3, Flowring Agentflow)
- [CVE-2026-2094](https://cve.now/CVE-2026-2094.md): Flowring｜Docpedia - SQL Injection (CVSS 8.7, Flowring Docpedia)
- [CVE-2026-2093](https://cve.now/CVE-2026-2093.md): Flowring｜Docpedia - SQL Injection (CVSS 8.7, Flowring Docpedia)
- [CVE-2025-12063](https://cve.now/CVE-2025-12063.md): An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permiss (CVSS 5.7, Axis Communications AB AXIS Camera Station Pro)
- [CVE-2025-12757](https://cve.now/CVE-2025-12757.md): An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to. (CVSS 4.6, Axis Communications AB AXIS Camera Station Pro)
- [CVE-2025-13064](https://cve.now/CVE-2025-13064.md): A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by (CVSS 4.5, Axis Communications AB AXIS Camera Station Pro)
- [CVE-2025-11547](https://cve.now/CVE-2025-11547.md): AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. (CVSS 7.8, Axis Communications AB AXIS Camera Station Pro)
- [CVE-2025-11142](https://cve.now/CVE-2025-11142.md): The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. (CVSS 7.1, Axis Communications AB AXIS OS)
- [CVE-2026-0996](https://cve.now/CVE-2026-0996.md): Fluent Forms \<= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module (CVSS 6.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2026-24328](https://cve.now/CVE-2026-24328.md): Open Redirection vulnerability in Business Server Pages Application (TAF\_APPLAUNCHER) (CVSS 6.1, SAP\_SE Business Server Pages Application)
- [CVE-2026-24327](https://cve.now/CVE-2026-24327.md): Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application) (CVSS 4.3, SAP\_SE SAP Strategic Enterprise Management)
- [CVE-2026-24326](https://cve.now/CVE-2026-24326.md): Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations) (CVSS 4.3, SAP\_SE SAP S/4HANA Defense & Security)
- [CVE-2026-24325](https://cve.now/CVE-2026-24325.md): Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console) (CVSS 4.8, SAP\_SE SAP BusinessObjects Enterprise)
- [CVE-2026-24324](https://cve.now/CVE-2026-24324.md): Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) (CVSS 6.5, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2026-24323](https://cve.now/CVE-2026-24323.md): Multiple vulnerabilities in BSP Applications of SAP Document Management System (CVSS 6.1, SAP\_SE SAP Document Management System)
- [CVE-2026-24322](https://cve.now/CVE-2026-24322.md): Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) (CVSS 7.7, SAP\_SE SAP Solution Tools Plug-In)
- [CVE-2026-24321](https://cve.now/CVE-2026-24321.md): Information Disclosure vulnerability in SAP Commerce Cloud (CVSS 5.3, SAP\_SE SAP Commerce Cloud)
- [CVE-2026-24320](https://cve.now/CVE-2026-24320.md): Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) (CVSS 3.1, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2026-24319](https://cve.now/CVE-2026-24319.md): Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files) (CVSS 5.8, SAP\_SE SAP Business One)
- [CVE-2026-24312](https://cve.now/CVE-2026-24312.md): Missing authorization check in SAP Business Workflow (CVSS 5.2, SAP\_SE SAP Business Workflow)
- [CVE-2026-23689](https://cve.now/CVE-2026-23689.md): Denial of service (DOS) in SAP Supply Chain Management (CVSS 7.7, SAP\_SE SAP Supply Chain Management)
- [CVE-2026-23688](https://cve.now/CVE-2026-23688.md): Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services) (CVSS 4.3, SAP\_SE SAP Fiori App)
- [CVE-2026-23687](https://cve.now/CVE-2026-23687.md): XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform (CVSS 8.8, SAP\_SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2026-23686](https://cve.now/CVE-2026-23686.md): CRLF Injection vulnerability in SAP NetWeaver Application Server Java (CVSS 3.4, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2026-23685](https://cve.now/CVE-2026-23685.md): Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) (CVSS 4.4, SAP\_SE SAP NetWeaver)
- [CVE-2026-23684](https://cve.now/CVE-2026-23684.md): Race condition vulnerability in SAP Commerce Cloud (CVSS 5.9, SAP\_SE SAP Commerce Cloud)
- [CVE-2026-2260](https://cve.now/CVE-2026-2260.md): D-Link DCS-931L setSysAdmin os command injection (CVSS 8.6, D-Link DCS-931L)
- [CVE-2026-23681](https://cve.now/CVE-2026-23681.md): Missing Authorization check in a function module in SAP Support Tools Plug-In (CVSS 4.3, SAP\_SE SAP Support Tools Plug-In)
- [CVE-2026-0509](https://cve.now/CVE-2026-0509.md): Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 9.6, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2026-0508](https://cve.now/CVE-2026-0508.md): Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 7.3, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2026-0505](https://cve.now/CVE-2026-0505.md): Multiple vulnerabilities in BSP Applications of SAP Document Management System (CVSS 6.1, SAP\_SE SAP Document Management System)
- [CVE-2026-0490](https://cve.now/CVE-2026-0490.md): Denial of service (DOS) in SAP BusinessObjects BI Platform (CVSS 7.5, SAP\_SE SAP BusinessObjects BI Platform)
- [CVE-2026-0488](https://cve.now/CVE-2026-0488.md): Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) (CVSS 9.9, SAP\_SE SAP CRM and SAP S/4HANA)
- [CVE-2026-0486](https://cve.now/CVE-2026-0486.md): Missing Authorization Check in ABAP based SAP systems (CVSS 5.0, SAP\_SE ABAP based SAP systems)
- [CVE-2026-0485](https://cve.now/CVE-2026-0485.md): Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform (CVSS 7.5, SAP\_SE SAP BusinessObjects BI Platform)
- [CVE-2026-0484](https://cve.now/CVE-2026-0484.md): Missing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA (CVSS 6.5, SAP\_SE SAP NetWeaver Application Server ABAP and SAP S/4HANA)
- [CVE-2026-2259](https://cve.now/CVE-2026-2259.md): aardappel lobster Parsing parser.h ParseStatements memory corruption (CVSS 4.8, aardappel lobster)
- [CVE-2026-2258](https://cve.now/CVE-2026-2258.md): aardappel lobster wfc.h WaveFunctionCollapse memory corruption (CVSS 4.8, aardappel lobster)
- [CVE-2024-54192](https://cve.now/CVE-2024-54192.md): An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial of service via a crafted file to the tcpedit\_dlt\_getplugin function at (CVSS 5.5)
- [CVE-2025-70347](https://cve.now/CVE-2025-70347.md): An issue in mquickjs before commit 74b7e (2026-01-15) allows a local attacker to cause a denial of service via a crafted file to the get\_mbl (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.