CVEs published February 11, 2026
325 CVEs were published on February 11, 2026: 18 critical, 90 high. 1 is now in CISA KEV.
- Published
- 325
- Critical
- 18
- High
- 90
- Medium
- 163
- Low
- 54
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 184
Most affected products
- QNAP Systems Qsync Central
- 28
- Apple macOS
- 24
- Apple iOS and iPadOS · Apple macOS +3
- 17
- GitLab
- 15
- QNAP Systems File Station
- 13
- Apple iOS and iPadOS
- 11
- Google Chrome
- 11
- Apple iOS and iPadOS · Apple macOS +1
- 7
- Apple Safari · Apple iOS and iPadOS +2
- 6
- Apple iOS and iPadOS · Apple macOS
- 4
Critical 18
- CVE-2026-20677A race condition was addressed with improved handling of symbolic links.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-26215manga-image-translator Shared API Unsafe Deserialization RCEzyddnys manga-image-translator
- CVE-2026-26021Prototype pollution in set-inahdinosaur set-in · set-in
- CVE-2020-37186Chevereto 3.13.4 Core - Remote Code ExecutionChevere SpA Chevereto
- CVE-2026-24789ZLAN Information Technology ZLAN5143D Missing Authentication for Critical FunctionZLAN Information Technology ZLAN5143D
- CVE-2026-25084ZLAN Information Technology ZLAN5143D Missing Authentication for Critical FunctionZLAN Information Technology ZLAN5143D
- CVE-2026-2249Unauthenticated Remote Command Execution via Web Console in METIS DFSMETIS Cyberspace Technology SA METIS DFS
- CVE-2026-2248Unauthenticated Remote Root Shell Access via Web Console in METIS WICMETIS Cyberspace Technology SA METIS WIC
- CVE-2025-12059Improper Access Control in Logo Software's Logo j-PlatformLogo Software Industry and Trade Logo j-Platform
- CVE-2025-8668Reflected XSS in E-Kalite Software Hardware Engineering's TurboardE-Kalite Software Hardware Engineering Design and Internet…
- CVE-2025-8025Improper Access Control in Dinosoft Business Solutions' Dinosoft ERPDinosoft Business Solutions Dinosoft ERP
- CVE-2025-66277QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2026-1357Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Uploadwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2025-64075A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to
- CVE-2025-67135Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay
- CVE-2025-69872DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.diskcache
- CVE-2025-69874nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary finanotar
- CVE-2025-70085An issue was discovered in OpenSatKit 2.2.1.
High 90
- CVE-2026-20652The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20700A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20628A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20658A package validation issue was addressed by blocking the vulnerable package.Apple macOS
- CVE-2026-20615A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20614A path handling issue was addressed with improved validation.Apple macOS
- CVE-2025-46290A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20675The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20617A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20616An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20641A privacy issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20620An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2026-20650A denial-of-service issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20611An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20626This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20667A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20610This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2026-20606This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS
- CVE-2026-1669Arbitrary File Read in Keras via HDF5 External DatasetsGoogle Keras · keras
- CVE-2026-26029sf-mcp-server has a Command Injection in query_records tool due to unsafe use of child_process.execakutishevsky sf-mcp-server
- CVE-2026-26010Leaky JWTs in OpenMetadata exposing highly-privileged bot usersopen-metadata OpenMetadata · org.open-metadata:openmetadata…
- CVE-2026-25999Klaw has an improper authorisation check on /resetMemoryCacheAiven-Open klaw
- CVE-2026-25994PJSIP has a heap buffer overflow in ICE with long usernamepjsip pjproject
- CVE-2026-25990Pillow has an out-of-bounds write when loading PSD imagespython-pillow Pillow · pillow
- CVE-2020-37158AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)AVideo Platform
- CVE-2020-37153ASTPP VoIP 4.0.1 - Remote Code ExecutionASTPP
- CVE-2020-37104ASTPP 4.0.1 VoIP Billing - Database Backup DownloadASTPP
- CVE-2026-25935Vikunja Affected by XSS Via Task Previewgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-25924Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCEkanboard
- CVE-2026-25759Statmatic affected by privilege escalation via stored cross-site scriptingstatamic cms · statamic/cms
- CVE-2020-37214Voyager 1.3.0 - Directory TraversalThe Control Group Voyager
- CVE-2020-37184Allok Video Converter 4.6.1217 - Stack Overflow (SEH)Allok Soft Allok Video Converter
- CVE-2020-37183Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 - Stack Overflow (SEH)Allok Soft Allok RM RMVB to AVI MPEG DVD Converter
- CVE-2020-37182Redir 3.3 - Denial of Servicetroglobit Redir
- CVE-2020-37176Torrent 3GP Converter 1.51 - Stack Overflow (SEH)Torrentrockyou Torrent 3GP Converter
- CVE-2020-37173AVideo Platform 8.1 - Information Disclosure (User Enumeration)AVideo Platform
- CVE-2020-37172AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)AVideo Platform
- CVE-2026-26158Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entriesRed Hat Hardened Images · Red Hat Enterprise Linux
- CVE-2026-26157Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitizationRed Hat Hardened Images · Red Hat Enterprise Linux
- CVE-2025-64487Outline is vulnerable to privilege escalation vulnerability in document sharingoutline
- CVE-2026-2321Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2026-2319Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures anGoogle Chrome
- CVE-2026-2315Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of boundGoogle Chrome
- CVE-2026-2314Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2026-2313Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2026-2361Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privilegesDALIBO PostgreSQL Anonymizer
- CVE-2026-2360Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14DALIBO PostgreSQL Anonymizer
- CVE-2026-1837libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2Google libjxl
- CVE-2019-25310ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service PathActfax ActiveFax Server
- CVE-2019-25309Zilab Remote Console Server 3.2.9 - 'Zilab Remote Console Server' Unquoted Service PathZilab Software Zilab Remote Console Server
- CVE-2019-25308Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Service PathLiteManager Team Mikogo
- CVE-2019-25307WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service PathSoftalk WorkgroupMail
- CVE-2019-25306BlackMoon FTP Server 3.1.2.1731 - 'BMFTP-RELEASE' Unquoted Serive PathBlackMoon FTP Server
- CVE-2026-2344Stored XSS on Plunet BusinessManagerPlunet BusinessManager
- CVE-2025-61969Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resultiAMD µProf
- CVE-2025-52541A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary codAMD Vivado™ Installation
- CVE-2023-20548A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting inAMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +6
- CVE-2023-31324A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global MemoAMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +4
- CVE-2024-36320Integer Overflow within atihdwt6.sys can allow a local attacker to cause out of bound read/write potentially leading to loss of confidentialAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +35
- CVE-2023-20514Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to funAMD Radeon™ RX 6000 Series Graphics Products · AMD Radeo… +6
- CVE-2024-36324Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitAMD Ryzen™ 6000 Series Processors with Radeon™ Graphics… +20
- CVE-2025-48503A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting inAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +22
- CVE-2026-2250Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WICMETIS Cyberspace Technology SA METIS WIC
- CVE-2026-1226CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the apSchneider Electric EcoStruxure Building Operation Workstati…
- CVE-2026-1227CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files,Schneider Electric EcoStruxure Building Operation Workstati…
- CVE-2026-2337Refleccted XSS on Plunet BusinessManagerPlunet BusinessManager
- CVE-2026-0910wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injectiontomdever wpForo Forum
- CVE-2025-10174Improper Access Control in Pan Software's PanCafe ProPan Software & Information Technologies PanCafe Pro
- CVE-2025-7659Origin Validation Error in GitLabGitLab
- CVE-2025-8099Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-14560Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-0595Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-0958Interpretation Conflict in GitLabGitLab
- CVE-2025-15096Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeoverkamleshyadav Videospirecore Theme Plugin
- CVE-2025-9986Improper Access Control in Vadi Corporate Information System's DIGIKENTVadi Corporate Information Systems Ltd. DIGIKENT
- CVE-2026-1560Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Executionnko Custom Block Builder – Lazy Blocks
- CVE-2025-15440iONE360 configurator <= 2.0.57 - Unauthenticated Stored Cross-Site Scripting via Contact Form ParametersiONE360 configurator
- CVE-2025-10913XSS in saastech.io's TemizlikYoldaSaastech Cleaning and Internet Services TemizlikYolda
- CVE-2025-14541Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parametervillatheme Lucky Wheel Giveaway
- CVE-2024-26477An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth,
- CVE-2024-26480An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the admin parameter.
- CVE-2024-50617Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthoriz
- CVE-2024-50619Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access
- CVE-2024-50620Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner C
- CVE-2025-65128A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthe
- CVE-2025-65480An issue was discovered in Pacom Unison Client 5.13.1.
- CVE-2025-69871A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module.
- CVE-2025-70029An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information.
- CVE-2025-70083An issue was discovered in OpenSatKit 2.2.1.
- CVE-2025-70084Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via
Medium, low and unrated 217
- CVE-2026-20629A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2026-20644The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20605The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2026-20625A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS · Apple visionOS
- CVE-2026-20648A privacy issue was addressed by moving sensitive data to a protected location.Apple macOS
- CVE-2026-20609The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20608This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20649A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20624An injection issue was addressed with improved validation.Apple macOS
- CVE-2026-20673A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2025-46310This issue was addressed through improved state management.Apple macOS
- CVE-2026-20653A parsing issue in the handling of directory paths was addressed with improved path validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20645An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-20612A privacy issue was addressed with improved checks.Apple macOS
- CVE-2026-20669A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2026-20674A privacy issue was addressed by removing sensitive data.Apple iOS and iPadOS
- CVE-2026-20623A permissions issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2026-20635The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-20662An authorization issue was addressed with improved state management.Apple macOS
- CVE-2025-46301The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20619A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2026-20678An authorization issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-20681A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2026-20642An input validation issue was addressed.Apple iOS and iPadOS
- CVE-2026-20654The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20603This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2026-20602The issue was addressed with improved handling of caches.Apple macOS
- CVE-2026-20655An authorization issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-20680The issue was addressed with additional restrictions on the observability of app states.Apple iOS and iPadOS · Apple macOS
- CVE-2026-20638A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2026-20618An issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2026-20663The issue was resolved by sanitizing logging.Apple iOS and iPadOS
- CVE-2025-43417A path handling issue was addressed with improved logic.Apple macOS
- CVE-2025-46300The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20634The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-46303The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20660A path handling issue was addressed with improved logic.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20621The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20676This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20601A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-20656A logic issue was addressed with improved validation.Apple Safari · Apple iOS and iPadOS +1
- CVE-2026-20640An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-20682A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2025-43403An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-20636The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-46302The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20661An authorization issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-20646A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2025-46305The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20666An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-20627An issue existed in the handling of environment variables.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20671A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20630A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-46304The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20647This issue was addressed with improved data protection.Apple macOS
- CVE-2025-43537A path handling issue was addressed with improved validation.Apple iOS and iPadOS
- CVE-2026-26031Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled studentsfrappe lms
- CVE-2026-26023Client‑side DOM XSS in the web chat app of Dify when using echartslanggenius dify
- CVE-2026-26012vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissionsdani-garcia vaultwarden
- CVE-2026-26019@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validationlangchain-ai langchainjs · @langchain/community
- CVE-2026-26014Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication keypion dtls · github.com/pion/dtls +2
- CVE-2020-37156BloodX 1.0 - Authentication Bypassdiveshlunker BloodX
- CVE-2019-25313FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)Flexera Software FlexNet Publisher
- CVE-2020-37215MSN Password Recovery 1.30 - Denial of ServiceTop Password Software MSN Password Recovery
- CVE-2020-37213TextCrawler Pro3.1.1 - Denial of ServiceDigitalVolcano Software TextCrawler Pro
- CVE-2020-37212SpotMSN 2.4.6 - 'Name' Denial of ServiceNsasoft Nsauditor SpotMSN
- CVE-2020-37211SpotIM 2.2 - 'Name' Denial Of ServiceNsasoft Nsauditor SpotIM
- CVE-2020-37210SpotIE 2.9.5 - 'Key' Denial of ServiceNsasoft Nsauditor SpotIE
- CVE-2020-37209SpotFTP FTP Password Recovery 3.0.0.0 - 'Name' Denial of ServiceNsasoft Nsauditor SpotFTP FTP Password Recovery
- CVE-2020-37208SpotFTP FTP Password Recovery 3.0.0.0 - 'Key' Denial of ServiceNsasoft Nsauditor SpotFTP FTP Password Recovery
- CVE-2020-37207SpotDialup 1.6.7 - 'Key' Denial of ServiceNsasoft Nsauditor SpotDialup
- CVE-2020-37206ShareAlarmPro Advanced Network Access Control - 'Key' Denial of ServiceNsasoft Nsauditor ShareAlarmPro Advanced Network Access Con…
- CVE-2020-37205RemShutdown 2.9.0.0 - 'Name' Denial of ServiceNsasoft Nsauditor RemShutdown
- CVE-2020-37204RemShutdown 2.9.0.0 - 'Key' Denial of ServiceNsauditor RemShutdown
- CVE-2020-37203Office Product Key Finder 1.5.4 - Denial of ServiceNsasoft Nsauditor Office Product Key Finder
- CVE-2020-37202NetworkSleuth 3.0.0.0 - 'Key' Denial of ServiceNsasoft Nsauditor NetworkSleuth
- CVE-2020-37201NetShareWatcher 1.5.8.0 - 'Name' Denial Of ServiceNsasoft Nsauditor NetShareWatcher
- CVE-2020-37200NetShareWatcher 1.5.8.0 - 'Key' Denial of ServiceNsasoft Nsauditor NetShareWatcher
- CVE-2020-37199NBMonitor 1.6.6.0 - 'Key' Denial of ServiceNsasoft Nsauditor NBMonitor
- CVE-2020-37198Duplicate Cleaner Pro 4 - Denial of ServiceDigitalVolcano Software Duplicate Cleaner Pro
- CVE-2020-37197Dnss Domain Name Search Software - 'Name' Denial of ServiceNsasoft Nsauditor Dnss Domain Name Search Software
- CVE-2020-37196Dnss Domain Name Search Software - 'Key' Denial of ServiceNsasoft Nsauditor Dnss Domain Name Search Software
- CVE-2020-37195BlueAuditor 1.7.2.0 - 'Name' Denial of ServiceNsasoft BlueAuditor
- CVE-2020-37194Backup Key Recovery Recover Keys Crashed Hard Disk Drive 2.2.5 - 'Key' Denial of ServiceNsasoft Nsauditor Backup Key Recovery Recover Keys Crashed…
- CVE-2020-37193ZIP Password Recovery 2.30 - 'ZIP File' Denial of ServiceTop Password Software ZIP Password Recovery
- CVE-2020-37192MSN Password Recovery 1.30 - XML External Entity InjectionTop Password Software MSN Password Recovery
- CVE-2020-37191Top Password Software Dialup Password Recovery 1.30 - Denial of ServiceTop Password Software Dialup Password Recovery
- CVE-2020-37190Top Password Firefox Password Recovery 2.8 - Denial of ServiceTop Password Software Top Password Firefox Password Recovery
- CVE-2020-37189TaskCanvas 1.4.0 - 'Registration' Denial Of ServiceDigitalVolcano Software TaskCanvas
- CVE-2020-37188SpotOutlook 1.2.6 - 'Name' Denial of ServiceNsasoft Nsauditor SpotOutlook
- CVE-2020-37187SpotDialup 1.6.7 - 'Name' Denial of ServiceNsasoft Nsauditor SpotDialup
- CVE-2020-37185Backup Key Recovery 2.2.5 - 'Name' Denial of ServiceNsasoft Nsauditor Backup Key Recovery
- CVE-2020-37181Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite)TorrentRockYou Torrent FLV Converter
- CVE-2020-37180GTalk Password Finder 2.2.1 - 'Key' Denial of ServiceNsasoft Nsauditor GTalk Password Finder
- CVE-2020-37179APKF Product Key Finder 2.5.8.0 - 'Name' Denial of ServiceNsasoft Nsauditor APKF Product Key Finder
- CVE-2020-37178KeePass 2.44 - Denial of Service (PoC)KeePass Password Safe
- CVE-2020-37177BOOTP Turbo 2.0 - Denial of Service (SEH)Weird Solutions BOOTP Turbo
- CVE-2020-37175P2PWIFICAM2 for iOS 10.4.1 - 'Camera ID' Denial of ServiceKa Ming Cheung P2PWIFICAM2 for iOS
- CVE-2026-25633Statamic's missing authorization allows access to assetsstatamic cms · statamic/cms
- CVE-2025-68663Outline has a suspended user authentication bypass via WebSocket connectionsoutline
- CVE-2026-25062Outline Affected an Arbitrary File Read via Path Traversal in JSON Importoutline
- CVE-2026-2323Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-2322Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2026-2320Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2026-2318Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to eGoogle Chrome
- CVE-2026-2317Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-2316Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-0229PAN-OS: Denial of Service in Advanced DNS Security FeaturePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0228PAN-OS: Improper Validation of Terminal Server Agent CertificatePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-13391Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File DeletionMooMoo Product Options and Price Calculation Formulas for W…
- CVE-2026-25869MiniGal Nano <= 0.3.5 Path Traversal via dir ParameterMiniGal Nano
- CVE-2026-25868MiniGal Nano <= 0.3.5 Reflected XSS via dir ParameterMiniGal Nano
- CVE-2025-12474libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handlingGoogle libjxl
- CVE-2019-25317Kimai 2- persistent cross-site scripting (XSS)kevinpapst Kimai · kimai/kimai
- CVE-2019-25316GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site ScriptingGOautodial
- CVE-2019-25315WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scriptinganttiviljami WP Server Log Viewer
- CVE-2019-25314Duplicate-Post 3.2.3 - Persistent Cross-Site ScriptingYoast Duplicate-Post
- CVE-2019-25312InoERP 0.7.2 - Persistent Cross-Site ScriptingInoIdeas InoERP
- CVE-2019-25311thesystem Persistent XSSkostasmitroglou thesystem
- CVE-2018-25157Phraseanet 4.0.3 Stored XSS via Document UploadPhraseanet DAM Open Source · phraseanet/phraseanet
- CVE-2026-2345Insufficient Origin Validation in Proctorio Chrome Extension postMessage HandlersProctorio Secure Exam Proctor Extension
- CVE-2025-48518Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Gr… +8
- CVE-2025-48508Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control AMD Radeon™ PRO
- CVE-2024-36316The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a deniaAMD Ryzen™ 6000 Series Processors with Radeon™ Graphics… +13
- CVE-2024-56807Media Streaming add-onQNAP Systems Media Streaming add-on
- CVE-2024-56808Media Streaming add-onQNAP Systems Media Streaming add-on
- CVE-2025-30266Qsync CentralQNAP Systems Qsync Central
- CVE-2025-30269Qsync CentralQNAP Systems Qsync Central
- CVE-2025-30276Qsync CentralQNAP Systems Qsync Central
- CVE-2025-47205QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-47209Qsync CentralQNAP Systems Qsync Central
- CVE-2025-48722Qsync CentralQNAP Systems Qsync Central
- CVE-2025-48723Qsync CentralQNAP Systems Qsync Central
- CVE-2025-48724Qsync CentralQNAP Systems Qsync Central
- CVE-2025-48725QuTS heroQNAP Systems QuTS hero
- CVE-2025-52868Qsync CentralQNAP Systems Qsync Central
- CVE-2025-52869Qsync CentralQNAP Systems Qsync Central
- CVE-2025-52870Qsync CentralQNAP Systems Qsync Central
- CVE-2025-53598Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54146Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54147Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54148Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54149Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54150Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54151Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54152Qsync CentralQNAP Systems Qsync Central
- CVE-2025-54155File Station 5QNAP Systems File Station
- CVE-2025-54161File Station 5QNAP Systems File Station
- CVE-2025-54162File Station 5QNAP Systems File Station
- CVE-2025-54163File Station 5QNAP Systems File Station
- CVE-2025-54169File Station 5QNAP Systems File Station
- CVE-2025-54170Qsync CentralQNAP Systems Qsync Central
- CVE-2025-57707File Station 5QNAP Systems File Station
- CVE-2025-57708Qsync CentralQNAP Systems Qsync Central
- CVE-2025-57709Qsync CentralQNAP Systems Qsync Central
- CVE-2025-57710Qsync CentralQNAP Systems Qsync Central
- CVE-2025-57711Qsync CentralQNAP Systems Qsync Central
- CVE-2025-57713File Station 5QNAP Systems File Station
- CVE-2025-58466QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-58467Qsync CentralQNAP Systems Qsync Central
- CVE-2025-58470Qsync CentralQNAP Systems Qsync Central
- CVE-2025-58471Qsync CentralQNAP Systems Qsync Central
- CVE-2025-58472Qsync CentralQNAP Systems Qsync Central
- CVE-2025-59386QuTS heroQNAP Systems QuTS hero
- CVE-2025-62853File Station 5QNAP Systems File Station
- CVE-2025-62854File Station 5QNAP Systems File Station
- CVE-2025-62855File Station 5QNAP Systems File Station
- CVE-2025-62856File Station 5QNAP Systems File Station
- CVE-2025-66274QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-66278File Station 5QNAP Systems File Station
- CVE-2025-68406Qsync CentralQNAP Systems Qsync Central
- CVE-2026-22894File Station 5QNAP Systems File Station
- CVE-2025-12073Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2025-12575Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2025-14594Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2025-14592Missing Authorization in GitLabGitLab
- CVE-2026-1080Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-1094Improper Validation of Unsafe Equivalence in Input in GitLabGitLab
- CVE-2026-1282Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabGitLab
- CVE-2026-1387Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-1456Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-1458Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-2295WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_moreWPZOOM Addons for Elementor – Starter Templates & Widgets
- CVE-2025-13651LEAK OF SENSITIVE INFORMATION ON MICROCOM'S ZEUSWEBMicrocom ZeusWeb
- CVE-2025-13650REFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEBMicrocom ZeusWeb
- CVE-2025-13649REFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEBMicrocom ZeusWeb
- CVE-2025-13648STORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEBMicrocom ZeusWeb
- CVE-2026-1827IDE Micro code-editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attributeluke-alford IDE Micro code-editor
- CVE-2026-0815Category Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameterpankajanupam Category Image
- CVE-2026-1833WaMate Confirm <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblockingsm_rasmy WaMate Confirm – Order Confirmation
- CVE-2026-1826OpenPOS Lite <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesOpenPOS Lite – Point of Sale for WooCommerce
- CVE-2026-1786Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Updatebadbreze Twitter posts to Blog
- CVE-2026-1809HTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesjhoylman HTML Shortcodes
- CVE-2026-0724WPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameterwecodify WPlyr Media Block
- CVE-2026-1748Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposurekirilkirkov Invoct – PDF Invoices & Billing for WooCommerce
- CVE-2026-1215MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Updatemessagemetric MMA Call Tracking
- CVE-2026-1853BuddyHolis ListSearch <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attributedigiblogger BuddyHolis ListSearch
- CVE-2026-1804WDES Responsive Popup <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attributemaster-buldog WDES Responsive Popup
- CVE-2026-1821Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesMicrotango
- CVE-2026-1885Slideshow Wp <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attributeaumsrini Slideshow Wp
- CVE-2025-10912IDOR in saastech.io's TemizlikYoldaSaastech Cleaning and Internet Services TemizlikYolda
- CVE-2026-1235WP eCommerce <= 3.15.1 - Unauthenticated PHP Object InjectionWP eCommerce
- CVE-2025-15400OpenPix <= 2.13.3 - Subscriber+ Payment Gateway Settings ResetOpenPix for WooCommerce
- CVE-2026-1893Orbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attributelordspace Orbisius Random Name Generator
- CVE-2026-26079Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.Roundcube Webmail
- CVE-2025-13431SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameterveronalabs SlimStat Analytics
- CVE-2026-1231Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settingsbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2025-15524Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposurefooplugins Gallery by FooGallery
- CVE-2026-1571Reflected XSS Vulnerability on TP-Link Archer C60TP-Link Systems Archer C60
- CVE-2024-26478An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint.
- CVE-2024-26479An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Command execution function.
- CVE-2024-50618A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to byp
- CVE-2025-64074A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to
- CVE-2025-65127A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated at
- CVE-2025-69873ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enaajv.js ajv · ajv
- CVE-2025-70296A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject ar
- CVE-2025-70297A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authe