# CVEs published 2026-02-11

325 CVEs were published on February 11, 2026: 18 critical, 90 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-20629](https://cve.now/CVE-2026-20629.md): A privacy issue was addressed with improved handling of temporary files. (CVSS 5.5, Apple macOS)
- [CVE-2026-20644](https://cve.now/CVE-2026-20644.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-20652](https://cve.now/CVE-2026-20652.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-20605](https://cve.now/CVE-2026-20605.md): The issue was addressed with improved memory handling. (CVSS 4.6, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-20625](https://cve.now/CVE-2026-20625.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS · Apple visionOS)
- [CVE-2026-20648](https://cve.now/CVE-2026-20648.md): A privacy issue was addressed by moving sensitive data to a protected location. (CVSS 5.5, Apple macOS)
- [CVE-2026-20609](https://cve.now/CVE-2026-20609.md): The issue was addressed with improved memory handling. (CVSS 4.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20608](https://cve.now/CVE-2026-20608.md): This issue was addressed through improved state management. (CVSS 5.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-20649](https://cve.now/CVE-2026-20649.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-20624](https://cve.now/CVE-2026-20624.md): An injection issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-20673](https://cve.now/CVE-2026-20673.md): A logic issue was addressed with improved checks. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-46310](https://cve.now/CVE-2025-46310.md): This issue was addressed through improved state management. (CVSS 6.0, Apple macOS)
- [CVE-2026-20653](https://cve.now/CVE-2026-20653.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-20700](https://cve.now/CVE-2026-20700.md): A memory corruption issue was addressed with improved state management. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20645](https://cve.now/CVE-2026-20645.md): An inconsistent user interface issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-20612](https://cve.now/CVE-2026-20612.md): A privacy issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-20669](https://cve.now/CVE-2026-20669.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-20628](https://cve.now/CVE-2026-20628.md): A permissions issue was addressed with additional restrictions. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20674](https://cve.now/CVE-2026-20674.md): A privacy issue was addressed by removing sensitive data. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-20623](https://cve.now/CVE-2026-20623.md): A permissions issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2026-20635](https://cve.now/CVE-2026-20635.md): The issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-20662](https://cve.now/CVE-2026-20662.md): An authorization issue was addressed with improved state management. (CVSS 4.6, Apple macOS)
- [CVE-2025-46301](https://cve.now/CVE-2025-46301.md): The issue was addressed with improved bounds checks. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20619](https://cve.now/CVE-2026-20619.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple macOS)
- [CVE-2026-20658](https://cve.now/CVE-2026-20658.md): A package validation issue was addressed by blocking the vulnerable package. (CVSS 7.8, Apple macOS)
- [CVE-2026-20678](https://cve.now/CVE-2026-20678.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2026-20681](https://cve.now/CVE-2026-20681.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS)
- [CVE-2026-20615](https://cve.now/CVE-2026-20615.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-20642](https://cve.now/CVE-2026-20642.md): An input validation issue was addressed. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2026-20654](https://cve.now/CVE-2026-20654.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20603](https://cve.now/CVE-2026-20603.md): This issue was addressed with improved redaction of sensitive information. (CVSS 4.4, Apple macOS)
- [CVE-2026-20602](https://cve.now/CVE-2026-20602.md): The issue was addressed with improved handling of caches. (CVSS 5.5, Apple macOS)
- [CVE-2026-20655](https://cve.now/CVE-2026-20655.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2026-20614](https://cve.now/CVE-2026-20614.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-20680](https://cve.now/CVE-2026-20680.md): The issue was addressed with additional restrictions on the observability of app states. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-20638](https://cve.now/CVE-2026-20638.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2025-46290](https://cve.now/CVE-2025-46290.md): A logic issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-20618](https://cve.now/CVE-2026-20618.md): An issue was addressed with improved handling of temporary files. (CVSS 5.5, Apple macOS)
- [CVE-2026-20663](https://cve.now/CVE-2026-20663.md): The issue was resolved by sanitizing logging. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2025-43417](https://cve.now/CVE-2025-43417.md): A path handling issue was addressed with improved logic. (CVSS 5.5, Apple macOS)
- [CVE-2025-46300](https://cve.now/CVE-2025-46300.md): The issue was addressed with improved bounds checks. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20634](https://cve.now/CVE-2026-20634.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20675](https://cve.now/CVE-2026-20675.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-46303](https://cve.now/CVE-2025-46303.md): The issue was addressed with improved bounds checks. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20660](https://cve.now/CVE-2026-20660.md): A path handling issue was addressed with improved logic. (CVSS 5.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-20621](https://cve.now/CVE-2026-20621.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-20676](https://cve.now/CVE-2026-20676.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-20601](https://cve.now/CVE-2026-20601.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2026-20656](https://cve.now/CVE-2026-20656.md): A logic issue was addressed with improved validation. (CVSS 3.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2026-20640](https://cve.now/CVE-2026-20640.md): An inconsistent user interface issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-20617](https://cve.now/CVE-2026-20617.md): A race condition was addressed with improved state handling. (CVSS 7.0, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20682](https://cve.now/CVE-2026-20682.md): A logic issue was addressed with improved state management. (CVSS 5.3, Apple iOS and iPadOS)
- [CVE-2026-20616](https://cve.now/CVE-2026-20616.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-20641](https://cve.now/CVE-2026-20641.md): A privacy issue was addressed with improved checks. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20677](https://cve.now/CVE-2026-20677.md): A race condition was addressed with improved handling of symbolic links. (CVSS 9.0, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2025-43403](https://cve.now/CVE-2025-43403.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-20620](https://cve.now/CVE-2026-20620.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 7.7, Apple macOS)
- [CVE-2026-20636](https://cve.now/CVE-2026-20636.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2025-46302](https://cve.now/CVE-2025-46302.md): The issue was addressed with improved bounds checks. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20661](https://cve.now/CVE-2026-20661.md): An authorization issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-20650](https://cve.now/CVE-2026-20650.md): A denial-of-service issue was addressed with improved validation. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20646](https://cve.now/CVE-2026-20646.md): A logging issue was addressed with improved data redaction. (CVSS 3.3, Apple macOS)
- [CVE-2026-20611](https://cve.now/CVE-2026-20611.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-46305](https://cve.now/CVE-2025-46305.md): The issue was addressed with improved bounds checks. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20666](https://cve.now/CVE-2026-20666.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-20627](https://cve.now/CVE-2026-20627.md): An issue existed in the handling of environment variables. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-20671](https://cve.now/CVE-2026-20671.md): A logic issue was addressed with improved checks. (CVSS 3.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20626](https://cve.now/CVE-2026-20626.md): This issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-20630](https://cve.now/CVE-2026-20630.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-46304](https://cve.now/CVE-2025-46304.md): The issue was addressed with improved bounds checks. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-20667](https://cve.now/CVE-2026-20667.md): A logic issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-20610](https://cve.now/CVE-2026-20610.md): This issue was addressed with improved handling of symlinks. (CVSS 7.8, Apple macOS)
- [CVE-2026-20647](https://cve.now/CVE-2026-20647.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple macOS)
- [CVE-2026-20606](https://cve.now/CVE-2026-20606.md): This issue was addressed by removing the vulnerable code. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43537](https://cve.now/CVE-2025-43537.md): A path handling issue was addressed with improved validation. (CVSS 3.5, Apple iOS and iPadOS)
- [CVE-2026-26215](https://cve.now/CVE-2026-26215.md): manga-image-translator Shared API Unsafe Deserialization RCE (CVSS 9.3, zyddnys manga-image-translator)
- [CVE-2026-1669](https://cve.now/CVE-2026-1669.md): Arbitrary File Read in Keras via HDF5 External Datasets (CVSS 7.1, Google Keras · keras)
- [CVE-2026-26031](https://cve.now/CVE-2026-26031.md): Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students (CVSS 1.3, frappe lms)
- [CVE-2026-26029](https://cve.now/CVE-2026-26029.md): sf-mcp-server has a Command Injection in query\_records tool due to unsafe use of child\_process.exec (CVSS 7.5, akutishevsky sf-mcp-server)
- [CVE-2026-26023](https://cve.now/CVE-2026-26023.md): Client‑side DOM XSS in the web chat app of Dify when using echarts (CVSS 5.3, langgenius dify)
- [CVE-2026-26021](https://cve.now/CVE-2026-26021.md): Prototype pollution in set-in (CVSS 9.4, ahdinosaur set-in · set-in)
- [CVE-2026-26012](https://cve.now/CVE-2026-26012.md): vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions (CVSS 6.5, dani-garcia vaultwarden)
- [CVE-2026-26019](https://cve.now/CVE-2026-26019.md): @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation (CVSS 4.1, langchain-ai langchainjs · @langchain/community)
- [CVE-2026-26014](https://cve.now/CVE-2026-26014.md): Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key (CVSS 5.9, pion dtls · github.com/pion/dtls +2)
- [CVE-2026-26010](https://cve.now/CVE-2026-26010.md): Leaky JWTs in OpenMetadata exposing highly-privileged bot users (CVSS 7.6, open-metadata OpenMetadata · org.open-metadata:openmetadata…)
- [CVE-2026-25999](https://cve.now/CVE-2026-25999.md): Klaw has an improper authorisation check on /resetMemoryCache (CVSS 7.1, Aiven-Open klaw)
- [CVE-2026-25994](https://cve.now/CVE-2026-25994.md): PJSIP has a heap buffer overflow in ICE with long username (CVSS 8.1, pjsip pjproject)
- [CVE-2026-25990](https://cve.now/CVE-2026-25990.md): Pillow has an out-of-bounds write when loading PSD images (CVSS 8.6, python-pillow Pillow · pillow)
- [CVE-2020-37158](https://cve.now/CVE-2020-37158.md): AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset) (CVSS 8.5, AVideo Platform)
- [CVE-2020-37156](https://cve.now/CVE-2020-37156.md): BloodX 1.0 - Authentication Bypass (CVSS 6.9, diveshlunker BloodX)
- [CVE-2020-37153](https://cve.now/CVE-2020-37153.md): ASTPP VoIP 4.0.1 - Remote Code Execution (CVSS 7.7, ASTPP)
- [CVE-2020-37104](https://cve.now/CVE-2020-37104.md): ASTPP 4.0.1 VoIP Billing - Database Backup Download (CVSS 8.7, ASTPP)
- [CVE-2019-25313](https://cve.now/CVE-2019-25313.md): FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) (CVSS 5.1, Flexera Software FlexNet Publisher)
- [CVE-2026-25935](https://cve.now/CVE-2026-25935.md): Vikunja Affected by XSS Via Task Preview (CVSS 8.6, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-25924](https://cve.now/CVE-2026-25924.md): Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE (CVSS 8.5, kanboard)
- [CVE-2026-25759](https://cve.now/CVE-2026-25759.md): Statmatic affected by privilege escalation via stored cross-site scripting (CVSS 8.7, statamic cms · statamic/cms)
- [CVE-2020-37215](https://cve.now/CVE-2020-37215.md): MSN Password Recovery 1.30 - Denial of Service (CVSS 4.6, Top Password Software MSN Password Recovery)
- [CVE-2020-37214](https://cve.now/CVE-2020-37214.md): Voyager 1.3.0 - Directory Traversal (CVSS 8.7, The Control Group Voyager)
- [CVE-2020-37213](https://cve.now/CVE-2020-37213.md): TextCrawler Pro3.1.1 - Denial of Service (CVSS 6.7, DigitalVolcano Software TextCrawler Pro)
- [CVE-2020-37212](https://cve.now/CVE-2020-37212.md): SpotMSN 2.4.6 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotMSN)
- [CVE-2020-37211](https://cve.now/CVE-2020-37211.md): SpotIM 2.2 - 'Name' Denial Of Service (CVSS 4.6, Nsasoft Nsauditor SpotIM)
- [CVE-2020-37210](https://cve.now/CVE-2020-37210.md): SpotIE 2.9.5 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotIE)
- [CVE-2020-37209](https://cve.now/CVE-2020-37209.md): SpotFTP FTP Password Recovery 3.0.0.0 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotFTP FTP Password Recovery)
- [CVE-2020-37208](https://cve.now/CVE-2020-37208.md): SpotFTP FTP Password Recovery 3.0.0.0 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotFTP FTP Password Recovery)
- [CVE-2020-37207](https://cve.now/CVE-2020-37207.md): SpotDialup 1.6.7 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotDialup)
- [CVE-2020-37206](https://cve.now/CVE-2020-37206.md): ShareAlarmPro Advanced Network Access Control - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor ShareAlarmPro Advanced Network Access Con…)
- [CVE-2020-37205](https://cve.now/CVE-2020-37205.md): RemShutdown 2.9.0.0 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor RemShutdown)
- [CVE-2020-37204](https://cve.now/CVE-2020-37204.md): RemShutdown 2.9.0.0 - 'Key' Denial of Service (CVSS 4.6, Nsauditor RemShutdown)
- [CVE-2020-37203](https://cve.now/CVE-2020-37203.md): Office Product Key Finder 1.5.4 - Denial of Service (CVSS 4.6, Nsasoft Nsauditor Office Product Key Finder)
- [CVE-2020-37202](https://cve.now/CVE-2020-37202.md): NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor NetworkSleuth)
- [CVE-2020-37201](https://cve.now/CVE-2020-37201.md): NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service (CVSS 4.6, Nsasoft Nsauditor NetShareWatcher)
- [CVE-2020-37200](https://cve.now/CVE-2020-37200.md): NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor NetShareWatcher)
- [CVE-2020-37199](https://cve.now/CVE-2020-37199.md): NBMonitor 1.6.6.0 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor NBMonitor)
- [CVE-2020-37198](https://cve.now/CVE-2020-37198.md): Duplicate Cleaner Pro 4 - Denial of Service (CVSS 6.7, DigitalVolcano Software Duplicate Cleaner Pro)
- [CVE-2020-37197](https://cve.now/CVE-2020-37197.md): Dnss Domain Name Search Software - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor Dnss Domain Name Search Software)
- [CVE-2020-37196](https://cve.now/CVE-2020-37196.md): Dnss Domain Name Search Software - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor Dnss Domain Name Search Software)
- [CVE-2020-37195](https://cve.now/CVE-2020-37195.md): BlueAuditor 1.7.2.0 - 'Name' Denial of Service (CVSS 4.6, Nsasoft BlueAuditor)
- [CVE-2020-37194](https://cve.now/CVE-2020-37194.md): Backup Key Recovery Recover Keys Crashed Hard Disk Drive 2.2.5 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor Backup Key Recovery Recover Keys Crashed…)
- [CVE-2020-37193](https://cve.now/CVE-2020-37193.md): ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (CVSS 4.6, Top Password Software ZIP Password Recovery)
- [CVE-2020-37192](https://cve.now/CVE-2020-37192.md): MSN Password Recovery 1.30 - XML External Entity Injection (CVSS 6.7, Top Password Software MSN Password Recovery)
- [CVE-2020-37191](https://cve.now/CVE-2020-37191.md): Top Password Software Dialup Password Recovery 1.30 - Denial of Service (CVSS 4.6, Top Password Software Dialup Password Recovery)
- [CVE-2020-37190](https://cve.now/CVE-2020-37190.md): Top Password Firefox Password Recovery 2.8 - Denial of Service (CVSS 4.6, Top Password Software Top Password Firefox Password Recovery)
- [CVE-2020-37189](https://cve.now/CVE-2020-37189.md): TaskCanvas 1.4.0 - 'Registration' Denial Of Service (CVSS 4.6, DigitalVolcano Software TaskCanvas)
- [CVE-2020-37188](https://cve.now/CVE-2020-37188.md): SpotOutlook 1.2.6 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotOutlook)
- [CVE-2020-37187](https://cve.now/CVE-2020-37187.md): SpotDialup 1.6.7 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor SpotDialup)
- [CVE-2020-37186](https://cve.now/CVE-2020-37186.md): Chevereto 3.13.4 Core - Remote Code Execution (CVSS 9.3, Chevere SpA Chevereto)
- [CVE-2020-37185](https://cve.now/CVE-2020-37185.md): Backup Key Recovery 2.2.5 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor Backup Key Recovery)
- [CVE-2020-37184](https://cve.now/CVE-2020-37184.md): Allok Video Converter 4.6.1217 - Stack Overflow (SEH) (CVSS 8.4, Allok Soft Allok Video Converter)
- [CVE-2020-37183](https://cve.now/CVE-2020-37183.md): Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 - Stack Overflow (SEH) (CVSS 8.4, Allok Soft Allok RM RMVB to AVI MPEG DVD Converter)
- [CVE-2020-37182](https://cve.now/CVE-2020-37182.md): Redir 3.3 - Denial of Service (CVSS 8.7, troglobit Redir)
- [CVE-2020-37181](https://cve.now/CVE-2020-37181.md): Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite) (CVSS 6.7, TorrentRockYou Torrent FLV Converter)
- [CVE-2020-37180](https://cve.now/CVE-2020-37180.md): GTalk Password Finder 2.2.1 - 'Key' Denial of Service (CVSS 4.6, Nsasoft Nsauditor GTalk Password Finder)
- [CVE-2020-37179](https://cve.now/CVE-2020-37179.md): APKF Product Key Finder 2.5.8.0 - 'Name' Denial of Service (CVSS 4.6, Nsasoft Nsauditor APKF Product Key Finder)
- [CVE-2020-37178](https://cve.now/CVE-2020-37178.md): KeePass 2.44 - Denial of Service (PoC) (CVSS 4.6, KeePass Password Safe)
- [CVE-2020-37177](https://cve.now/CVE-2020-37177.md): BOOTP Turbo 2.0 - Denial of Service (SEH) (CVSS 6.7, Weird Solutions BOOTP Turbo)
- [CVE-2020-37176](https://cve.now/CVE-2020-37176.md): Torrent 3GP Converter 1.51 - Stack Overflow (SEH) (CVSS 8.4, Torrentrockyou Torrent 3GP Converter)
- [CVE-2020-37175](https://cve.now/CVE-2020-37175.md): P2PWIFICAM2 for iOS 10.4.1 - 'Camera ID' Denial of Service (CVSS 4.6, Ka Ming Cheung P2PWIFICAM2 for iOS)
- [CVE-2020-37173](https://cve.now/CVE-2020-37173.md): AVideo Platform 8.1 - Information Disclosure (User Enumeration) (CVSS 8.7, AVideo Platform)
- [CVE-2026-25633](https://cve.now/CVE-2026-25633.md): Statamic's missing authorization allows access to assets (CVSS 4.3, statamic cms · statamic/cms)
- [CVE-2020-37172](https://cve.now/CVE-2020-37172.md): AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset) (CVSS 8.5, AVideo Platform)
- [CVE-2025-68663](https://cve.now/CVE-2025-68663.md): Outline has a suspended user authentication bypass via WebSocket connections (CVSS 6.9, outline)
- [CVE-2026-26158](https://cve.now/CVE-2026-26158.md): Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries (CVSS 7.0, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-26157](https://cve.now/CVE-2026-26157.md): Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization (CVSS 7.0, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2025-64487](https://cve.now/CVE-2025-64487.md): Outline is vulnerable to privilege escalation vulnerability in document sharing (CVSS 7.6, outline)
- [CVE-2026-25062](https://cve.now/CVE-2026-25062.md): Outline Affected an Arbitrary File Read via Path Traversal in JSON Import (CVSS 5.5, outline)
- [CVE-2026-2323](https://cve.now/CVE-2026-2323.md): Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-2322](https://cve.now/CVE-2026-2322.md): Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage (CVSS 5.4, Google Chrome)
- [CVE-2026-2321](https://cve.now/CVE-2026-2321.md): Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 8.8, Google Chrome)
- [CVE-2026-2320](https://cve.now/CVE-2026-2320.md): Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage (CVSS 6.5, Google Chrome)
- [CVE-2026-2319](https://cve.now/CVE-2026-2319.md): Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures an (CVSS 7.5, Google Chrome)
- [CVE-2026-2318](https://cve.now/CVE-2026-2318.md): Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to e (CVSS 6.5, Google Chrome)
- [CVE-2026-2317](https://cve.now/CVE-2026-2317.md): Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-2316](https://cve.now/CVE-2026-2316.md): Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-2315](https://cve.now/CVE-2026-2315.md): Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bound (CVSS 8.8, Google Chrome)
- [CVE-2026-2314](https://cve.now/CVE-2026-2314.md): Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-2313](https://cve.now/CVE-2026-2313.md): Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-0229](https://cve.now/CVE-2026-0229.md): PAN-OS: Denial of Service in Advanced DNS Security Feature (CVSS 6.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0228](https://cve.now/CVE-2026-0228.md): PAN-OS: Improper Validation of Terminal Server Agent Certificate (CVSS 1.3, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-2361](https://cve.now/CVE-2026-2361.md): Improper search\_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-2360](https://cve.now/CVE-2026-2360.md): Improper search\_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14 (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2025-13391](https://cve.now/CVE-2025-13391.md): Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) \<= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion (CVSS 5.8, MooMoo Product Options and Price Calculation Formulas for W…)
- [CVE-2026-24789](https://cve.now/CVE-2026-24789.md): ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function (CVSS 9.8, ZLAN Information Technology ZLAN5143D)
- [CVE-2026-25084](https://cve.now/CVE-2026-25084.md): ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function (CVSS 9.8, ZLAN Information Technology ZLAN5143D)
- [CVE-2026-25869](https://cve.now/CVE-2026-25869.md): MiniGal Nano \<= 0.3.5 Path Traversal via dir Parameter (CVSS 6.9, MiniGal Nano)
- [CVE-2026-25868](https://cve.now/CVE-2026-25868.md): MiniGal Nano \<= 0.3.5 Reflected XSS via dir Parameter (CVSS 5.1, MiniGal Nano)
- [CVE-2025-12474](https://cve.now/CVE-2025-12474.md): libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling (CVSS 2.3, Google libjxl)
- [CVE-2026-1837](https://cve.now/CVE-2026-1837.md): libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2 (CVSS 8.7, Google libjxl)
- [CVE-2019-25317](https://cve.now/CVE-2019-25317.md): Kimai 2- persistent cross-site scripting (XSS) (CVSS 5.1, kevinpapst Kimai · kimai/kimai)
- [CVE-2019-25316](https://cve.now/CVE-2019-25316.md): GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting (CVSS 5.1, GOautodial)
- [CVE-2019-25315](https://cve.now/CVE-2019-25315.md): WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting (CVSS 5.1, anttiviljami WP Server Log Viewer)
- [CVE-2019-25314](https://cve.now/CVE-2019-25314.md): Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting (CVSS 4.8, Yoast Duplicate-Post)
- [CVE-2019-25312](https://cve.now/CVE-2019-25312.md): InoERP 0.7.2 - Persistent Cross-Site Scripting (CVSS 5.1, InoIdeas InoERP)
- [CVE-2019-25311](https://cve.now/CVE-2019-25311.md): thesystem Persistent XSS (CVSS 5.1, kostasmitroglou thesystem)
- [CVE-2019-25310](https://cve.now/CVE-2019-25310.md): ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path (CVSS 8.5, Actfax ActiveFax Server)
- [CVE-2019-25309](https://cve.now/CVE-2019-25309.md): Zilab Remote Console Server 3.2.9 - 'Zilab Remote Console Server' Unquoted Service Path (CVSS 8.5, Zilab Software Zilab Remote Console Server)
- [CVE-2019-25308](https://cve.now/CVE-2019-25308.md): Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Service Path (CVSS 8.5, LiteManager Team Mikogo)
- [CVE-2019-25307](https://cve.now/CVE-2019-25307.md): WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service Path (CVSS 8.5, Softalk WorkgroupMail)
- [CVE-2019-25306](https://cve.now/CVE-2019-25306.md): BlackMoon FTP Server 3.1.2.1731 - 'BMFTP-RELEASE' Unquoted Serive Path (CVSS 8.5, BlackMoon FTP Server)
- [CVE-2018-25157](https://cve.now/CVE-2018-25157.md): Phraseanet 4.0.3 Stored XSS via Document Upload (CVSS 5.1, Phraseanet DAM Open Source · phraseanet/phraseanet)
- [CVE-2026-2344](https://cve.now/CVE-2026-2344.md): Stored XSS on Plunet BusinessManager (CVSS 8.6, Plunet BusinessManager)
- [CVE-2026-2345](https://cve.now/CVE-2026-2345.md): Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers (CVSS 3.6, Proctorio Secure Exam Proctor Extension)
- [CVE-2025-61969](https://cve.now/CVE-2025-61969.md): Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulti (CVSS 7.0, AMD µProf)
- [CVE-2025-52541](https://cve.now/CVE-2025-52541.md): A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary cod (CVSS 7.3, AMD Vivado™ Installation)
- [CVE-2023-20548](https://cve.now/CVE-2023-20548.md): A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in (CVSS 7.1, AMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +6)
- [CVE-2023-31324](https://cve.now/CVE-2023-31324.md): A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memo (CVSS 7.1, AMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +4)
- [CVE-2025-48518](https://cve.now/CVE-2025-48518.md): Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integ (CVSS 6.9, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Gr… +8)
- [CVE-2024-36320](https://cve.now/CVE-2024-36320.md): Integer Overflow within atihdwt6.sys can allow a local attacker to cause out of bound read/write potentially leading to loss of confidential (CVSS 7.0, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +35)
- [CVE-2023-20514](https://cve.now/CVE-2023-20514.md): Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to fun (CVSS 8.7, AMD Radeon™ RX 6000 Series Graphics Products · AMD Radeo… +6)
- [CVE-2024-36324](https://cve.now/CVE-2024-36324.md): Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbit (CVSS 8.8, AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics… +20)
- [CVE-2025-48508](https://cve.now/CVE-2025-48508.md): Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control (CVSS 6.0, AMD Radeon™ PRO)
- [CVE-2024-36316](https://cve.now/CVE-2024-36316.md): The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a denia (CVSS 5.5, AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics… +13)
- [CVE-2025-48503](https://cve.now/CVE-2025-48503.md): A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in (CVSS 7.8, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +22)
- [CVE-2026-2249](https://cve.now/CVE-2026-2249.md): Unauthenticated Remote Command Execution via Web Console in METIS DFS (CVSS 9.8, METIS Cyberspace Technology SA METIS DFS)
- [CVE-2026-2248](https://cve.now/CVE-2026-2248.md): Unauthenticated Remote Root Shell Access via Web Console in METIS WIC (CVSS 9.8, METIS Cyberspace Technology SA METIS WIC)
- [CVE-2026-2250](https://cve.now/CVE-2026-2250.md): Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC (CVSS 7.5, METIS Cyberspace Technology SA METIS WIC)
- [CVE-2025-12059](https://cve.now/CVE-2025-12059.md): Improper Access Control in Logo Software's Logo j-Platform (CVSS 9.8, Logo Software Industry and Trade Logo j-Platform)
- [CVE-2026-1226](https://cve.now/CVE-2026-1226.md): CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the ap (CVSS 7.0, Schneider Electric EcoStruxure Building Operation Workstati…)
- [CVE-2026-1227](https://cve.now/CVE-2026-1227.md): CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, (CVSS 7.0, Schneider Electric EcoStruxure Building Operation Workstati…)
- [CVE-2025-8668](https://cve.now/CVE-2025-8668.md): Reflected XSS in E-Kalite Software Hardware Engineering's Turboard (CVSS 9.4, E-Kalite Software Hardware Engineering Design and Internet…)
- [CVE-2026-2337](https://cve.now/CVE-2026-2337.md): Refleccted XSS on Plunet BusinessManager (CVSS 8.7, Plunet BusinessManager)
- [CVE-2026-0910](https://cve.now/CVE-2026-0910.md): wpForo Forum \<= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, tomdever wpForo Forum)
- [CVE-2024-56807](https://cve.now/CVE-2024-56807.md): Media Streaming add-on (CVSS 1.7, QNAP Systems Media Streaming add-on)
- [CVE-2024-56808](https://cve.now/CVE-2024-56808.md): Media Streaming add-on (CVSS 2.0, QNAP Systems Media Streaming add-on)
- [CVE-2025-30266](https://cve.now/CVE-2025-30266.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-30269](https://cve.now/CVE-2025-30269.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-30276](https://cve.now/CVE-2025-30276.md): Qsync Central (CVSS 4.9, QNAP Systems Qsync Central)
- [CVE-2025-47205](https://cve.now/CVE-2025-47205.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-47209](https://cve.now/CVE-2025-47209.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-48722](https://cve.now/CVE-2025-48722.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-48723](https://cve.now/CVE-2025-48723.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-48724](https://cve.now/CVE-2025-48724.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-48725](https://cve.now/CVE-2025-48725.md): QuTS hero (CVSS 0.6, QNAP Systems QuTS hero)
- [CVE-2025-52868](https://cve.now/CVE-2025-52868.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-8025](https://cve.now/CVE-2025-8025.md): Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP (CVSS 9.8, Dinosoft Business Solutions Dinosoft ERP)
- [CVE-2025-52869](https://cve.now/CVE-2025-52869.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-52870](https://cve.now/CVE-2025-52870.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-53598](https://cve.now/CVE-2025-53598.md): Qsync Central (CVSS 0.6, QNAP Systems Qsync Central)
- [CVE-2025-54146](https://cve.now/CVE-2025-54146.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-54147](https://cve.now/CVE-2025-54147.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-54148](https://cve.now/CVE-2025-54148.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-54149](https://cve.now/CVE-2025-54149.md): Qsync Central (CVSS 4.9, QNAP Systems Qsync Central)
- [CVE-2025-54150](https://cve.now/CVE-2025-54150.md): Qsync Central (CVSS 4.9, QNAP Systems Qsync Central)
- [CVE-2025-54151](https://cve.now/CVE-2025-54151.md): Qsync Central (CVSS 4.9, QNAP Systems Qsync Central)
- [CVE-2025-54152](https://cve.now/CVE-2025-54152.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-54155](https://cve.now/CVE-2025-54155.md): File Station 5 (CVSS 3.6, QNAP Systems File Station)
- [CVE-2025-54161](https://cve.now/CVE-2025-54161.md): File Station 5 (CVSS 3.6, QNAP Systems File Station)
- [CVE-2025-54162](https://cve.now/CVE-2025-54162.md): File Station 5 (CVSS 4.8, QNAP Systems File Station)
- [CVE-2025-54163](https://cve.now/CVE-2025-54163.md): File Station 5 (CVSS 1.2, QNAP Systems File Station)
- [CVE-2025-54169](https://cve.now/CVE-2025-54169.md): File Station 5 (CVSS 4.9, QNAP Systems File Station)
- [CVE-2025-54170](https://cve.now/CVE-2025-54170.md): Qsync Central (CVSS 4.9, QNAP Systems Qsync Central)
- [CVE-2025-57707](https://cve.now/CVE-2025-57707.md): File Station 5 (CVSS 1.1, QNAP Systems File Station)
- [CVE-2025-57708](https://cve.now/CVE-2025-57708.md): Qsync Central (CVSS 2.3, QNAP Systems Qsync Central)
- [CVE-2025-57709](https://cve.now/CVE-2025-57709.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-57710](https://cve.now/CVE-2025-57710.md): Qsync Central (CVSS 3.6, QNAP Systems Qsync Central)
- [CVE-2025-57711](https://cve.now/CVE-2025-57711.md): Qsync Central (CVSS 3.6, QNAP Systems Qsync Central)
- [CVE-2025-57713](https://cve.now/CVE-2025-57713.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-58466](https://cve.now/CVE-2025-58466.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-58467](https://cve.now/CVE-2025-58467.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-58470](https://cve.now/CVE-2025-58470.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2025-58471](https://cve.now/CVE-2025-58471.md): Qsync Central (CVSS 1.2, QNAP Systems Qsync Central)
- [CVE-2025-58472](https://cve.now/CVE-2025-58472.md): Qsync Central (CVSS 1.2, QNAP Systems Qsync Central)
- [CVE-2025-59386](https://cve.now/CVE-2025-59386.md): QuTS hero (CVSS 1.2, QNAP Systems QuTS hero)
- [CVE-2025-62853](https://cve.now/CVE-2025-62853.md): File Station 5 (CVSS 5.2, QNAP Systems File Station)
- [CVE-2025-62854](https://cve.now/CVE-2025-62854.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-62855](https://cve.now/CVE-2025-62855.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-62856](https://cve.now/CVE-2025-62856.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-66274](https://cve.now/CVE-2025-66274.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-66277](https://cve.now/CVE-2025-66277.md): QTS, QuTS hero (CVSS 9.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-66278](https://cve.now/CVE-2025-66278.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-68406](https://cve.now/CVE-2025-68406.md): Qsync Central (CVSS 1.3, QNAP Systems Qsync Central)
- [CVE-2026-22894](https://cve.now/CVE-2026-22894.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-10174](https://cve.now/CVE-2025-10174.md): Improper Access Control in Pan Software's PanCafe Pro (CVSS 8.3, Pan Software & Information Technologies PanCafe Pro)
- [CVE-2025-7659](https://cve.now/CVE-2025-7659.md): Origin Validation Error in GitLab (CVSS 8.0, GitLab)
- [CVE-2025-8099](https://cve.now/CVE-2025-8099.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-12073](https://cve.now/CVE-2025-12073.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-12575](https://cve.now/CVE-2025-12575.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 5.4, GitLab)
- [CVE-2025-14560](https://cve.now/CVE-2025-14560.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.3, GitLab)
- [CVE-2025-14594](https://cve.now/CVE-2025-14594.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-14592](https://cve.now/CVE-2025-14592.md): Missing Authorization in GitLab (CVSS 3.7, GitLab)
- [CVE-2026-0595](https://cve.now/CVE-2026-0595.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.3, GitLab)
- [CVE-2026-0958](https://cve.now/CVE-2026-0958.md): Interpretation Conflict in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-1080](https://cve.now/CVE-2026-1080.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-1094](https://cve.now/CVE-2026-1094.md): Improper Validation of Unsafe Equivalence in Input in GitLab (CVSS 4.6, GitLab)
- [CVE-2026-1282](https://cve.now/CVE-2026-1282.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab (CVSS 3.5, GitLab)
- [CVE-2026-1387](https://cve.now/CVE-2026-1387.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-1456](https://cve.now/CVE-2026-1456.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-1458](https://cve.now/CVE-2026-1458.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-15096](https://cve.now/CVE-2025-15096.md): Videospirecore Theme Plugin \<= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover (CVSS 8.8, kamleshyadav Videospirecore Theme Plugin)
- [CVE-2026-2295](https://cve.now/CVE-2026-2295.md): WPZOOM Addons for Elementor – Starter Templates & Widgets \<= 1.3.2 - Unauthenticated Protected Post Exposure via ajax\_post\_grid\_load\_more (CVSS 5.3, WPZOOM Addons for Elementor – Starter Templates & Widgets)
- [CVE-2025-13651](https://cve.now/CVE-2025-13651.md): LEAK OF SENSITIVE INFORMATION ON MICROCOM'S ZEUSWEB (CVSS 6.9, Microcom ZeusWeb)
- [CVE-2025-13650](https://cve.now/CVE-2025-13650.md): REFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB (CVSS 5.1, Microcom ZeusWeb)
- [CVE-2025-13649](https://cve.now/CVE-2025-13649.md): REFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB (CVSS 5.1, Microcom ZeusWeb)
- [CVE-2025-13648](https://cve.now/CVE-2025-13648.md): STORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB (CVSS 4.8, Microcom ZeusWeb)
- [CVE-2025-9986](https://cve.now/CVE-2025-9986.md): Improper Access Control in Vadi Corporate Information System's DIGIKENT (CVSS 8.2, Vadi Corporate Information Systems Ltd. DIGIKENT)
- [CVE-2026-1827](https://cve.now/CVE-2026-1827.md): IDE Micro code-editor \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, luke-alford IDE Micro code-editor)
- [CVE-2026-0815](https://cve.now/CVE-2026-0815.md): Category Image \<= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter (CVSS 4.4, pankajanupam Category Image)
- [CVE-2026-1833](https://cve.now/CVE-2026-1833.md): WaMate Confirm \<= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking (CVSS 5.3, sm\_rasmy WaMate Confirm – Order Confirmation)
- [CVE-2026-1826](https://cve.now/CVE-2026-1826.md): OpenPOS Lite \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, OpenPOS Lite – Point of Sale for WooCommerce)
- [CVE-2026-1560](https://cve.now/CVE-2026-1560.md): Custom Block Builder – Lazy Blocks \<= 4.2.0 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, nko Custom Block Builder – Lazy Blocks)
- [CVE-2026-1786](https://cve.now/CVE-2026-1786.md): Twitter posts to Blog \<= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 6.5, badbreze Twitter posts to Blog)
- [CVE-2026-1809](https://cve.now/CVE-2026-1809.md): HTML Shortcodes \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, jhoylman HTML Shortcodes)
- [CVE-2026-0724](https://cve.now/CVE-2026-0724.md): WPlyr Media Block \<= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '\_wplyr\_accent\_color' Parameter (CVSS 4.4, wecodify WPlyr Media Block)
- [CVE-2026-1748](https://cve.now/CVE-2026-1748.md): Invoct – PDF Invoices & Billing for WooCommerce \<= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure (CVSS 4.3, kirilkirkov Invoct – PDF Invoices & Billing for WooCommerce)
- [CVE-2026-1215](https://cve.now/CVE-2026-1215.md): MMA Call Tracking \<= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, messagemetric MMA Call Tracking)
- [CVE-2026-1853](https://cve.now/CVE-2026-1853.md): BuddyHolis ListSearch \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute (CVSS 6.4, digiblogger BuddyHolis ListSearch)
- [CVE-2026-1804](https://cve.now/CVE-2026-1804.md): WDES Responsive Popup \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute (CVSS 6.4, master-buldog WDES Responsive Popup)
- [CVE-2026-1821](https://cve.now/CVE-2026-1821.md): Microtango \<= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, Microtango)
- [CVE-2026-1885](https://cve.now/CVE-2026-1885.md): Slideshow Wp \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute (CVSS 6.4, aumsrini Slideshow Wp)
- [CVE-2025-15440](https://cve.now/CVE-2025-15440.md): iONE360 configurator \<= 2.0.57 - Unauthenticated Stored Cross-Site Scripting via Contact Form Parameters (CVSS 7.2, iONE360 configurator)
- [CVE-2025-10913](https://cve.now/CVE-2025-10913.md): XSS in saastech.io's TemizlikYolda (CVSS 8.3, Saastech Cleaning and Internet Services TemizlikYolda)
- [CVE-2025-10912](https://cve.now/CVE-2025-10912.md): IDOR in saastech.io's TemizlikYolda (CVSS 5.4, Saastech Cleaning and Internet Services TemizlikYolda)
- [CVE-2026-1235](https://cve.now/CVE-2026-1235.md): WP eCommerce \<= 3.15.1 - Unauthenticated PHP Object Injection (CVSS 6.5, WP eCommerce)
- [CVE-2025-15400](https://cve.now/CVE-2025-15400.md): OpenPix \<= 2.13.3 - Subscriber+ Payment Gateway Settings Reset (CVSS 6.5, OpenPix for WooCommerce)
- [CVE-2026-1357](https://cve.now/CVE-2026-1357.md): Migration, Backup, Staging \<= 0.9.123 - Unauthenticated Arbitrary File Upload (CVSS 9.8, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2026-1893](https://cve.now/CVE-2026-1893.md): Orbisius Random Name Generator \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn\_label' Shortcode Attribute (CVSS 6.4, lordspace Orbisius Random Name Generator)
- [CVE-2026-26079](https://cve.now/CVE-2026-26079.md): Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled. (CVSS 4.7, Roundcube Webmail)
- [CVE-2025-14541](https://cve.now/CVE-2025-14541.md): Lucky Wheel Giveaway \<= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional\_tags' Parameter (CVSS 7.2, villatheme Lucky Wheel Giveaway)
- [CVE-2025-13431](https://cve.now/CVE-2025-13431.md): SlimStat Analytics \<= 5.3.1 - Authenticated (Subscriber+) SQL Injection via \`args\` Parameter (CVSS 6.5, veronalabs SlimStat Analytics)
- [CVE-2026-1231](https://cve.now/CVE-2026-1231.md): Beaver Builder Page Builder – Drag and Drop Website Builder \<= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2025-15524](https://cve.now/CVE-2025-15524.md): Gallery by FooGallery \<= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure (CVSS 4.3, fooplugins Gallery by FooGallery)
- [CVE-2026-1571](https://cve.now/CVE-2026-1571.md): Reflected XSS Vulnerability on TP-Link Archer C60 (CVSS 5.3, TP-Link Systems Archer C60)
- [CVE-2024-26477](https://cve.now/CVE-2024-26477.md): An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, (CVSS 7.5)
- [CVE-2024-26478](https://cve.now/CVE-2024-26478.md): An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint. (CVSS 5.3)
- [CVE-2024-26479](https://cve.now/CVE-2024-26479.md): An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Command execution function. (CVSS 5.3)
- [CVE-2024-26480](https://cve.now/CVE-2024-26480.md): An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the admin parameter. (CVSS 7.5)
- [CVE-2024-50617](https://cve.now/CVE-2024-50617.md): Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthoriz (CVSS 7.5)
- [CVE-2024-50618](https://cve.now/CVE-2024-50618.md): A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to byp (CVSS 4.3)
- [CVE-2024-50619](https://cve.now/CVE-2024-50619.md): Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access (CVSS 8.8)
- [CVE-2024-50620](https://cve.now/CVE-2024-50620.md): Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner C (CVSS 8.8)
- [CVE-2025-64074](https://cve.now/CVE-2025-64074.md): A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to (CVSS 5.3)
- [CVE-2025-64075](https://cve.now/CVE-2025-64075.md): A path traversal vulnerability in the check\_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to (CVSS 10.0)
- [CVE-2025-65127](https://cve.now/CVE-2025-65127.md): A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated at (CVSS 6.5)
- [CVE-2025-65128](https://cve.now/CVE-2025-65128.md): A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthe (CVSS 8.1)
- [CVE-2025-65480](https://cve.now/CVE-2025-65480.md): An issue was discovered in Pacom Unison Client 5.13.1. (CVSS 8.8)
- [CVE-2025-67135](https://cve.now/CVE-2025-67135.md): Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay (CVSS 9.8)
- [CVE-2025-69871](https://cve.now/CVE-2025-69871.md): A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. (CVSS 8.1)
- [CVE-2025-69872](https://cve.now/CVE-2025-69872.md): DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. (CVSS 9.8, diskcache)
- [CVE-2025-69873](https://cve.now/CVE-2025-69873.md): ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is ena (CVSS 2.9, ajv.js ajv · ajv)
- [CVE-2025-69874](https://cve.now/CVE-2025-69874.md): nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary fi (CVSS 9.8, nanotar)
- [CVE-2025-70029](https://cve.now/CVE-2025-70029.md): An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. (CVSS 7.5)
- [CVE-2025-70083](https://cve.now/CVE-2025-70083.md): An issue was discovered in OpenSatKit 2.2.1. (CVSS 7.8)
- [CVE-2025-70084](https://cve.now/CVE-2025-70084.md): Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via (CVSS 7.5)
- [CVE-2025-70085](https://cve.now/CVE-2025-70085.md): An issue was discovered in OpenSatKit 2.2.1. (CVSS 9.8)
- [CVE-2025-70296](https://cve.now/CVE-2025-70296.md): A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject ar (CVSS 5.4)
- [CVE-2025-70297](https://cve.now/CVE-2025-70297.md): A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authe (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.