CVEs published February 12, 2026
125 CVEs were published on February 12, 2026: 21 critical, 58 high.
- Published
- 125
- Critical
- 21
- High
- 58
- Medium
- 45
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- PostgreSQL
- 5
- Farktor Software E-Commerce Services E-Commerce Package
- 3
- goauthentik authentik
- 3
- SolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1
- 3
- ALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server
- 2
- cloudamqp lavinmq
- 2
- frankenphp · github.com/dunglas/frankenphp
- 2
- Heatmiser Netmonitor
- 2
- kostasmitroglou thesystem
- 2
- newbee-ltd newbee-mall
- 2
Critical 21
- CVE-2019-25322Heatmiser Netmonitor 3.03 - Hardcoded CredentialsHeatmiser Netmonitor
- CVE-2026-26068emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)jm33-m0 emp3r0r
- CVE-2026-26069Scraparr Readarr Integration exposes sensitive values as metric labels.thecfu scraparr
- CVE-2026-1358Airleader Master Unrestricted Upload of File with Dangerous TypeAirleader Master
- CVE-2026-26020AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)Significant-Gravitas AutoGPT
- CVE-2026-26011Critical Heap Out-of-bounds Access in `pf_cluster_stats()` via Malicious /initialpose Covariance -- Potential Remote Code Executionros-navigation navigation2
- CVE-2026-25227authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpointgoauthentik authentik
- CVE-2026-24044ESS Community Helm Chart has a weak server key generation methodelement-hq ess-helm · element-hq matrix-tools
- CVE-2026-26219newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Crackingnewbee-ltd newbee-mall
- CVE-2026-26218newbee-mall Default Seeded Administrator Credentials Allow Account Takeovernewbee-ltd newbee-mall
- CVE-2026-26217Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handlingunclecode Crawl4AI · crawl4ai
- CVE-2026-26216Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameterunclecode Crawl4AI · crawl4ai
- CVE-2026-26214Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITMXiaomi Technology Co. Galaxy FDS Android SDK
- CVE-2025-14014Insecure File Upload in NTN Informatics' Smart PanelNTN Information Processing Services Computer Software Hardw…
- CVE-2025-10969SQLi in Farktor Software's E-Commerce PackageFarktor Software E-Commerce Services E-Commerce Package
- CVE-2025-15573Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud ConnectionSolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1
- CVE-2025-14892Prime Listing Manager <= 1.1 - Unauthenticated Privilege EscalationPrime Listing Manager
- CVE-2026-1729AdForest <= 6.0.12 - Authentication Bypassscriptsbundle AdForest
- CVE-2025-69634Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field
- CVE-2025-70314webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request.
- CVE-2025-70981CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
High 58
- CVE-2025-40905WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functionsDBOOK WWW::OAuth
- CVE-2019-25335PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication BypassWebsitem 7070 Hazır Profesyonel Web Sitesi
- CVE-2020-37167ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression ErrorClamAV ClamBC
- CVE-2019-25342Centova Cast 3.2.12 - Denial of ServiceCentova Technologies Centova Cast
- CVE-2019-25336SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH)Nsasoft Nsauditor SpotAuditor
- CVE-2019-25333Bullwark Momentum Series JAWS 1.0 - 'Momentum Series JAWS' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Bullwark Momentum Series JAWS
- CVE-2019-25332FTP Commander Pro 8.03 - Local Stack OverflowInternet-Soft FTP Commander Pro
- CVE-2019-25331AVS Audio Converter 9.1 - 'Exit folder' Buffer OverflowAVS4YOU AVS Audio Converter
- CVE-2019-25327Prime95 Version 29.8 build 6 - Buffer Overflow (SEH)Mersenne Research Prime95
- CVE-2019-25325Thrive Smart Home 1.1 - 'Smart Home' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Thrive Smart Home
- CVE-2019-25321FTP Navigator 8.03 - Stack Overflow (SEH)Softpedia FTP Navigator
- CVE-2019-25320elearning-script 1.0 - Authentication Bypassamitkolloldey elearning-script
- CVE-2019-25319Domain Quester Pro 6.02 - Stack Overflow (SEH)Internet-Soft Domain Quester Pro
- CVE-2019-25318AVS Audio Converter 9.1.2.600 - Stack OverflowAvs4You AVS Audio Converter
- CVE-2026-26224Intego Log Reporter TOCTOU Local Privilege EscalationIntego Log Reporter
- CVE-2026-26225Intego Personal Backup Task File Privilege EscalationIntego Personal Backup
- CVE-2026-26056Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATCyokecd yoke · github.com/yokecd/yoke
- CVE-2026-26055Unauthenticated Admission Webhook Endpoints in Yoke ATCyokecd yoke · github.com/yokecd/yoke
- CVE-2026-25949Traefik: TCP readTimeout bypass via STARTTLS on Postgrestraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-25768LavinMQ is missing vhost access controlcloudamqp lavinmq
- CVE-2026-25767LavinMQ has incomplete shovel configuration validationcloudamqp lavinmq
- CVE-2026-25922authentik has a Signature Verification Bypass via SAML Assertion Wrappinggoauthentik authentik
- CVE-2026-25748authentik has a forward authentication bypass with broken cookiegoauthentik authentik
- CVE-2026-24895FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesfrankenphp · github.com/dunglas/frankenphp
- CVE-2026-24894FrankenPHP leaks session data between requests in worker modefrankenphp · github.com/dunglas/frankenphp
- CVE-2019-25347thesystem App 1.0 - 'username' SQL Injectionkostasmitroglou thesystem
- CVE-2019-25346thesystem 1.0 - 'server_name' SQL Injectionkostasmitroglou thesystem
- CVE-2019-25345RTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service PathRealtek RTK IIS Codec Service
- CVE-2019-25344MobileGo 8.5.0 - Insecure File PermissionsWondershare MobileGo
- CVE-2019-25343NextVPN 4.10 - Insecure File PermissionsVm3Max NextVPN
- CVE-2025-54519A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary coAMD Vivado™ Documentation Navigator Installation
- CVE-2023-31323Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory InterconAMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +6
- CVE-2025-52533Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromiAMD EPYC™ 7003 Series Processors · AMD EPYC™ 7002 Serie… +35
- CVE-2025-54756BrightSign Players Use of Default CredentialsBrightSign OS series 4 players · BrightSign OS series 5 pla…
- CVE-2026-1104FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Downloadninjateam FastDup – Fastest WordPress Migration & Duplicator
- CVE-2023-31313An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messagesAMD Instinct™ MI210 · AMD Instinct™ MI250
- CVE-2026-1320Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Headerays-pro Secure Copy Content Protection and Content Locking
- CVE-2026-2007PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memoryPostgreSQL
- CVE-2026-2006PostgreSQL missing validation of multibyte character length executes arbitrary codePostgreSQL
- CVE-2026-2005PostgreSQL pgcrypto heap buffer overflow executes arbitrary codePostgreSQL
- CVE-2026-2004PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary codePostgreSQL
- CVE-2025-13002XSS in Farktor Software's E-Commerce PackageFarktor Software E-Commerce Services E-Commerce Package
- CVE-2026-1316Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameterivole Customer Reviews for WooCommerce
- CVE-2025-15577Valmet DNA Web server arbitrary file read accessValmet DNA Web Tools
- CVE-2026-25676The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link M-Audio M-Track Duo HD
- CVE-2026-26235JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing AuthenticationALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server
- CVE-2026-26234JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting SyntaxALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server
- CVE-2026-23857Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or PrivilDell Update Package
- CVE-2026-23856Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4Dell iDRAC Service Module
- CVE-2026-0969Arbitrary code execution in React server-side rendering of untrusted MDX contentHashiCorp Shared library · next-mdx-remote
- CVE-2025-61879In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism.
- CVE-2025-61880In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.
- CVE-2025-63421An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the comeinst.exe file
- CVE-2025-67432A stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers to cause a Denial of
- CVE-2025-67433A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a Denial of Service (
- CVE-2025-69806p2r3 bareiron commit: 8e4d4020d contains an Out-of-bounds Read, which allows unauthenticated remote attackers to get relative information le
- CVE-2025-69807p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause a denial of service
- CVE-2025-70886An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submi
Medium, low and unrated 46
- CVE-2024-21961Improper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtualAMD EPYC™ 7002 Series Processors · AMD Ryzen™ 5000 Seri… +19
- CVE-2026-26188Solspace Freeform plugin affected by Stored Cross-Site Scripting (XSS) in Freeform Craft Plugin CP UI (builder/integrations)solspace craft-freeform · solspace/craft-freeform
- CVE-2019-25341iNetTools for iOS 8.20 - 'Whois' Denial of ServiceiNetTools for iOS
- CVE-2019-25340SpotAuditor 5.3.2 - 'Base64' Denial Of ServiceNsasoft Nsauditor SpotAuditor
- CVE-2019-25339GHIA CamIP 1.2 for iOS - 'Password' Denial of Serviceghia-camip GHIA CamIP
- CVE-2019-25338Dokuwiki 2018-04-22b - Username EnumerationDokuwiki
- CVE-2019-25337OwnCloud 8.1.8 - Username DisclosureOwnCloud
- CVE-2019-25334Product Key Explorer 4.2.0.0 - 'Name' Denial of ServiceNsasoft Nsauditor Product Key Explorer
- CVE-2019-25330SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH)Bimesoft SurfOffline Professional
- CVE-2019-25329FTP Navigator 8.03 - 'Custom Command' Denial of Service (SEH)Internet-Soft FTP Navigator
- CVE-2019-25328XnConvert 1.82 - Denial of ServiceXnSoft XnConvert
- CVE-2019-25324RICOH Web Image Monitor 1.09 - HTML InjectionRICOH Web Image Monitor
- CVE-2019-25323Heatmiser Netmonitor 3.03 - HTML InjectionHeatmiser Netmonitor
- CVE-2026-26185Directus Affected by User Enumeration via Password Reset Timing Attackdirectus · @directus/api
- CVE-2026-26076ntpd-rs affected by excessive CPU load from malformed packetspendulum-project ntpd-rs
- CVE-2026-26075Cross-Site Request Forgery (CSRF) in FastGPTlabring FastGPT
- CVE-2025-14282Dropbear: privilege escalation via unix domain socket forwardingshttps://github.com/mkj/dropbear/ dropbear
- CVE-2026-26005ClipBucket v5 enables internal network scans via an SSRF vulnerabilityMacWarrior clipbucket-v5
- CVE-2026-26000XWiki Platform affected by click-jacking through CSS injection in commentsxwiki-platform · org.xwiki.platform:xwiki-platform-web
- CVE-2026-0619Integer Wraparound DoS in Silicon Labs Matter Implementationsilabs.com Silicon Labs Matter
- CVE-2026-25996Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Modeinspektor-gadget · github.com/inspektor-gadget/inspektor-ga…
- CVE-2026-25933Arduino App Lab has Improper Data Validation in Internal Terminal Interfacearduino-app-lab
- CVE-2026-22821mreporting affected by a SQLI on date changepluginsGLPI mreporting
- CVE-2026-21438webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Mapquic-go webtransport-go · github.com/quic-go/webtransport-go
- CVE-2026-21435webtransport-go CloseWithError can block indefinitelyquic-go webtransport-go · github.com/quic-go/webtransport-go
- CVE-2026-21434webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsulequic-go webtransport-go · github.com/quic-go/webtranspor… +1
- CVE-2024-36319Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causinAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ G… +12
- CVE-2023-20601Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-AMD Radeon™ PRO VII · AMD Radeon™ VII
- CVE-2025-55210FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional ScopesFreePBX api
- CVE-2025-13004IDOR in Farktor Software's E-Commerce PackageFarktor Software E-Commerce Services E-Commerce Package
- CVE-2026-2003PostgreSQL oidvector discloses a few bytes of memoryPostgreSQL
- CVE-2026-1671Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log Fileswitcorp Activity Log for WordPress
- CVE-2025-15574Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud ConnectionSolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1
- CVE-2025-15575Missing Firmware Authenticity Checks in Solax Power Pocket WiFi modelsSolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1
- CVE-2026-2276Reflected Cross-Site Scripting in the Wix web applicationWix web application
- CVE-2026-1356Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via srcmateuszgbiorczyk Converter for Media – Optimize images | Co…
- CVE-2025-41117XSS in Grafana Explore stack tracegrafana/grafana · grafana/grafana-enterprise +1
- CVE-2026-21722Public Dashboards time range restriction on annotations can be bypassedgrafana/grafana · grafana/grafana-enterprise
- CVE-2026-2327Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the markdown-it
- CVE-2026-2391qs's arrayLimit bypass in comma parsing allows denial of serviceqs
- CVE-2026-1537LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details ExposureLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2025-56647npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket.@farmfe/core
- CVE-2025-69752An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profil
- CVE-2025-70092A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scrip
- CVE-2025-70845lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly saniti
- CVE-2026-25828grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitiz