# CVEs published 2026-02-12

125 CVEs were published on February 12, 2026: 21 critical, 58 high. Days are UTC.

- [CVE-2024-21961](https://cve.now/CVE-2024-21961.md): Improper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtual (CVSS 6.0, AMD EPYC™ 7002 Series Processors · AMD Ryzen™ 5000 Seri… +19)
- [CVE-2025-40905](https://cve.now/CVE-2025-40905.md): WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions (CVSS 7.3, DBOOK WWW::OAuth)
- [CVE-2026-26188](https://cve.now/CVE-2026-26188.md): Solspace Freeform plugin affected by Stored Cross-Site Scripting (XSS) in Freeform Craft Plugin CP UI (builder/integrations) (CVSS 5.1, solspace craft-freeform · solspace/craft-freeform)
- [CVE-2019-25335](https://cve.now/CVE-2019-25335.md): PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass (CVSS 8.8, Websitem 7070 Hazır Profesyonel Web Sitesi)
- [CVE-2020-37167](https://cve.now/CVE-2020-37167.md): ClamAV ClamBC \< 0.103.0-rc - 'ClamBC' Executable Regular Expression Error (CVSS 8.6, ClamAV ClamBC)
- [CVE-2019-25342](https://cve.now/CVE-2019-25342.md): Centova Cast 3.2.12 - Denial of Service (CVSS 7.1, Centova Technologies Centova Cast)
- [CVE-2019-25341](https://cve.now/CVE-2019-25341.md): iNetTools for iOS 8.20 - 'Whois' Denial of Service (CVSS 6.7, iNetTools for iOS)
- [CVE-2019-25340](https://cve.now/CVE-2019-25340.md): SpotAuditor 5.3.2 - 'Base64' Denial Of Service (CVSS 6.7, Nsasoft Nsauditor SpotAuditor)
- [CVE-2019-25339](https://cve.now/CVE-2019-25339.md): GHIA CamIP 1.2 for iOS - 'Password' Denial of Service (CVSS 6.7, ghia-camip GHIA CamIP)
- [CVE-2019-25338](https://cve.now/CVE-2019-25338.md): Dokuwiki 2018-04-22b - Username Enumeration (CVSS 6.9, Dokuwiki)
- [CVE-2019-25337](https://cve.now/CVE-2019-25337.md): OwnCloud 8.1.8 - Username Disclosure (CVSS 5.3, OwnCloud)
- [CVE-2019-25336](https://cve.now/CVE-2019-25336.md): SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH) (CVSS 8.4, Nsasoft Nsauditor SpotAuditor)
- [CVE-2019-25334](https://cve.now/CVE-2019-25334.md): Product Key Explorer 4.2.0.0 - 'Name' Denial of Service (CVSS 6.7, Nsasoft Nsauditor Product Key Explorer)
- [CVE-2019-25333](https://cve.now/CVE-2019-25333.md): Bullwark Momentum Series JAWS 1.0 - 'Momentum Series JAWS' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 8.7, Bullwark Momentum Series JAWS)
- [CVE-2019-25332](https://cve.now/CVE-2019-25332.md): FTP Commander Pro 8.03 - Local Stack Overflow (CVSS 8.4, Internet-Soft FTP Commander Pro)
- [CVE-2019-25331](https://cve.now/CVE-2019-25331.md): AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow (CVSS 8.4, AVS4YOU AVS Audio Converter)
- [CVE-2019-25330](https://cve.now/CVE-2019-25330.md): SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH) (CVSS 6.7, Bimesoft SurfOffline Professional)
- [CVE-2019-25329](https://cve.now/CVE-2019-25329.md): FTP Navigator 8.03 - 'Custom Command' Denial of Service (SEH) (CVSS 6.7, Internet-Soft FTP Navigator)
- [CVE-2019-25328](https://cve.now/CVE-2019-25328.md): XnConvert 1.82 - Denial of Service (CVSS 6.7, XnSoft XnConvert)
- [CVE-2019-25327](https://cve.now/CVE-2019-25327.md): Prime95 Version 29.8 build 6 - Buffer Overflow (SEH) (CVSS 8.4, Mersenne Research Prime95)
- [CVE-2019-25325](https://cve.now/CVE-2019-25325.md): Thrive Smart Home 1.1 - 'Smart Home' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 8.8, Thrive Smart Home)
- [CVE-2019-25324](https://cve.now/CVE-2019-25324.md): RICOH Web Image Monitor 1.09 - HTML Injection (CVSS 5.1, RICOH Web Image Monitor)
- [CVE-2019-25323](https://cve.now/CVE-2019-25323.md): Heatmiser Netmonitor 3.03 - HTML Injection (CVSS 5.1, Heatmiser Netmonitor)
- [CVE-2019-25322](https://cve.now/CVE-2019-25322.md): Heatmiser Netmonitor 3.03 - Hardcoded Credentials (CVSS 9.3, Heatmiser Netmonitor)
- [CVE-2019-25321](https://cve.now/CVE-2019-25321.md): FTP Navigator 8.03 - Stack Overflow (SEH) (CVSS 8.4, Softpedia FTP Navigator)
- [CVE-2019-25320](https://cve.now/CVE-2019-25320.md): elearning-script 1.0 - Authentication Bypass (CVSS 8.8, amitkolloldey elearning-script)
- [CVE-2019-25319](https://cve.now/CVE-2019-25319.md): Domain Quester Pro 6.02 - Stack Overflow (SEH) (CVSS 8.4, Internet-Soft Domain Quester Pro)
- [CVE-2019-25318](https://cve.now/CVE-2019-25318.md): AVS Audio Converter 9.1.2.600 - Stack Overflow (CVSS 8.4, Avs4You AVS Audio Converter)
- [CVE-2026-26068](https://cve.now/CVE-2026-26068.md): emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection) (CVSS 9.3, jm33-m0 emp3r0r)
- [CVE-2026-26224](https://cve.now/CVE-2026-26224.md): Intego Log Reporter TOCTOU Local Privilege Escalation (CVSS 8.5, Intego Log Reporter)
- [CVE-2026-26225](https://cve.now/CVE-2026-26225.md): Intego Personal Backup Task File Privilege Escalation (CVSS 8.5, Intego Personal Backup)
- [CVE-2026-26185](https://cve.now/CVE-2026-26185.md): Directus Affected by User Enumeration via Password Reset Timing Attack (CVSS 5.3, directus · @directus/api)
- [CVE-2026-26076](https://cve.now/CVE-2026-26076.md): ntpd-rs affected by excessive CPU load from malformed packets (CVSS 6.9, pendulum-project ntpd-rs)
- [CVE-2026-26075](https://cve.now/CVE-2026-26075.md): Cross-Site Request Forgery (CSRF) in FastGPT (CVSS 6.9, labring FastGPT)
- [CVE-2025-14282](https://cve.now/CVE-2025-14282.md): Dropbear: privilege escalation via unix domain socket forwardings (CVSS 5.4, https://github.com/mkj/dropbear/ dropbear)
- [CVE-2026-26069](https://cve.now/CVE-2026-26069.md): Scraparr Readarr Integration exposes sensitive values as metric labels. (CVSS 9.1, thecfu scraparr)
- [CVE-2026-1358](https://cve.now/CVE-2026-1358.md): Airleader Master Unrestricted Upload of File with Dangerous Type (CVSS 9.8, Airleader Master)
- [CVE-2026-26056](https://cve.now/CVE-2026-26056.md): Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC (CVSS 8.8, yokecd yoke · github.com/yokecd/yoke)
- [CVE-2026-26055](https://cve.now/CVE-2026-26055.md): Unauthenticated Admission Webhook Endpoints in Yoke ATC (CVSS 7.5, yokecd yoke · github.com/yokecd/yoke)
- [CVE-2026-26020](https://cve.now/CVE-2026-26020.md): AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (\_\_import\_\_) (CVSS 9.4, Significant-Gravitas AutoGPT)
- [CVE-2026-26011](https://cve.now/CVE-2026-26011.md): Critical Heap Out-of-bounds Access in \`pf\_cluster\_stats()\` via Malicious /initialpose Covariance -- Potential Remote Code Execution (CVSS 9.3, ros-navigation navigation2)
- [CVE-2026-26005](https://cve.now/CVE-2026-26005.md): ClipBucket v5 enables internal network scans via an SSRF vulnerability (CVSS 5.0, MacWarrior clipbucket-v5)
- [CVE-2026-26000](https://cve.now/CVE-2026-26000.md): XWiki Platform affected by click-jacking through CSS injection in comments (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-web)
- [CVE-2026-0619](https://cve.now/CVE-2026-0619.md): Integer Wraparound DoS in Silicon Labs Matter Implementation (CVSS 6.0, silabs.com Silicon Labs Matter)
- [CVE-2026-25996](https://cve.now/CVE-2026-25996.md): Inspektor Gadget uses unsanitized ANSI Escape Sequences In \`columns\` Output Mode (CVSS 6.9, inspektor-gadget · github.com/inspektor-gadget/inspektor-ga…)
- [CVE-2026-25949](https://cve.now/CVE-2026-25949.md): Traefik: TCP readTimeout bypass via STARTTLS on Postgres (CVSS 7.5, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-25933](https://cve.now/CVE-2026-25933.md): Arduino App Lab has Improper Data Validation in Internal Terminal Interface (CVSS 6.9, arduino-app-lab)
- [CVE-2026-25768](https://cve.now/CVE-2026-25768.md): LavinMQ is missing vhost access control (CVSS 7.1, cloudamqp lavinmq)
- [CVE-2026-25767](https://cve.now/CVE-2026-25767.md): LavinMQ has incomplete shovel configuration validation (CVSS 8.6, cloudamqp lavinmq)
- [CVE-2026-25922](https://cve.now/CVE-2026-25922.md): authentik has a Signature Verification Bypass via SAML Assertion Wrapping (CVSS 8.8, goauthentik authentik)
- [CVE-2026-25748](https://cve.now/CVE-2026-25748.md): authentik has a forward authentication bypass with broken cookie (CVSS 8.6, goauthentik authentik)
- [CVE-2026-25227](https://cve.now/CVE-2026-25227.md): authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint (CVSS 9.1, goauthentik authentik)
- [CVE-2026-24895](https://cve.now/CVE-2026-24895.md): FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files (CVSS 8.9, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-24894](https://cve.now/CVE-2026-24894.md): FrankenPHP leaks session data between requests in worker mode (CVSS 8.7, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-24044](https://cve.now/CVE-2026-24044.md): ESS Community Helm Chart has a weak server key generation method (CVSS 9.2, element-hq ess-helm · element-hq matrix-tools)
- [CVE-2019-25347](https://cve.now/CVE-2019-25347.md): thesystem App 1.0 - 'username' SQL Injection (CVSS 7.1, kostasmitroglou thesystem)
- [CVE-2019-25346](https://cve.now/CVE-2019-25346.md): thesystem 1.0 - 'server\_name' SQL Injection (CVSS 7.1, kostasmitroglou thesystem)
- [CVE-2019-25345](https://cve.now/CVE-2019-25345.md): RTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service Path (CVSS 8.5, Realtek RTK IIS Codec Service)
- [CVE-2019-25344](https://cve.now/CVE-2019-25344.md): MobileGo 8.5.0 - Insecure File Permissions (CVSS 8.5, Wondershare MobileGo)
- [CVE-2019-25343](https://cve.now/CVE-2019-25343.md): NextVPN 4.10 - Insecure File Permissions (CVSS 8.5, Vm3Max NextVPN)
- [CVE-2026-22821](https://cve.now/CVE-2026-22821.md): mreporting affected by a SQLI on date change (CVSS 4.9, pluginsGLPI mreporting)
- [CVE-2026-26219](https://cve.now/CVE-2026-26219.md): newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking (CVSS 9.3, newbee-ltd newbee-mall)
- [CVE-2026-26218](https://cve.now/CVE-2026-26218.md): newbee-mall Default Seeded Administrator Credentials Allow Account Takeover (CVSS 9.3, newbee-ltd newbee-mall)
- [CVE-2026-21438](https://cve.now/CVE-2026-21438.md): webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map (CVSS 5.3, quic-go webtransport-go · github.com/quic-go/webtransport-go)
- [CVE-2026-21435](https://cve.now/CVE-2026-21435.md): webtransport-go CloseWithError can block indefinitely (CVSS 5.3, quic-go webtransport-go · github.com/quic-go/webtransport-go)
- [CVE-2026-21434](https://cve.now/CVE-2026-21434.md): webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT\_CLOSE\_SESSION Capsule (CVSS 5.3, quic-go webtransport-go · github.com/quic-go/webtranspor… +1)
- [CVE-2025-54519](https://cve.now/CVE-2025-54519.md): A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary co (CVSS 7.3, AMD Vivado™ Documentation Navigator Installation)
- [CVE-2023-31323](https://cve.now/CVE-2023-31323.md): Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Intercon (CVSS 8.4, AMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +6)
- [CVE-2024-36319](https://cve.now/CVE-2024-36319.md): Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causin (CVSS 6.3, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ G… +12)
- [CVE-2023-20601](https://cve.now/CVE-2023-20601.md): Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial- (CVSS 4.6, AMD Radeon™ PRO VII · AMD Radeon™ VII)
- [CVE-2025-52533](https://cve.now/CVE-2025-52533.md): Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromi (CVSS 8.7, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 7002 Serie… +35)
- [CVE-2025-54756](https://cve.now/CVE-2025-54756.md): BrightSign Players Use of Default Credentials (CVSS 8.4, BrightSign OS series 4 players · BrightSign OS series 5 pla…)
- [CVE-2025-55210](https://cve.now/CVE-2025-55210.md): FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes (CVSS 2.0, FreePBX api)
- [CVE-2026-26217](https://cve.now/CVE-2026-26217.md): Crawl4AI \< 0.8.0 Docker API Local File Inclusion via file URL Handling (CVSS 9.2, unclecode Crawl4AI · crawl4ai)
- [CVE-2026-26216](https://cve.now/CVE-2026-26216.md): Crawl4AI \< 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter (CVSS 10.0, unclecode Crawl4AI · crawl4ai)
- [CVE-2026-26214](https://cve.now/CVE-2026-26214.md): Xiaomi Galaxy FDS Android SDK \<= 3.0.8 TLS Hostname Verification Disabled Enables MITM (CVSS 9.1, Xiaomi Technology Co. Galaxy FDS Android SDK)
- [CVE-2026-1104](https://cve.now/CVE-2026-1104.md): FastDup – Fastest WordPress Migration & Duplicator \<= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download (CVSS 8.8, ninjateam FastDup – Fastest WordPress Migration & Duplicator)
- [CVE-2023-31313](https://cve.now/CVE-2023-31313.md): An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages (CVSS 7.2, AMD Instinct™ MI210 · AMD Instinct™ MI250)
- [CVE-2025-14014](https://cve.now/CVE-2025-14014.md): Insecure File Upload in NTN Informatics' Smart Panel (CVSS 9.8, NTN Information Processing Services Computer Software Hardw…)
- [CVE-2026-1320](https://cve.now/CVE-2026-1320.md): Secure Copy Content Protection and Content Locking \<= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header (CVSS 7.2, ays-pro Secure Copy Content Protection and Content Locking)
- [CVE-2025-13004](https://cve.now/CVE-2025-13004.md): IDOR in Farktor Software's E-Commerce Package (CVSS 6.3, Farktor Software E-Commerce Services E-Commerce Package)
- [CVE-2026-2007](https://cve.now/CVE-2026-2007.md): PostgreSQL pg\_trgm heap buffer overflow writes pattern onto server memory (CVSS 8.2, PostgreSQL)
- [CVE-2026-2006](https://cve.now/CVE-2026-2006.md): PostgreSQL missing validation of multibyte character length executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-2005](https://cve.now/CVE-2026-2005.md): PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-2004](https://cve.now/CVE-2026-2004.md): PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-2003](https://cve.now/CVE-2026-2003.md): PostgreSQL oidvector discloses a few bytes of memory (CVSS 4.3, PostgreSQL)
- [CVE-2025-13002](https://cve.now/CVE-2025-13002.md): XSS in Farktor Software's E-Commerce Package (CVSS 8.2, Farktor Software E-Commerce Services E-Commerce Package)
- [CVE-2025-10969](https://cve.now/CVE-2025-10969.md): SQLi in Farktor Software's E-Commerce Package (CVSS 9.8, Farktor Software E-Commerce Services E-Commerce Package)
- [CVE-2026-1316](https://cve.now/CVE-2026-1316.md): Customer Reviews for WooCommerce \<= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media\[\].href Parameter (CVSS 7.2, ivole Customer Reviews for WooCommerce)
- [CVE-2026-1671](https://cve.now/CVE-2026-1671.md): Activity Log for WordPress \<= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File (CVSS 6.5, switcorp Activity Log for WordPress)
- [CVE-2025-15574](https://cve.now/CVE-2025-15574.md): Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection (CVSS 6.5, SolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1)
- [CVE-2025-15575](https://cve.now/CVE-2025-15575.md): Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models (CVSS 5.3, SolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1)
- [CVE-2025-15573](https://cve.now/CVE-2025-15573.md): Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection (CVSS 9.4, SolaX Power Pocket WiFi · SolaX Power Pocket WiFi+LAN +1)
- [CVE-2026-2276](https://cve.now/CVE-2026-2276.md): Reflected Cross-Site Scripting in the Wix web application (CVSS 5.3, Wix web application)
- [CVE-2026-1356](https://cve.now/CVE-2026-1356.md): Converter for Media – Optimize images | Convert WebP & AVIF \<= 6.5.1 - Unauthenticated Server-Side Request Forgery via src (CVSS 4.8, mateuszgbiorczyk Converter for Media – Optimize images | Co…)
- [CVE-2025-41117](https://cve.now/CVE-2025-41117.md): XSS in Grafana Explore stack trace (CVSS 6.8, grafana/grafana · grafana/grafana-enterprise +1)
- [CVE-2026-21722](https://cve.now/CVE-2026-21722.md): Public Dashboards time range restriction on annotations can be bypassed (CVSS 5.3, grafana/grafana · grafana/grafana-enterprise)
- [CVE-2025-15577](https://cve.now/CVE-2025-15577.md): Valmet DNA Web server arbitrary file read access (CVSS 8.7, Valmet DNA Web Tools)
- [CVE-2025-14892](https://cve.now/CVE-2025-14892.md): Prime Listing Manager \<= 1.1 - Unauthenticated Privilege Escalation (CVSS 9.8, Prime Listing Manager)
- [CVE-2026-2327](https://cve.now/CVE-2026-2327.md): Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the (CVSS 6.9, markdown-it)
- [CVE-2026-2391](https://cve.now/CVE-2026-2391.md): qs's arrayLimit bypass in comma parsing allows denial of service (CVSS 6.3, qs)
- [CVE-2026-25676](https://cve.now/CVE-2026-25676.md): The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link (CVSS 7.8, M-Audio M-Track Duo HD)
- [CVE-2026-26235](https://cve.now/CVE-2026-26235.md): JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication (CVSS 8.7, ALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server)
- [CVE-2026-26234](https://cve.now/CVE-2026-26234.md): JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax (CVSS 8.7, ALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server)
- [CVE-2026-1537](https://cve.now/CVE-2026-1537.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.6 - Missing Authorization to Booking Details Exposure (CVSS 5.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-23857](https://cve.now/CVE-2026-23857.md): Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or Privil (CVSS 8.2, Dell Update Package)
- [CVE-2026-23856](https://cve.now/CVE-2026-23856.md): Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4 (CVSS 7.8, Dell iDRAC Service Module)
- [CVE-2026-0969](https://cve.now/CVE-2026-0969.md): Arbitrary code execution in React server-side rendering of untrusted MDX content (CVSS 8.8, HashiCorp Shared library · next-mdx-remote)
- [CVE-2026-1729](https://cve.now/CVE-2026-1729.md): AdForest \<= 6.0.12 - Authentication Bypass (CVSS 9.8, scriptsbundle AdForest)
- [CVE-2025-56647](https://cve.now/CVE-2025-56647.md): npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. (CVSS 6.5, @farmfe/core)
- [CVE-2025-61879](https://cve.now/CVE-2025-61879.md): In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism. (CVSS 7.7)
- [CVE-2025-61880](https://cve.now/CVE-2025-61880.md): In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution. (CVSS 8.8)
- [CVE-2025-63421](https://cve.now/CVE-2025-63421.md): An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the comeinst.exe file (CVSS 7.8)
- [CVE-2025-67432](https://cve.now/CVE-2025-67432.md): A stack overflow in the ZBarcode\_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers to cause a Denial of (CVSS 7.5)
- [CVE-2025-67433](https://cve.now/CVE-2025-67433.md): A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a Denial of Service ( (CVSS 7.5)
- [CVE-2025-69634](https://cve.now/CVE-2025-69634.md): Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field (CVSS 9.0)
- [CVE-2025-69752](https://cve.now/CVE-2025-69752.md): An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profil (CVSS 4.3)
- [CVE-2025-69806](https://cve.now/CVE-2025-69806.md): p2r3 bareiron commit: 8e4d4020d contains an Out-of-bounds Read, which allows unauthenticated remote attackers to get relative information le (CVSS 7.5)
- [CVE-2025-69807](https://cve.now/CVE-2025-69807.md): p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause a denial of service (CVSS 7.5)
- [CVE-2025-70092](https://cve.now/CVE-2025-70092.md): A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scrip (CVSS 5.5)
- [CVE-2025-70314](https://cve.now/CVE-2025-70314.md): webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. (CVSS 9.8)
- [CVE-2025-70845](https://cve.now/CVE-2025-70845.md): lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly saniti (CVSS 6.1)
- [CVE-2025-70886](https://cve.now/CVE-2025-70886.md): An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submi (CVSS 7.5)
- [CVE-2025-70981](https://cve.now/CVE-2025-70981.md): CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter. (CVSS 9.8)
- [CVE-2026-25828](https://cve.now/CVE-2026-25828.md): grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitiz (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.