CVEs published February 13, 2026
61 CVEs were published on February 13, 2026: 8 critical, 28 high. 2 are now in CISA KEV.
- Published
- 61
- Critical
- 8
- High
- 28
- Medium
- 22
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 30
Most affected products
- Yokogawa Electric Vnet/IP Interface Package
- 6
- bacnet-stack
- 3
- Calero VeraSMART
- 3
- Universal Software FlexCity/Kiosk
- 3
- Linux
- 2
- Mattermost · github.com/mattermost/mattermost-server
- 2
- TandoorRecipes recipes
- 2
- agents
- 1
- Alex4SSB ADB-Explorer
- 1
- Apache Software Foundation Apache Avro Java SDK · avro +1
- 1
Critical 8
- CVE-2026-26273Known affected by Account Takeover via Password Reset Token Leakageidno known · idno/known
- CVE-2026-26333Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCECalero VeraSMART
- CVE-2026-26335Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCECalero VeraSMART
- CVE-2026-26190Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromisemilvus-io milvus · github.com/milvus-io/milvus
- CVE-2026-26221Hyland OnBase Timer Service Unauthenticated .NET Remoting RCEHyland OnBase Workflow Timer Service
- CVE-2026-23112nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovecLinux
- CVE-2025-69633A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in vers
- CVE-2025-69770A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary command
High 28
- CVE-2026-24853Caido has an insufficient patch for DNS rebind leading to RCEcaido
- CVE-2026-1841PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site ScriptingPixelYourSite – Your smart PIXEL (TAG) & API Manager
- CVE-2026-1844PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site ScriptingPixelYourSite Pro – Your smart PIXEL (TAG) Manager
- CVE-2025-15157Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaultsstarfishwp Starfish Review Generation & Marketing for WordP…
- CVE-2026-26334Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service CredentialsCalero VeraSMART
- CVE-2026-26208ADB Explorer Vulnerable to Remote Code Execution via Insecure DeserializationAlex4SSB ADB-Explorer
- CVE-2026-26187lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory accesstreeverse lakeFS · github.com/treeverse/lakefs
- CVE-2026-25991Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe ImportTandoorRecipes recipes
- CVE-2026-2441Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-26264BACnet Stack WriteProperty decoding length underflow leads to OOB read and crashbacnet-stack
- CVE-2026-21878BACnet Stack Improperly Limits Pathnames to a Restricted Directorybacnet-stack
- CVE-2026-26268Cursor sandbox escape via Git hookscursor
- CVE-2026-23111netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()Linux
- CVE-2026-1619IDOR in Universal Sotware's FlexCity/KioskUniversal Software FlexCity/Kiosk
- CVE-2026-1618Admin Account Takeover in Universal Sotware's FlexCity/KioskUniversal Software FlexCity/Kiosk
- CVE-2025-14349Business Logic Error in Universal Software's FlexCity/KioskUniversal Software FlexCity/Kiosk
- CVE-2025-33042Apache Avro Java SDK: Code injection on Java generated codeApache Software Foundation Apache Avro Java SDK · avro +1
- CVE-2026-25108FileZen contains an OS command injection vulnerability.Soliton Systems K.K. FileZen
- CVE-2025-9293Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle InterceptionTP-Link Systems Tapo App · TP-Link Systems Kasa App +12
- CVE-2025-70093An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.
- CVE-2025-70121An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a
- CVE-2025-70122A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a craft
- CVE-2025-70123An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service.
- CVE-2025-70866LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control.
- CVE-2025-70954A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06.
- CVE-2025-70955A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10.
- CVE-2025-70956A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04.
- CVE-2025-70957A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09.
Medium, low and unrated 25
- CVE-2026-26269Vim has a Netbeans specialKeys Stack Buffer Overflowvim
- CVE-2026-25964Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadTandoorRecipes recipes
- CVE-2026-21870The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_stringbacnet-stack
- CVE-2025-1790Local privilege escalation in Genetec Sipelia Plugin.Genetec Sipelia
- CVE-2026-26226beautiful-mermaid < 0.1.3 SVG Attribute Injectionlukilabs beautiful-mermaid · beautiful-mermaid
- CVE-2026-2026Improper Access Control Allows Denial of ServiceTenable Agent
- CVE-2026-25531Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projectskanboard
- CVE-2026-1578HP App – Potential Cross-Site ScriptingHP App
- CVE-2026-2443Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosureRed Hat Enterprise Linux
- CVE-2026-20796Time-of-check time-of-use vulnerability in common teams APIMattermost · github.com/mattermost/mattermost-server
- CVE-2026-22892Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post AttachmentsMattermost · github.com/mattermost/mattermost-server
- CVE-2026-0872Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows LogonThalesgroup SafeNet Agent for Windows Logon
- CVE-2025-15520RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data DisclosureRegistrationMagic
- CVE-2025-48023A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.Yokogawa Electric Vnet/IP Interface Package
- CVE-2025-48022A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.Yokogawa Electric Vnet/IP Interface Package
- CVE-2025-48021A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.Yokogawa Electric Vnet/IP Interface Package
- CVE-2025-48020A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.Yokogawa Electric Vnet/IP Interface Package
- CVE-2025-48019A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.Yokogawa Electric Vnet/IP Interface Package
- CVE-2025-1924A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.Yokogawa Electric Vnet/IP Interface Package
- CVE-2026-1721Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteagents
- CVE-2025-9292Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud ControllersTP-Link Systems Omada Cloud Controller
- CVE-2025-66676An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CVE-2025-70091A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scrip
- CVE-2025-70094A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitra
- CVE-2025-70095A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to exe