# CVEs published 2026-02-13

61 CVEs were published on February 13, 2026: 8 critical, 28 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-24853](https://cve.now/CVE-2026-24853.md): Caido has an insufficient patch for DNS rebind leading to RCE (CVSS 8.1, caido)
- [CVE-2026-26273](https://cve.now/CVE-2026-26273.md): Known affected by Account Takeover via Password Reset Token Leakage (CVSS 9.8, idno known · idno/known)
- [CVE-2026-1841](https://cve.now/CVE-2026-1841.md): PixelYourSite \<= 11.2.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, PixelYourSite – Your smart PIXEL (TAG) & API Manager)
- [CVE-2026-1844](https://cve.now/CVE-2026-1844.md): PixelYourSite PRO \<= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, PixelYourSite Pro – Your smart PIXEL (TAG) Manager)
- [CVE-2025-15157](https://cve.now/CVE-2025-15157.md): Starfish Review Generation & Marketing for WordPress \<= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm\_restore\_options\_defaults (CVSS 8.8, starfishwp Starfish Review Generation & Marketing for WordP…)
- [CVE-2026-26334](https://cve.now/CVE-2026-26334.md): Calero VeraSMART \< 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials (CVSS 8.5, Calero VeraSMART)
- [CVE-2026-26333](https://cve.now/CVE-2026-26333.md): Calero VeraSMART \< 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE (CVSS 10.0, Calero VeraSMART)
- [CVE-2026-26335](https://cve.now/CVE-2026-26335.md): Calero VeraSMART \< 2022 R1 Static IIS Machine Keys Enable ViewState RCE (CVSS 9.3, Calero VeraSMART)
- [CVE-2026-26269](https://cve.now/CVE-2026-26269.md): Vim has a Netbeans specialKeys Stack Buffer Overflow (CVSS 5.4, vim)
- [CVE-2026-26208](https://cve.now/CVE-2026-26208.md): ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization (CVSS 7.8, Alex4SSB ADB-Explorer)
- [CVE-2026-26190](https://cve.now/CVE-2026-26190.md): Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise (CVSS 9.8, milvus-io milvus · github.com/milvus-io/milvus)
- [CVE-2026-26187](https://cve.now/CVE-2026-26187.md): lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access (CVSS 8.1, treeverse lakeFS · github.com/treeverse/lakefs)
- [CVE-2026-25991](https://cve.now/CVE-2026-25991.md): Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import (CVSS 7.7, TandoorRecipes recipes)
- [CVE-2026-2441](https://cve.now/CVE-2026-2441.md): Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, KEV, Google Chrome)
- [CVE-2026-25964](https://cve.now/CVE-2026-25964.md): Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read (CVSS 4.9, TandoorRecipes recipes)
- [CVE-2026-26264](https://cve.now/CVE-2026-26264.md): BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash (CVSS 7.8, bacnet-stack)
- [CVE-2026-21878](https://cve.now/CVE-2026-21878.md): BACnet Stack Improperly Limits Pathnames to a Restricted Directory (CVSS 7.5, bacnet-stack)
- [CVE-2026-21870](https://cve.now/CVE-2026-21870.md): The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer\_string (CVSS 5.5, bacnet-stack)
- [CVE-2026-26268](https://cve.now/CVE-2026-26268.md): Cursor sandbox escape via Git hooks (CVSS 8.1, cursor)
- [CVE-2025-1790](https://cve.now/CVE-2025-1790.md): Local privilege escalation in Genetec Sipelia Plugin. (CVSS 5.8, Genetec Sipelia)
- [CVE-2026-26226](https://cve.now/CVE-2026-26226.md): beautiful-mermaid \< 0.1.3 SVG Attribute Injection (CVSS 5.3, lukilabs beautiful-mermaid · beautiful-mermaid)
- [CVE-2026-2026](https://cve.now/CVE-2026-2026.md): Improper Access Control Allows Denial of Service (CVSS 5.4, Tenable Agent)
- [CVE-2026-26221](https://cve.now/CVE-2026-26221.md): Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE (CVSS 9.3, Hyland OnBase Workflow Timer Service)
- [CVE-2026-25531](https://cve.now/CVE-2026-25531.md): Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects (CVSS 4.3, kanboard)
- [CVE-2026-1578](https://cve.now/CVE-2026-1578.md): HP App – Potential Cross-Site Scripting (CVSS 5.1, HP App)
- [CVE-2026-23112](https://cve.now/CVE-2026-23112.md): nvmet-tcp: add bounds checks in nvmet\_tcp\_build\_pdu\_iovec (CVSS 9.8, Linux)
- [CVE-2026-23111](https://cve.now/CVE-2026-23111.md): netfilter: nf\_tables: fix inverted genmask check in nft\_map\_catchall\_activate() (CVSS 7.8, Linux)
- [CVE-2026-1619](https://cve.now/CVE-2026-1619.md): IDOR in Universal Sotware's FlexCity/Kiosk (CVSS 8.3, Universal Software FlexCity/Kiosk)
- [CVE-2026-1618](https://cve.now/CVE-2026-1618.md): Admin Account Takeover in Universal Sotware's FlexCity/Kiosk (CVSS 8.8, Universal Software FlexCity/Kiosk)
- [CVE-2025-14349](https://cve.now/CVE-2025-14349.md): Business Logic Error in Universal Software's FlexCity/Kiosk (CVSS 8.8, Universal Software FlexCity/Kiosk)
- [CVE-2026-2443](https://cve.now/CVE-2026-2443.md): Libsoup: out-of-bounds read in libsoup handle\_partial\_get() leading to heap information disclosure (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2025-33042](https://cve.now/CVE-2025-33042.md): Apache Avro Java SDK: Code injection on Java generated code (CVSS 7.3, Apache Software Foundation Apache Avro Java SDK · avro +1)
- [CVE-2026-20796](https://cve.now/CVE-2026-20796.md): Time-of-check time-of-use vulnerability in common teams API (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-22892](https://cve.now/CVE-2026-22892.md): Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-0872](https://cve.now/CVE-2026-0872.md): Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon (CVSS 2.5, Thalesgroup SafeNet Agent for Windows Logon)
- [CVE-2025-15520](https://cve.now/CVE-2025-15520.md): RegistrationMagic \<= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure (CVSS 4.3, RegistrationMagic)
- [CVE-2025-48023](https://cve.now/CVE-2025-48023.md): A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. (CVSS 6.0, Yokogawa Electric Vnet/IP Interface Package)
- [CVE-2025-48022](https://cve.now/CVE-2025-48022.md): A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. (CVSS 6.0, Yokogawa Electric Vnet/IP Interface Package)
- [CVE-2025-48021](https://cve.now/CVE-2025-48021.md): A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. (CVSS 6.0, Yokogawa Electric Vnet/IP Interface Package)
- [CVE-2025-48020](https://cve.now/CVE-2025-48020.md): A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. (CVSS 6.0, Yokogawa Electric Vnet/IP Interface Package)
- [CVE-2025-48019](https://cve.now/CVE-2025-48019.md): A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. (CVSS 6.0, Yokogawa Electric Vnet/IP Interface Package)
- [CVE-2025-1924](https://cve.now/CVE-2025-1924.md): A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. (CVSS 6.0, Yokogawa Electric Vnet/IP Interface Package)
- [CVE-2026-25108](https://cve.now/CVE-2026-25108.md): FileZen contains an OS command injection vulnerability. (CVSS 8.8, KEV, Soliton Systems K.K. FileZen)
- [CVE-2026-1721](https://cve.now/CVE-2026-1721.md): Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site (CVSS 6.2, agents)
- [CVE-2025-9293](https://cve.now/CVE-2025-9293.md): Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception (CVSS 7.7, TP-Link Systems Tapo App · TP-Link Systems Kasa App +12)
- [CVE-2025-9292](https://cve.now/CVE-2025-9292.md): Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers (CVSS 2.0, TP-Link Systems Omada Cloud Controller)
- [CVE-2025-66676](https://cve.now/CVE-2025-66676.md): An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request. (CVSS 6.2)
- [CVE-2025-69633](https://cve.now/CVE-2025-69633.md): A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in vers (CVSS 9.8)
- [CVE-2025-69770](https://cve.now/CVE-2025-69770.md): A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary command (CVSS 10.0)
- [CVE-2025-70091](https://cve.now/CVE-2025-70091.md): A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scrip (CVSS 6.5)
- [CVE-2025-70093](https://cve.now/CVE-2025-70093.md): An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response. (CVSS 7.4)
- [CVE-2025-70094](https://cve.now/CVE-2025-70094.md): A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitra (CVSS 6.5)
- [CVE-2025-70095](https://cve.now/CVE-2025-70095.md): A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to exe (CVSS 6.5)
- [CVE-2025-70121](https://cve.now/CVE-2025-70121.md): An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a (CVSS 7.5)
- [CVE-2025-70122](https://cve.now/CVE-2025-70122.md): A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a craft (CVSS 7.5)
- [CVE-2025-70123](https://cve.now/CVE-2025-70123.md): An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. (CVSS 7.5)
- [CVE-2025-70866](https://cve.now/CVE-2025-70866.md): LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. (CVSS 8.8)
- [CVE-2025-70954](https://cve.now/CVE-2025-70954.md): A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. (CVSS 7.5)
- [CVE-2025-70955](https://cve.now/CVE-2025-70955.md): A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. (CVSS 7.5)
- [CVE-2025-70956](https://cve.now/CVE-2025-70956.md): A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. (CVSS 7.5)
- [CVE-2025-70957](https://cve.now/CVE-2025-70957.md): A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.