CVEs published February 14, 2026
163 CVEs were published on February 14, 2026: 2 critical, 30 high.
- Published
- 163
- Critical
- 2
- High
- 30
- Medium
- 46
- Low
- 0
- Unrated
- 85
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- Linux
- 108
- webilop User Language Switch
- 2
- adminkov midi-Synth
- 1
- ajferg Link Hopper
- 1
- alexeyknyazev personal-authors-category
- 1
- amentotechpvtltd One to one user Chat by WPGuppy
- 1
- ampenhancer AMP Enhancer – Compatibility Layer for Official…
- 1
- antevenio MDirector Newsletter WordPress Plugin
- 1
- arieslab Press3D
- 1
- arnoesterhuizen Allow HTML in Category Descriptions
- 1
Critical 2
High 30
- CVE-2026-23209macvlan: fix error recovery in macvlan_common_newlink()Linux
- CVE-2026-23204net/sched: cls_u32: use skb_header_pointer_careful()Linux
- CVE-2026-23198KVM: Don't clobber irqfd routing type when deassigning irqfdLinux
- CVE-2026-23195cgroup/dmem: avoid pool UAFLinux
- CVE-2026-23193scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()Linux
- CVE-2026-23192linkwatch: use __dev_put() in callers to prevent UAFLinux
- CVE-2026-23191ALSA: aloop: Fix racy access at PCM triggerLinux
- CVE-2026-23185wifi: iwlwifi: mld: cancel mlo_scan_start_wkLinux
- CVE-2026-23184binder: fix UAF in binder_netlink_report()Linux
- CVE-2026-23180dpaa2-switch: add bounds check for if_id in IRQ handlerLinux
- CVE-2026-23178HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()Linux
- CVE-2026-23175net: cpsw: Execute ndo_set_rx_mode callback in a work queueLinux
- CVE-2025-71221dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()Linux
- CVE-2025-71204smb/server: fix refcount leak in parse_durable_handle_context()Linux
- CVE-2026-23172net: wwan: t7xx: fix potential skb->frags overflow in RX pathLinux
- CVE-2026-23171bonding: fix use-after-free due to enslave fail after slave array updateLinux
- CVE-2026-23169mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()Linux
- CVE-2026-23161mm/shmem, swap: fix race of truncate and swap entry splitLinux
- CVE-2026-23148nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereferenceLinux
- CVE-2025-71202iommu/sva: invalidate stale IOTLB entries for kernel address spaceLinux
- CVE-2026-23139netfilter: nf_conncount: update last_gc only when GC has been performedLinux
- CVE-2026-23136libceph: reset sparse-read state in osd_fault()Linux
- CVE-2025-71201netfs: Fix early read unlock of page with EOF in middleLinux
- CVE-2026-1843Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Logoptimole Super Page Cache
- CVE-2026-1988Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attributewpdecent Flexi Product Slider and Grid for WooCommerce
- CVE-2026-0753Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameterbitacre Super Simple Contact Form
- CVE-2026-2024PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parametersavitasoni PhotoStack Gallery
- CVE-2026-2469Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used directorytree/imapengine
- CVE-2026-0692BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status ManipulationBlueSnap Payment Gateway for WooCommerce
- CVE-2026-2144Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storagekatsushi-kawamori Magic Login Mail or QR Code
Medium, low and unrated 131
- CVE-2026-23210ice: Fix PTP NULL pointer dereference during VSI rebuildLinux
- CVE-2026-23208ALSA: usb-audio: Prevent excessive number of framesLinux
- CVE-2026-23207spi: tegra210-quad: Protect curr_xfer check in IRQ handlerLinux
- CVE-2026-23206dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zeroLinux
- CVE-2026-23205smb/client: fix memory leak in smb2_open_file()Linux
- CVE-2026-23203net: cpsw_new: Execute ndo_set_rx_mode callback in a work queueLinux
- CVE-2026-23202spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xferLinux
- CVE-2026-23201ceph: fix oops due to invalid pointer for kfree() in parse_longname()Linux
- CVE-2026-23200ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONFLinux
- CVE-2026-23199procfs: avoid fetching build ID while holding VMA lockLinux
- CVE-2026-23197i2c: imx: preserve error state in block data length handlerLinux
- CVE-2026-23196HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA bufferLinux
- CVE-2026-23194rust_binder: correctly handle FDA objects of length zeroLinux
- CVE-2026-23190ASoC: amd: fix memory leak in acp3x pdm dma opsLinux
- CVE-2026-23189ceph: fix NULL pointer dereference in ceph_mds_auth_match()Linux
- CVE-2026-23188net: usb: r8152: fix resume reset deadlockLinux
- CVE-2026-23187pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domainsLinux
- CVE-2026-23186hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()Linux
- CVE-2026-23183cgroup/dmem: fix NULL pointer dereference when setting maxLinux
- CVE-2026-23182spi: tegra: Fix a memory leak in tegra_slink_probe()Linux
- CVE-2026-23181btrfs: sync read disk super and set block sizeLinux
- CVE-2026-23179nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()Linux
- CVE-2026-23177mm, shmem: prevent infinite loop on truncate raceLinux
- CVE-2026-23176platform/x86: toshiba_haps: Fix memory leaks in add/remove routinesLinux
- CVE-2026-23174nvme-pci: handle changing device dma map requirementsLinux
- CVE-2025-71224wifi: mac80211: ocb: skip rx_no_sta when interface is not joinedLinux
- CVE-2025-71223smb/server: fix refcount leak in smb2_open()Linux
- CVE-2025-71222wifi: wlcore: ensure skb headroom before skb_pushLinux
- CVE-2025-71220smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()Linux
- CVE-2025-71203riscv: Sanitize syscall table indexing under speculationLinux
- CVE-2026-23173net/mlx5e: TC, delete flows only for existing peersLinux
- CVE-2026-23170drm/imx/tve: fix probe device leakLinux
- CVE-2026-23168flex_proportions: make fprop_new_period() hardirq safeLinux
- CVE-2026-23167nfc: nci: Fix race between rfkill and nci_unregister_device().Linux
- CVE-2026-23166ice: Fix NULL pointer dereference in ice_vsi_set_napi_queuesLinux
- CVE-2026-23165sfc: fix deadlock in RSS config readLinux
- CVE-2026-23164rocker: fix memory leak in rocker_world_port_post_fini()Linux
- CVE-2026-23163drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_removeLinux
- CVE-2026-23162drm/xe/nvm: Fix double-free on aux add failureLinux
- CVE-2026-23160octeon_ep: Fix memory leak in octep_device_setup()Linux
- CVE-2026-23159perf: sched: Fix perf crash with new is_user_task() helperLinux
- CVE-2026-23158gpio: virtuser: fix UAF in configfs release pathLinux
- CVE-2026-23157btrfs: do not strictly require dirty metadata threshold for metadata writepagesLinux
- CVE-2026-23156efivarfs: fix error propagation in efivar_entry_get()Linux
- CVE-2026-23155can: gs_usb: gs_usb_receive_bulk_callback(): fix error messageLinux
- CVE-2026-23154net: fix segmentation of forwarding fraglist GROLinux
- CVE-2026-23153firewire: core: fix race condition against transaction listLinux
- CVE-2026-23152wifi: mac80211: correctly decode TTLM with default link mapLinux
- CVE-2026-23151Bluetooth: MGMT: Fix memory leak in set_ssp_completeLinux
- CVE-2026-23150nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().Linux
- CVE-2026-23149drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()Linux
- CVE-2026-23147btrfs: zlib: fix the folio leak on S390 hardware accelerationLinux
- CVE-2026-23146Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_workLinux
- CVE-2026-23145ext4: fix iloc.bh leak in ext4_xattr_inode_update_refLinux
- CVE-2026-23144mm/damon/sysfs: cleanup attrs subdirs on context dir setup failureLinux
- CVE-2026-23143virtio_net: Fix misalignment bug in struct virtnet_infoLinux
- CVE-2026-23142mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failureLinux
- CVE-2026-23141btrfs: send: check for inline extents in range_is_hole_in_parent()Linux
- CVE-2026-23140bpf, test_run: Subtract size of xdp_frame from allowed metadata sizeLinux
- CVE-2026-23138tracing: Add recursion protection in kernel stack trace recordingLinux
- CVE-2026-23137of: unittest: Fix memory leak in unittest_data_add()Linux
- CVE-2026-23135wifi: ath12k: fix dma_free_coherent() pointerLinux
- CVE-2026-23134slab: fix kmalloc_nolock() context check for PREEMPT_RTLinux
- CVE-2026-23133wifi: ath10k: fix dma_free_coherent() pointerLinux
- CVE-2026-23132drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bindLinux
- CVE-2026-23131platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute namesLinux
- CVE-2026-23130wifi: ath12k: fix dead lock while flushing management framesLinux
- CVE-2026-23129dpll: Prevent duplicate registrationsLinux
- CVE-2026-23128arm64: Set __nocfi on swsusp_arch_resume()Linux
- CVE-2026-23127perf: Fix refcount warning on event->mmap_count incrementLinux
- CVE-2026-23126netdevsim: fix a race issue related to the operation on bpf_bound_progs listLinux
- CVE-2026-23125sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INITLinux
- CVE-2026-23124ipv6: annotate data-race in ndisc_router_discovery()Linux
- CVE-2026-23123interconnect: debugfs: initialize src_node and dst_node to empty stringsLinux
- CVE-2026-23122igc: Reduce TSN TX packet buffer from 7KB to 5KB per queueLinux
- CVE-2026-23121mISDN: annotate data-race around dev->workLinux
- CVE-2026-23120l2tp: avoid one data-race in l2tp_tunnel_del_work()Linux
- CVE-2026-23119bonding: provide a net pointer to __skb_flow_dissect()Linux
- CVE-2026-23118rxrpc: Fix data-race warning and potential load/store tearingLinux
- CVE-2026-23117ice: add missing ice_deinit_hw() in devlink reinit pathLinux
- CVE-2026-23116pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpuLinux
- CVE-2026-23115serial: Fix not set tty->port race conditionLinux
- CVE-2026-23114arm64/fpsimd: ptrace: Fix SVE writes on !SME systemsLinux
- CVE-2026-23113io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loopLinux
- CVE-2025-71200mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 modeLinux
- CVE-2026-2312Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Renamemaxfoundry Media Library Folders
- CVE-2026-1512Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widgetwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2026-1258Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpointsgetwpfunnels Mail Mint – Email Marketing, Newsletter, Email…
- CVE-2026-0550myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcodesaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2026-1254Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editingwpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-1249MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request ForgeryMP3 Audio Player – Music Player, Podcast Player & Radio by…
- CVE-2026-1987Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modificationmorelmathieuj Scheduler Widget
- CVE-2026-0736Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Fieldcollectchat Chatbot for WordPress by Collect.chat ⚡️
- CVE-2026-1187ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attributeterrazoom ZoomifyWP Free
- CVE-2026-1915Simple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attributebestony Simple Plyr
- CVE-2026-1985Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Blockarieslab Press3D
- CVE-2026-0735User Language Switch <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameterwebilop User Language Switch
- CVE-2025-15483Link Hopper <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameterajferg Link Hopper
- CVE-2026-1303MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnectionmatthieuscarset MailChimp Campaigns
- CVE-2026-1910UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' AttributeUpMenu – Online ordering for restaurants
- CVE-2026-0693Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptionsarnoesterhuizen Allow HTML in Category Descriptions
- CVE-2026-1096Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attributeraju_ahmed Best-wp-google-map
- CVE-2026-0559MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcodestylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2026-1394WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Updatedmitritechs WP Quick Contact Us
- CVE-2026-1905Sphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attributedevmw Sphere Manager
- CVE-2025-14852MDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Updateantevenio MDirector Newsletter WordPress Plugin
- CVE-2026-1944CallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Updatekrellbat CallbackKiller service widget
- CVE-2026-0557WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcodepeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-1939Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescutesalah Percent to Infograph
- CVE-2026-1795Address Bar Ads <= 1.0.0 - Reflected Cross-Site Scriptingsivenso Address Bar Ads
- CVE-2026-1903Ravelry Designs Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attributeshellbot Ravelry Designs Widget
- CVE-2026-1792Geo Widet <= 1.0 - Reflected Cross-Site Scriptingowencutajar Geo Widget
- CVE-2026-0745User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameterwebilop User Language Switch
- CVE-2026-2022Smart Forms <= 2.6.99 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposureedgarrojas Smart Forms – when you need more than just a con…
- CVE-2026-1901QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesQuestionPro Surveys
- CVE-2025-14873LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request ForgeryLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-0727Accordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modificationessentialplugin Accordion and Accordion Slider
- CVE-2026-0751Payment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameterbrandonfire Payment Page | Payment Form for Stripe
- CVE-2025-6792One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interceptionamentotechpvtltd One to one user Chat by WPGuppy
- CVE-2026-1796StyleBidet <= 1.0.0 - Reflected Cross-Site Scriptingindextwo StyleBidet
- CVE-2026-1932Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modificationbssoftware Appointment Booking Calendar Plugin – Bookr
- CVE-2026-1912Citations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attributeulaulaman Citations tools
- CVE-2026-1983SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletionsourcez SEATT: Simple Event Attendance
- CVE-2026-1164Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'phoenixstudiodz Easy Voice Mail
- CVE-2026-1904Simple Wp colorfull Accordion <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attributenayon46 Simple Wp colorfull Accordion
- CVE-2026-1754personal-authors-category <= 0.3 - Reflected Cross-Site Scriptingalexeyknyazev personal-authors-category
- CVE-2026-2027AMP Enhancer <= 1.0.49 - Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Settingampenhancer AMP Enhancer – Compatibility Layer for Official…
- CVE-2025-14608WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modificationinfosatech WP Last Modified Info
- CVE-2025-14067Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposurehassantafreshi Easy Form Builder by WhiteStudio — Drag & Dr…
- CVE-2025-13973StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosurekasuga16 StickEasy Protected Contact Form
- CVE-2025-13681BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameterthebaldfatguy BFG Tools – Extension Zipper