# CVEs published 2026-02-15

31 CVEs were published on February 15, 2026: 3 critical, 9 high. Days are UTC.

- [CVE-2026-2522](https://cve.now/CVE-2026-2522.md): Open5GS MME esm-build.c memory corruption (CVSS 6.9, Open5GS)
- [CVE-2026-2521](https://cve.now/CVE-2026-2521.md): Open5GS SGW-C sgwc\_s5c\_handle\_create\_session\_response memory corruption (CVSS 6.9, Open5GS)
- [CVE-2026-26369](https://cve.now/CVE-2026-26369.md): JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup (CVSS 8.7, JUNG eNet SMART HOME server)
- [CVE-2026-26368](https://cve.now/CVE-2026-26368.md): JUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPassword (CVSS 8.7, JUNG eNet SMART HOME server)
- [CVE-2026-26367](https://cve.now/CVE-2026-26367.md): JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount (CVSS 7.1, JUNG eNet SMART HOME server)
- [CVE-2026-26366](https://cve.now/CVE-2026-26366.md): JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials (CVSS 9.3, JUNG eNet SMART HOME server)
- [CVE-2019-25377](https://cve.now/CVE-2019-25377.md): OPNsense 19.1 Reflected XSS via system\_advanced\_sysctl.php (CVSS 4.8, OPNsense)
- [CVE-2019-25376](https://cve.now/CVE-2019-25376.md): OPNsense 19.1 Reflected XSS via proxy endpoint (CVSS 5.1, OPNsense)
- [CVE-2019-25375](https://cve.now/CVE-2019-25375.md): OPNsense 19.1 Reflected XSS via monit interface (CVSS 5.1, OPNsense)
- [CVE-2019-25374](https://cve.now/CVE-2019-25374.md): OPNsense 19.1 Reflected XSS via vpn\_ipsec\_settings.php (CVSS 5.1, OPNsense)
- [CVE-2019-25373](https://cve.now/CVE-2019-25373.md): OPNsense 19.1 Stored XSS via firewall\_rules\_edit.php (CVSS 5.1, OPNsense)
- [CVE-2019-25372](https://cve.now/CVE-2019-25372.md): OPNsense 19.1 Reflected XSS via diag\_traceroute.php (CVSS 5.1, OPNsense)
- [CVE-2019-25371](https://cve.now/CVE-2019-25371.md): OPNsense 19.1 Reflected XSS via diag\_ping.php (CVSS 5.1, OPNsense)
- [CVE-2019-25370](https://cve.now/CVE-2019-25370.md): OPNsense 19.1 Reflected XSS via interfaces\_vlan\_edit.php (CVSS 5.1, OPNsense)
- [CVE-2019-25369](https://cve.now/CVE-2019-25369.md): OPNsense 19.1 Stored XSS via system\_advanced\_sysctl.php (CVSS 5.1, OPNsense)
- [CVE-2019-25368](https://cve.now/CVE-2019-25368.md): OPNsense 19.1 Reflected XSS via diag\_backup.php (CVSS 4.8, OPNsense)
- [CVE-2019-25367](https://cve.now/CVE-2019-25367.md): ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface (CVSS 4.8, ArangoDB Community Edition)
- [CVE-2026-2517](https://cve.now/CVE-2026-2517.md): Open5GS SMF types.c ogs\_gtp2\_parse\_tft denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-2516](https://cve.now/CVE-2026-2516.md): Unidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search path (CVSS 7.3, Unidocs ezPDF DRM Reader · Unidocs ezPDF Reader)
- [CVE-2026-2541](https://cve.now/CVE-2026-2541.md): Micca KE700 Brute-force vulnerability due to low entropy (CVSS 6.4, Micca Auto Electronics Co. Car Alarm System KE700)
- [CVE-2026-2540](https://cve.now/CVE-2026-2540.md): Micca KE700 Acceptance of previously used rolling codes (CVSS 8.4, Micca Auto Electronics Co. Car Alarm System KE700)
- [CVE-2026-2539](https://cve.now/CVE-2026-2539.md): Micca KE700 Cleartext transmission of key fob ID (CVSS 5.7, Micca Auto Electronics Co. Car Alarm System KE700)
- [CVE-2025-32063](https://cve.now/CVE-2025-32063.md): Enabling SSH server on Infotainment ECU (CVSS 6.8, Bosch Infotainment system ECU)
- [CVE-2025-32062](https://cve.now/CVE-2025-32062.md): Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU (CVSS 8.8, Bosch Infotainment system ECU)
- [CVE-2025-32061](https://cve.now/CVE-2025-32061.md): Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU (CVSS 8.8, Bosch Infotainment system ECU)
- [CVE-2025-32060](https://cve.now/CVE-2025-32060.md): Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU (CVSS 6.7, Bosch Infotainment system ECU)
- [CVE-2025-32059](https://cve.now/CVE-2025-32059.md): Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU (CVSS 8.8, Bosch Infotainment system ECU)
- [CVE-2025-32058](https://cve.now/CVE-2025-32058.md): Stack Overflow in processing requests over INC interface on RH850 side of Infotainment ECU (CVSS 9.3, Bosch Infotainment system ECU)
- [CVE-2026-1793](https://cve.now/CVE-2026-1793.md): Element Pack Addons for Elementor \<= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2026-1750](https://cve.now/CVE-2026-1750.md): Ecwid by Lightspeed Ecommerce Shopping Cart \<= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec\_store\_admin\_access (CVSS 8.8, Ecwid by Lightspeed Ecommerce Shopping Cart)
- [CVE-2026-1490](https://cve.now/CVE-2026-1490.md): Spam protection, Honeypot, Anti-Spam by CleanTalk \<= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation (CVSS 9.8, Spam protection, Honeypot, Anti-Spam by CleanTalk)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.