CVEs published February 16, 2026
88 CVEs were published on February 16, 2026: 5 critical, 20 high.
- Published
- 88
- Critical
- 5
- High
- 20
- Medium
- 61
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Smoothwall Express
- 17
- Wavlink WL-WN579A3
- 5
- Dassault Systèmes SOLIDWORKS eDrawings
- 3
- JingDong JD Cloud Box AX6600
- 3
- Kubysoft
- 3
- LigeroSmart
- 3
- Mattermost · github.com/mattermost/mattermost-server +3
- 3
- Wavlink WL-NU516U1
- 3
- Comfast CF-N1
- 2
- cskefu
- 2
Critical 5
- CVE-2026-2439Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session idsBVA Concierge::Sessions
- CVE-2025-15578Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurelyTEEJAY Maypole
- CVE-2026-2564Intelbras VIP 3260 Z IA OutsideCmd password recoveryIntelbras VIP 3260 Z IA
- CVE-2026-2550EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted uploadEFM iptime A6004MX
- CVE-2026-2577Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket BridgeHKUDS nanobot
High 20
- CVE-2025-12062WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusionflippercode WP Maps – Store Locator,Google Maps,OpenStreetM…
- CVE-2026-2474Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()DDICK Crypt::URandom
- CVE-2026-2001WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationwpxpo WowRevenue – Product Bundles & Bulk Discounts
- CVE-2026-2567Wavlink WL-NU516U1 nas.cgi sub_401218 stack-based overflowWavlink WL-NU516U1
- CVE-2026-2566Wavlink WL-NU516U1 adm.cgi sub_406194 stack-based overflowWavlink WL-NU516U1
- CVE-2026-2565Wavlink WL-NU516U1 adm.cgi sub_40785C stack-based overflowWavlink WL-NU516U1
- CVE-2026-26930SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.SmarterTools SmarterMail
- CVE-2026-2101Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19Dassault Systèmes ENOVIAvpm Web Access
- CVE-2026-2447Heap buffer overflow in libvpxMozilla Firefox · Mozilla Thunderbird
- CVE-2026-1335Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2026-1334Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2026-1333Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2026-1046Arbitrary application execution via unvalidated server-controlled URLs in Help menuMattermost
- CVE-2026-2452Unsafe variable evaluation in email templatespretix-newsletter
- CVE-2026-2451Unsafe variable evaluation in email templatespretix-doistep
- CVE-2026-2415Unsafe variable evaluation in email templatespretix
- CVE-2026-2542Total VPN win-service.exe unquoted search pathTotal VPN
- CVE-2026-2538Flos Freeware Notepad2 Msimg32.dll uncontrolled search pathFlos Freeware Notepad2
- CVE-2025-65715An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary c
- CVE-2025-65716An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a craft
Medium, low and unrated 63
- CVE-2019-25395Smoothwall Express 3.1 'preferences.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25394Smoothwall Express 3.1 'modem.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25393Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25392Smoothwall Express 3.1 'iptools.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25390Smoothwall Express 3.1 'interfaces.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25389Smoothwall Express 3.1 'timedaccess.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25388Smoothwall Express 3.1 'ipblock.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25387Smoothwall Express 3.1 'xtaccess.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25386Smoothwall Express 3.1 'dmzholes.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25385Smoothwall Express 3.1 'outgoing.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25384Smoothwall Express 3.1 'portfw.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25383Smoothwall Express 3.1 'apcupsd.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25382Smoothwall Express 3.1 'time.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25381Smoothwall Express 3.1 'hosts.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25380Smoothwall Express 3.1 'dhcp.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25379Smoothwall Express 3.1 'urlfilter.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2019-25378Smoothwall Express 3.1 'proxy.cgi' Cross-Site ScriptingSmoothwall Express
- CVE-2026-2563JingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges managementJingDong JD Cloud Box AX6600
- CVE-2026-2562JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi cast_streen privileges managementJingDong JD Cloud Box AX6600
- CVE-2026-2561JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges managementJingDong JD Cloud Box AX6600
- CVE-2026-2032Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOSMozilla Firefox for iOS
- CVE-2026-2560kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injectionkalcaddle kodbox
- CVE-2026-2558GeekAI net_handler.go Download server-side request forgeryGeekAI
- CVE-2026-2557cskefu File Upload MediaController.java upload cross site scriptingcskefu
- CVE-2026-2556cskefu Endpoint MediaController.java server-side request forgerycskefu
- CVE-2025-14573Team Admin Bypass of Invite Permissions via allow_open_invite FieldMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-14350Information disclosure via channel mentions in postsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-2555JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserializationJeecgBoot
- CVE-2025-13821User profile update exposes password hash and MFA secretsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-2418Open Redirect in TR7's Web Application FirewallTR7 Cyber Defense Web Application Firewall
- CVE-2026-2553tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injectiontushar-2223 Hotel-Management-System
- CVE-2026-2552ZenTao Editor control.php delete path traversalZenTao
- CVE-2026-2551ZenTao Backup control.php delete path traversalZenTao
- CVE-2026-0997Mattermost Zoom Plugin channel preference API lacks authorization checksMattermost · github.com/mattermost/mattermost-plugin-zoom
- CVE-2025-59904Stored Cross-Site Scripting vulnerability in KubysoftKubysoft
- CVE-2025-59903Stored Cross-Site Scripting (XSS) in KubysoftKubysoft
- CVE-2026-0998Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsMattermost · github.com/mattermost/mattermost-plugin-zoom
- CVE-2025-59905Reflected Cross-Site Scripting (XSS) in KubysoftKubysoft
- CVE-2026-0999Authentication bypass via userID login when email and username login are disabledMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-2549zhanghuanhao LibrarySystem 图书馆管理系统 BookController.java access controlzhanghuanhao LibrarySystem 图书馆管理系统
- CVE-2026-2548WAYOS FBM-220G rc sub_40F820 command injectionWAYOS FBM-220G
- CVE-2026-2547LigeroSmart index.pl AgentDashboard cross site scriptingLigeroSmart
- CVE-2026-2546LigeroSmart index.pl cross site scriptingLigeroSmart
- CVE-2026-2545LigeroSmart index.pl cross site scriptingLigeroSmart
- CVE-2026-2544yued-fe LuLu UI run.js child_process.exec os command injectionyued-fe LuLu UI
- CVE-2026-2543vichan-devel vichan Password Change pages.php unverified password changevichan-devel vichan
- CVE-2026-0929RegistrationMagic < 6.0.7.2 - Subscriber+ Form CreationRegistrationMagic
- CVE-2026-2537Comfast CF-E4 HTTP POST Request mbox-config command injectionComfast CF-E4
- CVE-2026-2536opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity referenceopencc JFlow
- CVE-2026-2535Comfast CF-N1 V2 mbox-config sub_44AB9C command injectionComfast CF-N1
- CVE-2026-2534Comfast CF-N1 V2 mbox-config sub_44AC4C command injectionComfast CF-N1
- CVE-2026-2533Tosei Self-service Washing Machine tosei_datasend.php command injectionTosei Self-service Washing Machine
- CVE-2026-2532lintsinghua DeepAudit IP Address embedding_config.py server-side request forgerylintsinghua DeepAudit
- CVE-2026-2531MindsDB File Upload security.py clear_filename server-side request forgeryMindsDB
- CVE-2026-2530Wavlink WL-WN579A3 wireless.cgi AddMac command injectionWavlink WL-WN579A3
- CVE-2026-2529Wavlink WL-WN579A3 wireless.cgi DeleteMac command injectionWavlink WL-WN579A3
- CVE-2026-2528Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injectionWavlink WL-WN579A3
- CVE-2026-2527Wavlink WL-WN579A3 login.cgi command injectionWavlink WL-WN579A3
- CVE-2026-2526Wavlink WL-WN579A3 wireless.cgi multi_ssid command injectionWavlink WL-WN579A3
- CVE-2026-2525Free5GC PFCP UDP Endpoint denial of serviceFree5GC
- CVE-2026-2524Open5GS MME mme_s11_handle_create_session_response denial of serviceOpen5GS
- CVE-2026-2523Open5GS SMF gn-handler.c smf_gn_handle_create_pdp_context_request assertionOpen5GS
- CVE-2025-65717An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML p