# CVEs published 2026-02-16

88 CVEs were published on February 16, 2026: 5 critical, 20 high. Days are UTC.

- [CVE-2025-12062](https://cve.now/CVE-2025-12062.md): WP Maps \<= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion (CVSS 8.8, flippercode WP Maps – Store Locator,Google Maps,OpenStreetM…)
- [CVE-2026-2439](https://cve.now/CVE-2026-2439.md): Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids (CVSS 9.8, BVA Concierge::Sessions)
- [CVE-2025-15578](https://cve.now/CVE-2025-15578.md): Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely (CVSS 9.8, TEEJAY Maypole)
- [CVE-2026-2474](https://cve.now/CVE-2026-2474.md): Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt\_urandom\_getrandom() (CVSS 7.5, DDICK Crypt::URandom)
- [CVE-2026-2001](https://cve.now/CVE-2026-2001.md): WowRevenue \<= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8, wpxpo WowRevenue – Product Bundles & Bulk Discounts)
- [CVE-2026-2567](https://cve.now/CVE-2026-2567.md): Wavlink WL-NU516U1 nas.cgi sub\_401218 stack-based overflow (CVSS 8.6, Wavlink WL-NU516U1)
- [CVE-2019-25395](https://cve.now/CVE-2019-25395.md): Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting (CVSS 5.3, Smoothwall Express)
- [CVE-2019-25394](https://cve.now/CVE-2019-25394.md): Smoothwall Express 3.1 'modem.cgi' Cross-Site Scripting (CVSS 5.3, Smoothwall Express)
- [CVE-2019-25393](https://cve.now/CVE-2019-25393.md): Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25392](https://cve.now/CVE-2019-25392.md): Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25390](https://cve.now/CVE-2019-25390.md): Smoothwall Express 3.1 'interfaces.cgi' Cross-Site Scripting (CVSS 4.8, Smoothwall Express)
- [CVE-2019-25389](https://cve.now/CVE-2019-25389.md): Smoothwall Express 3.1 'timedaccess.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25388](https://cve.now/CVE-2019-25388.md): Smoothwall Express 3.1 'ipblock.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25387](https://cve.now/CVE-2019-25387.md): Smoothwall Express 3.1 'xtaccess.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25386](https://cve.now/CVE-2019-25386.md): Smoothwall Express 3.1 'dmzholes.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25385](https://cve.now/CVE-2019-25385.md): Smoothwall Express 3.1 'outgoing.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25384](https://cve.now/CVE-2019-25384.md): Smoothwall Express 3.1 'portfw.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25383](https://cve.now/CVE-2019-25383.md): Smoothwall Express 3.1 'apcupsd.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25382](https://cve.now/CVE-2019-25382.md): Smoothwall Express 3.1 'time.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25381](https://cve.now/CVE-2019-25381.md): Smoothwall Express 3.1 'hosts.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25380](https://cve.now/CVE-2019-25380.md): Smoothwall Express 3.1 'dhcp.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2019-25379](https://cve.now/CVE-2019-25379.md): Smoothwall Express 3.1 'urlfilter.cgi' Cross-Site Scripting (CVSS 5.3, Smoothwall Express)
- [CVE-2019-25378](https://cve.now/CVE-2019-25378.md): Smoothwall Express 3.1 'proxy.cgi' Cross-Site Scripting (CVSS 5.1, Smoothwall Express)
- [CVE-2026-2566](https://cve.now/CVE-2026-2566.md): Wavlink WL-NU516U1 adm.cgi sub\_406194 stack-based overflow (CVSS 8.6, Wavlink WL-NU516U1)
- [CVE-2026-2565](https://cve.now/CVE-2026-2565.md): Wavlink WL-NU516U1 adm.cgi sub\_40785C stack-based overflow (CVSS 7.5, Wavlink WL-NU516U1)
- [CVE-2026-26930](https://cve.now/CVE-2026-26930.md): SmarterTools SmarterMail before 9526 allows XSS via MAPI requests. (CVSS 7.2, SmarterTools SmarterMail)
- [CVE-2026-2101](https://cve.now/CVE-2026-2101.md): Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 (CVSS 8.7, Dassault Systèmes ENOVIAvpm Web Access)
- [CVE-2026-2564](https://cve.now/CVE-2026-2564.md): Intelbras VIP 3260 Z IA OutsideCmd password recovery (CVSS 9.2, Intelbras VIP 3260 Z IA)
- [CVE-2026-2563](https://cve.now/CVE-2026-2563.md): JingDong JD Cloud Box AX6600 jdcapp\_rpc controlDevice get\_status privileges management (CVSS 5.3, JingDong JD Cloud Box AX6600)
- [CVE-2026-2562](https://cve.now/CVE-2026-2562.md): JingDong JD Cloud Box AX6600 jdcweb\_rpc jdcapi cast\_streen privileges management (CVSS 5.3, JingDong JD Cloud Box AX6600)
- [CVE-2026-2561](https://cve.now/CVE-2026-2561.md): JingDong JD Cloud Box AX6600 jdcweb\_rpc jdcapi web\_get\_ddns\_uptime privileges management (CVSS 5.3, JingDong JD Cloud Box AX6600)
- [CVE-2026-2032](https://cve.now/CVE-2026-2032.md): Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2026-2447](https://cve.now/CVE-2026-2447.md): Heap buffer overflow in libvpx (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-2560](https://cve.now/CVE-2026-2560.md): kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection (CVSS 5.3, kalcaddle kodbox)
- [CVE-2026-1335](https://cve.now/CVE-2026-1335.md): Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2026-1334](https://cve.now/CVE-2026-1334.md): Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2026-1333](https://cve.now/CVE-2026-1333.md): Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2026-2558](https://cve.now/CVE-2026-2558.md): GeekAI net\_handler.go Download server-side request forgery (CVSS 5.3, GeekAI)
- [CVE-2026-2557](https://cve.now/CVE-2026-2557.md): cskefu File Upload MediaController.java upload cross site scripting (CVSS 5.1, cskefu)
- [CVE-2026-2556](https://cve.now/CVE-2026-2556.md): cskefu Endpoint MediaController.java server-side request forgery (CVSS 5.3, cskefu)
- [CVE-2025-14573](https://cve.now/CVE-2025-14573.md): Team Admin Bypass of Invite Permissions via allow\_open\_invite Field (CVSS 3.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-1046](https://cve.now/CVE-2026-1046.md): Arbitrary application execution via unvalidated server-controlled URLs in Help menu (CVSS 7.6, Mattermost)
- [CVE-2025-14350](https://cve.now/CVE-2025-14350.md): Information disclosure via channel mentions in posts (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-2555](https://cve.now/CVE-2026-2555.md): JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization (CVSS 2.3, JeecgBoot)
- [CVE-2025-13821](https://cve.now/CVE-2025-13821.md): User profile update exposes password hash and MFA secrets (CVSS 5.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-2418](https://cve.now/CVE-2025-2418.md): Open Redirect in TR7's Web Application Firewall (CVSS 4.3, TR7 Cyber ​​Defense Web Application Firewall)
- [CVE-2026-2553](https://cve.now/CVE-2026-2553.md): tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection (CVSS 5.3, tushar-2223 Hotel-Management-System)
- [CVE-2026-2552](https://cve.now/CVE-2026-2552.md): ZenTao Editor control.php delete path traversal (CVSS 5.1, ZenTao)
- [CVE-2026-2551](https://cve.now/CVE-2026-2551.md): ZenTao Backup control.php delete path traversal (CVSS 5.3, ZenTao)
- [CVE-2026-2452](https://cve.now/CVE-2026-2452.md): Unsafe variable evaluation in email templates (CVSS 7.5, pretix-newsletter)
- [CVE-2026-2451](https://cve.now/CVE-2026-2451.md): Unsafe variable evaluation in email templates (CVSS 7.5, pretix-doistep)
- [CVE-2026-2415](https://cve.now/CVE-2026-2415.md): Unsafe variable evaluation in email templates (CVSS 7.5, pretix)
- [CVE-2026-2550](https://cve.now/CVE-2026-2550.md): EFM iptime A6004MX timepro.cgi commit\_vpncli\_file\_upload unrestricted upload (CVSS 9.3, EFM iptime A6004MX)
- [CVE-2026-0997](https://cve.now/CVE-2026-0997.md): Mattermost Zoom Plugin channel preference API lacks authorization checks (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-plugin-zoom)
- [CVE-2025-59904](https://cve.now/CVE-2025-59904.md): Stored Cross-Site Scripting vulnerability in Kubysoft (CVSS 5.1, Kubysoft)
- [CVE-2025-59903](https://cve.now/CVE-2025-59903.md): Stored Cross-Site Scripting (XSS) in Kubysoft (CVSS 5.1, Kubysoft)
- [CVE-2026-0998](https://cve.now/CVE-2026-0998.md): Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-plugin-zoom)
- [CVE-2026-2577](https://cve.now/CVE-2026-2577.md): Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge (CVSS 10.0, HKUDS nanobot)
- [CVE-2025-59905](https://cve.now/CVE-2025-59905.md): Reflected Cross-Site Scripting (XSS) in Kubysoft (CVSS 4.8, Kubysoft)
- [CVE-2026-0999](https://cve.now/CVE-2026-0999.md): Authentication bypass via userID login when email and username login are disabled (CVSS 5.4, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-2549](https://cve.now/CVE-2026-2549.md): zhanghuanhao LibrarySystem 图书馆管理系统 BookController.java access control (CVSS 6.9, zhanghuanhao LibrarySystem 图书馆管理系统)
- [CVE-2026-2548](https://cve.now/CVE-2026-2548.md): WAYOS FBM-220G rc sub\_40F820 command injection (CVSS 5.3, WAYOS FBM-220G)
- [CVE-2026-2547](https://cve.now/CVE-2026-2547.md): LigeroSmart index.pl AgentDashboard cross site scripting (CVSS 5.1, LigeroSmart)
- [CVE-2026-2546](https://cve.now/CVE-2026-2546.md): LigeroSmart index.pl cross site scripting (CVSS 5.1, LigeroSmart)
- [CVE-2026-2545](https://cve.now/CVE-2026-2545.md): LigeroSmart index.pl cross site scripting (CVSS 5.1, LigeroSmart)
- [CVE-2026-2544](https://cve.now/CVE-2026-2544.md): yued-fe LuLu UI run.js child\_process.exec os command injection (CVSS 6.9, yued-fe LuLu UI)
- [CVE-2026-2543](https://cve.now/CVE-2026-2543.md): vichan-devel vichan Password Change pages.php unverified password change (CVSS 5.1, vichan-devel vichan)
- [CVE-2026-2542](https://cve.now/CVE-2026-2542.md): Total VPN win-service.exe unquoted search path (CVSS 7.3, Total VPN)
- [CVE-2026-2538](https://cve.now/CVE-2026-2538.md): Flos Freeware Notepad2 Msimg32.dll uncontrolled search path (CVSS 7.3, Flos Freeware Notepad2)
- [CVE-2026-0929](https://cve.now/CVE-2026-0929.md): RegistrationMagic \< 6.0.7.2 - Subscriber+ Form Creation (CVSS 4.3, RegistrationMagic)
- [CVE-2026-2537](https://cve.now/CVE-2026-2537.md): Comfast CF-E4 HTTP POST Request mbox-config command injection (CVSS 5.1, Comfast CF-E4)
- [CVE-2026-2536](https://cve.now/CVE-2026-2536.md): opencc JFlow Workflow WF\_Admin\_AttrFlow.java Imp\_Done xml external entity reference (CVSS 5.3, opencc JFlow)
- [CVE-2026-2535](https://cve.now/CVE-2026-2535.md): Comfast CF-N1 V2 mbox-config sub\_44AB9C command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2026-2534](https://cve.now/CVE-2026-2534.md): Comfast CF-N1 V2 mbox-config sub\_44AC4C command injection (CVSS 5.3, Comfast CF-N1)
- [CVE-2026-2533](https://cve.now/CVE-2026-2533.md): Tosei Self-service Washing Machine tosei\_datasend.php command injection (CVSS 6.9, Tosei Self-service Washing Machine)
- [CVE-2026-2532](https://cve.now/CVE-2026-2532.md): lintsinghua DeepAudit IP Address embedding\_config.py server-side request forgery (CVSS 5.3, lintsinghua DeepAudit)
- [CVE-2026-2531](https://cve.now/CVE-2026-2531.md): MindsDB File Upload security.py clear\_filename server-side request forgery (CVSS 5.3, MindsDB)
- [CVE-2026-2530](https://cve.now/CVE-2026-2530.md): Wavlink WL-WN579A3 wireless.cgi AddMac command injection (CVSS 5.3, Wavlink WL-WN579A3)
- [CVE-2026-2529](https://cve.now/CVE-2026-2529.md): Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection (CVSS 5.3, Wavlink WL-WN579A3)
- [CVE-2026-2528](https://cve.now/CVE-2026-2528.md): Wavlink WL-WN579A3 wireless.cgi Delete\_Mac\_list command injection (CVSS 5.3, Wavlink WL-WN579A3)
- [CVE-2026-2527](https://cve.now/CVE-2026-2527.md): Wavlink WL-WN579A3 login.cgi command injection (CVSS 5.3, Wavlink WL-WN579A3)
- [CVE-2026-2526](https://cve.now/CVE-2026-2526.md): Wavlink WL-WN579A3 wireless.cgi multi\_ssid command injection (CVSS 5.3, Wavlink WL-WN579A3)
- [CVE-2026-2525](https://cve.now/CVE-2026-2525.md): Free5GC PFCP UDP Endpoint denial of service (CVSS 6.9, Free5GC)
- [CVE-2026-2524](https://cve.now/CVE-2026-2524.md): Open5GS MME mme\_s11\_handle\_create\_session\_response denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-2523](https://cve.now/CVE-2026-2523.md): Open5GS SMF gn-handler.c smf\_gn\_handle\_create\_pdp\_context\_request assertion (CVSS 6.9, Open5GS)
- [CVE-2025-65715](https://cve.now/CVE-2025-65715.md): An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary c (CVSS 7.8)
- [CVE-2025-65716](https://cve.now/CVE-2025-65716.md): An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a craft (CVSS 8.8)
- [CVE-2025-65717](https://cve.now/CVE-2025-65717.md): An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML p (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.