CVEs published February 17, 2026
98 CVEs were published on February 17, 2026: 7 critical, 32 high. 1 is now in CISA KEV.
- Published
- 98
- Critical
- 7
- High
- 32
- Medium
- 56
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 52
Most affected products
- IBM Concert
- 7
- IBM DB2 Recovery Expert for LUW
- 6
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…
- 4
- IBM Db2 for Linux, UNIX and Windows
- 4
- Beetel 777VR1
- 3
- IBM DB2 Merge Backup for Linux, UNIX and Windows
- 3
- IBM Security QRadar EDR
- 3
- Blossom
- 2
- Dell Avamar Server · Dell Avamar Virtual Edition +1
- 2
- Glory Global Solutions RBG-100
- 2
Critical 7
- CVE-2026-1670Honeywell CCTV Products Missing Authentication for Critical FunctionHoneywell I-HIB2PI-UL 2MP IP · Honeywell SMB NDAA MVO-3 +2
- CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.Dell RecoverPoint for Virtual Machines
- CVE-2026-23647Glory RBG-100 Recycler System Hard-coded OS CredentialsGlory Global Solutions RBG-100
- CVE-2026-22208OpenS100 Portrayal Engine Unrestricted Lua Standard Library AccessOpenS100 Project OpenS100
- CVE-2026-26220LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCEModelTC LightLLM
- CVE-2025-59793Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able
- CVE-2025-70830A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers
High 32
- CVE-2026-23599Local Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for LinuxHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2026-22048StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use MicroNETAPP StorageGRID
- CVE-2026-26119Windows Admin Center Elevation of Privilege VulnerabilityMicrosoft Windows Admin Center
- CVE-2025-13689DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environmentIBM DataStage on Cloud Pak
- CVE-2025-33088Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2026-2627Softland FBackup Backup/Restore HID.dll link followingSoftland FBackup
- CVE-2026-23595Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creationHewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…
- CVE-2025-13691DataStage on Cloud Pak for Data is vulnerable to sensitive information leaks due to HTTP processingIBM DataStage on Cloud Pak for Data
- CVE-2026-24734Apache Tomcat Native, Apache Tomcat: OCSP revocation bypassApache Software Foundation Apache Tomcat Native · Apache… +2
- CVE-2025-66614Apache Tomcat: Client certificate verification bypass due to virtual host mappingApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-2630[R1] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2Tenable Security Center
- CVE-2025-36247IBM Db2 XML External Entity ReferenceIBM Db2 for Linux, UNIX and Windows
- CVE-2026-23648Glory RBG-100 Recycler System Local Privilege Escalation via Insecure File PermissionsGlory Global Solutions RBG-100
- CVE-2026-2616Beetel 777VR1 Web Management hard-coded credentialsBeetel 777VR1
- CVE-2026-25087Apache Arrow: Potential use-after-free when reading IPC file with pre-bufferingApache Software Foundation Apache Arrow · pyarrow
- CVE-2026-2615Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injectionWavlink WL-NU516U1
- CVE-2025-7631Time-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News SoftwareTumeva Internet Technologies Software Information Advertisi…
- CVE-2026-2247SQL Injection in Clickedu's SaaS platformClickedu SaaS platform
- CVE-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component UpdatesApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2026-1216RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameterrebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…
- CVE-2026-2592Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status UpdateZarinpal Gateway
- CVE-2024-55270phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter.
- CVE-2025-32355Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections.
- CVE-2025-65753An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.
- CVE-2025-67102A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL co
- CVE-2025-67905Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location
- CVE-2025-70397jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.
- CVE-2025-70828An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration
- CVE-2025-70846lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field password.
- CVE-2026-26731TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv
- CVE-2026-26732TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in
- CVE-2026-26736TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formI
Medium, low and unrated 59
- CVE-2026-1344Insecure file permissions in Enforce Recovery Key PortalTanium Enforce Recovery Key Portal
- CVE-2025-62183Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.Pegasystems Pega Infinity
- CVE-2025-13333IBM WebSphere Application Server could provide weaker than expected securityIBM WebSphere Application Server
- CVE-2026-2629jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injectionjishi node-sonos-http-api
- CVE-2023-38005Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System[, ]IBM Cloud Pak System
- CVE-2025-33135IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilitiesIBM Financial Transaction Manager for ACH Services and Chec…
- CVE-2025-36183Privileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.dataIBM watsonx.data
- CVE-2025-36348The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information DisclosureIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-2623Blossom File Upload BLOSManager.java put path traversalBlossom
- CVE-2026-23598Unauthenticated Information Disclosure in application API allows sensitive system information exposureHewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…
- CVE-2026-23597Unauthenticated Information Disclosure in application API allows sensitive system information exposureHewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…
- CVE-2026-23596Unauthenticated Improper Access Control in management API allows unauthorized service disruptionHewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…
- CVE-2025-36376IBM Security QRadar EDR Software has multiple vulnerabilitiesIBM Security QRadar EDR
- CVE-2026-2622Blossom Article Title ArticleController.java content cross site scriptingBlossom
- CVE-2025-36377IBM Security QRadar EDR Software has multiple vulnerabilitiesIBM Security QRadar EDR
- CVE-2025-36379IBM Security QRadar EDR Software has multiple vulnerabilitiesIBM Security QRadar EDR
- CVE-2025-14289IBM webMethods Integration Server is vulnerable to HTML injectionIBM webMethods Integration Server
- CVE-2026-2621Sciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injectionSciyon Koyuan Thermoelectricity Heat Network Management Sys…
- CVE-2026-22762Dell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912, contain an Improper Limitation of a Pathname to aDell Avamar Server · Dell Avamar Virtual Edition +1
- CVE-2025-27898Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM DB2 Recovery Expert for LUW
- CVE-2025-27899Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM DB2 Recovery Expert for LUW
- CVE-2025-27900Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM DB2 Recovery Expert for LUW
- CVE-2026-22284Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('ComDell SmartFabric OS10 Software
- CVE-2026-26357Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site ScriDell Unisphere for PowerMax
- CVE-2025-27901Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM DB2 Recovery Expert for LUW
- CVE-2025-27903Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM DB2 Recovery Expert for LUW
- CVE-2025-27904Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM DB2 Recovery Expert for LUW
- CVE-2025-36598Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path TraveDell Avamar Virtual Edition · Dell PowerProtect DP Series A…
- CVE-2025-33130Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsIBM DB2 Merge Backup for Linux, UNIX and Windows
- CVE-2026-0102Microsoft Edge (Chromium-based) Defense in Depth VulnerabilityMicrosoft Edge
- CVE-2025-33124Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsIBM DB2 Merge Backup for Linux, UNIX and Windows
- CVE-2025-13108Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsIBM DB2 Merge Backup for Linux, UNIX and Windows
- CVE-2023-38265Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System[, ]IBM Cloud Pak System
- CVE-2025-36597Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path TraveDell Avamar Server · Dell Avamar Virtual Edition +1
- CVE-2025-33101Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2026-2620Huace Monitoring and Early Warning System ProjectRole.aspx sql injectionHuace Monitoring and Early Warning System
- CVE-2025-33089Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2025-36243Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2024-43178Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2025-36018Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2025-36019Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2026-24733Apache Tomcat: Security constraint bypass with HTTP/0.9Apache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2025-12755Multiple vulnerabilities in IBM MQ Operator and Queue manager container imagesIBM MQ Operator · IBM supplied MQ Advanced container images
- CVE-2025-36425IBM Db2 Information DisclosureIBM Db2 for Linux, UNIX and Windows
- CVE-2025-13867IBM Db2 Denial of ServiceIBM Db2 for Linux, UNIX and Windows
- CVE-2025-14689IBM Db2 Denial of ServiceIBM Db2 for Linux, UNIX and Windows
- CVE-2026-2618Beetel 777VR1 SSH Service risky encryptionBeetel 777VR1
- CVE-2026-2617Beetel 777VR1 Telnet Service/SSH Service insecure default initialization of resourceBeetel 777VR1
- CVE-2024-31118WordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerabilitySmartypants SP Project & Document Manager
- CVE-2022-41650WordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerabilityPaul Custom Content by Country
- CVE-2026-23861Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-siteDell Unisphere for PowerMax vApp,
- CVE-2025-7706Improper Access Control in TUBITAK BILGEM's LiderahenkTUBITAK BILGEM Software Technologies Research Institute Lid…
- CVE-2025-8303XSS in EKA Software's Real Estate Script V5 (With Doping Module – Store Module – New Language System)EKA Software Computer Information Advertising Services Real…
- CVE-2026-2608Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorizationstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-0829Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email SendingFrontend File Manager Plugin
- CVE-2026-1657EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpointmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2026-2002Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scriptingwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-55271A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0.
- CVE-2025-70829An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC con