# CVEs published 2026-02-17

98 CVEs were published on February 17, 2026: 7 critical, 32 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-1344](https://cve.now/CVE-2026-1344.md): Insecure file permissions in Enforce Recovery Key Portal (CVSS 6.5, Tanium Enforce Recovery Key Portal)
- [CVE-2026-23599](https://cve.now/CVE-2026-23599.md): Local Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for Linux (CVSS 7.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…)
- [CVE-2026-22048](https://cve.now/CVE-2026-22048.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Micro (CVSS 7.1, NETAPP StorageGRID)
- [CVE-2026-26119](https://cve.now/CVE-2026-26119.md): Windows Admin Center Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Admin Center)
- [CVE-2026-1670](https://cve.now/CVE-2026-1670.md): Honeywell CCTV Products Missing Authentication for Critical Function (CVSS 9.3, Honeywell I-HIB2PI-UL 2MP IP · Honeywell SMB NDAA MVO-3 +2)
- [CVE-2025-62183](https://cve.now/CVE-2025-62183.md): Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low. (CVSS 4.8, Pegasystems Pega Infinity)
- [CVE-2025-13333](https://cve.now/CVE-2025-13333.md): IBM WebSphere Application Server could provide weaker than expected security (CVSS 4.4, IBM WebSphere Application Server)
- [CVE-2025-13689](https://cve.now/CVE-2025-13689.md): DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment (CVSS 8.8, IBM DataStage on Cloud Pak)
- [CVE-2026-2629](https://cve.now/CVE-2026-2629.md): jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection (CVSS 6.9, jishi node-sonos-http-api)
- [CVE-2023-38005](https://cve.now/CVE-2023-38005.md): Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System\[, \] (CVSS 4.3, IBM Cloud Pak System)
- [CVE-2025-33135](https://cve.now/CVE-2025-33135.md): IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities (CVSS 6.1, IBM Financial Transaction Manager for ACH Services and Chec…)
- [CVE-2025-33088](https://cve.now/CVE-2025-33088.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 7.4, IBM Concert)
- [CVE-2025-36183](https://cve.now/CVE-2025-36183.md): Privileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.data (CVSS 3.8, IBM watsonx.data)
- [CVE-2026-2627](https://cve.now/CVE-2026-2627.md): Softland FBackup Backup/Restore HID.dll link following (CVSS 8.5, Softland FBackup)
- [CVE-2025-36348](https://cve.now/CVE-2025-36348.md): The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information Disclosure (CVSS 4.9, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-2623](https://cve.now/CVE-2026-2623.md): Blossom File Upload BLOSManager.java put path traversal (CVSS 5.3, Blossom)
- [CVE-2026-23598](https://cve.now/CVE-2026-23598.md): Unauthenticated Information Disclosure in application API allows sensitive system information exposure (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…)
- [CVE-2026-23597](https://cve.now/CVE-2026-23597.md): Unauthenticated Information Disclosure in application API allows sensitive system information exposure (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…)
- [CVE-2026-23596](https://cve.now/CVE-2026-23596.md): Unauthenticated Improper Access Control in management API allows unauthorized service disruption (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…)
- [CVE-2026-23595](https://cve.now/CVE-2026-23595.md): Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation (CVSS 8.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Priva…)
- [CVE-2025-36376](https://cve.now/CVE-2025-36376.md): IBM Security QRadar EDR Software has multiple vulnerabilities (CVSS 6.3, IBM Security QRadar EDR)
- [CVE-2026-2622](https://cve.now/CVE-2026-2622.md): Blossom Article Title ArticleController.java content cross site scripting (CVSS 5.1, Blossom)
- [CVE-2025-36377](https://cve.now/CVE-2025-36377.md): IBM Security QRadar EDR Software has multiple vulnerabilities (CVSS 6.3, IBM Security QRadar EDR)
- [CVE-2025-36379](https://cve.now/CVE-2025-36379.md): IBM Security QRadar EDR Software has multiple vulnerabilities (CVSS 5.9, IBM Security QRadar EDR)
- [CVE-2025-13691](https://cve.now/CVE-2025-13691.md): DataStage on Cloud Pak for Data is vulnerable to sensitive information leaks due to HTTP processing (CVSS 8.1, IBM DataStage on Cloud Pak for Data)
- [CVE-2025-14289](https://cve.now/CVE-2025-14289.md): IBM webMethods Integration Server is vulnerable to HTML injection (CVSS 5.4, IBM webMethods Integration Server)
- [CVE-2026-2621](https://cve.now/CVE-2026-2621.md): Sciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injection (CVSS 6.9, Sciyon Koyuan Thermoelectricity Heat Network Management Sys…)
- [CVE-2026-22762](https://cve.now/CVE-2026-22762.md): Dell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912, contain an Improper Limitation of a Pathname to a (CVSS 6.5, Dell Avamar Server · Dell Avamar Virtual Edition +1)
- [CVE-2025-27898](https://cve.now/CVE-2025-27898.md): Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows (CVSS 6.3, IBM DB2 Recovery Expert for LUW)
- [CVE-2025-27899](https://cve.now/CVE-2025-27899.md): Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows (CVSS 5.3, IBM DB2 Recovery Expert for LUW)
- [CVE-2025-27900](https://cve.now/CVE-2025-27900.md): Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows (CVSS 6.8, IBM DB2 Recovery Expert for LUW)
- [CVE-2026-22284](https://cve.now/CVE-2026-22284.md): Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Com (CVSS 6.6, Dell SmartFabric OS10 Software)
- [CVE-2026-26357](https://cve.now/CVE-2026-26357.md): Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scri (CVSS 5.4, Dell Unisphere for PowerMax)
- [CVE-2025-27901](https://cve.now/CVE-2025-27901.md): Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows (CVSS 6.5, IBM DB2 Recovery Expert for LUW)
- [CVE-2025-27903](https://cve.now/CVE-2025-27903.md): Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows (CVSS 5.9, IBM DB2 Recovery Expert for LUW)
- [CVE-2025-27904](https://cve.now/CVE-2025-27904.md): Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows (CVSS 6.5, IBM DB2 Recovery Expert for LUW)
- [CVE-2025-36598](https://cve.now/CVE-2025-36598.md): Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Trave (CVSS 6.5, Dell Avamar Virtual Edition · Dell PowerProtect DP Series A…)
- [CVE-2026-22769](https://cve.now/CVE-2026-22769.md): Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. (CVSS 10.0, KEV, Dell RecoverPoint for Virtual Machines)
- [CVE-2025-33130](https://cve.now/CVE-2025-33130.md): Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows (CVSS 6.5, IBM DB2 Merge Backup for Linux, UNIX and Windows)
- [CVE-2026-0102](https://cve.now/CVE-2026-0102.md): Microsoft Edge (Chromium-based) Defense in Depth Vulnerability (CVSS 3.1, Microsoft Edge)
- [CVE-2025-33124](https://cve.now/CVE-2025-33124.md): Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows (CVSS 6.5, IBM DB2 Merge Backup for Linux, UNIX and Windows)
- [CVE-2025-13108](https://cve.now/CVE-2025-13108.md): Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows (CVSS 5.5, IBM DB2 Merge Backup for Linux, UNIX and Windows)
- [CVE-2023-38265](https://cve.now/CVE-2023-38265.md): Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System\[, \] (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2025-36597](https://cve.now/CVE-2025-36597.md): Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Trave (CVSS 4.7, Dell Avamar Server · Dell Avamar Virtual Edition +1)
- [CVE-2025-33101](https://cve.now/CVE-2025-33101.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 5.9, IBM Concert)
- [CVE-2026-2620](https://cve.now/CVE-2026-2620.md): Huace Monitoring and Early Warning System ProjectRole.aspx sql injection (CVSS 6.9, Huace Monitoring and Early Warning System)
- [CVE-2025-33089](https://cve.now/CVE-2025-33089.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 6.5, IBM Concert)
- [CVE-2025-36243](https://cve.now/CVE-2025-36243.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 5.4, IBM Concert)
- [CVE-2024-43178](https://cve.now/CVE-2024-43178.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 5.9, IBM Concert)
- [CVE-2025-36018](https://cve.now/CVE-2025-36018.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 6.5, IBM Concert)
- [CVE-2026-24734](https://cve.now/CVE-2026-24734.md): Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass (CVSS 7.4, Apache Software Foundation Apache Tomcat Native · Apache… +2)
- [CVE-2025-36019](https://cve.now/CVE-2025-36019.md): Multiple Vulnerabilities in IBM Concert Software. (CVSS 6.1, IBM Concert)
- [CVE-2026-24733](https://cve.now/CVE-2026-24733.md): Apache Tomcat: Security constraint bypass with HTTP/0.9 (CVSS 6.5, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2025-12755](https://cve.now/CVE-2025-12755.md): Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (CVSS 4.0, IBM MQ Operator · IBM supplied MQ Advanced container images)
- [CVE-2025-66614](https://cve.now/CVE-2025-66614.md): Apache Tomcat: Client certificate verification bypass due to virtual host mapping (CVSS 7.6, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-2630](https://cve.now/CVE-2026-2630.md): \[R1\] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2 (CVSS 8.8, Tenable Security Center)
- [CVE-2025-36247](https://cve.now/CVE-2025-36247.md): IBM Db2 XML External Entity Reference (CVSS 7.1, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-36425](https://cve.now/CVE-2025-36425.md): IBM Db2 Information Disclosure (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-13867](https://cve.now/CVE-2025-13867.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-14689](https://cve.now/CVE-2025-14689.md): IBM Db2 Denial of Service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2026-2618](https://cve.now/CVE-2026-2618.md): Beetel 777VR1 SSH Service risky encryption (CVSS 6.3, Beetel 777VR1)
- [CVE-2026-23648](https://cve.now/CVE-2026-23648.md): Glory RBG-100 Recycler System Local Privilege Escalation via Insecure File Permissions (CVSS 8.5, Glory Global Solutions RBG-100)
- [CVE-2026-23647](https://cve.now/CVE-2026-23647.md): Glory RBG-100 Recycler System Hard-coded OS Credentials (CVSS 9.3, Glory Global Solutions RBG-100)
- [CVE-2026-2617](https://cve.now/CVE-2026-2617.md): Beetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource (CVSS 5.3, Beetel 777VR1)
- [CVE-2024-31118](https://cve.now/CVE-2024-31118.md): WordPress SP Project & Document Manager plugin \<= 4.70 - Broken Access Control to XSS vulnerability (CVSS 6.5, Smartypants SP Project & Document Manager)
- [CVE-2026-2616](https://cve.now/CVE-2026-2616.md): Beetel 777VR1 Web Management hard-coded credentials (CVSS 8.7, Beetel 777VR1)
- [CVE-2022-41650](https://cve.now/CVE-2022-41650.md): WordPress Custom Content by Country plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 6.5, Paul Custom Content by Country)
- [CVE-2026-22208](https://cve.now/CVE-2026-22208.md): OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access (CVSS 9.4, OpenS100 Project OpenS100)
- [CVE-2026-23861](https://cve.now/CVE-2026-23861.md): Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site (CVSS 5.4, Dell Unisphere for PowerMax vApp,)
- [CVE-2025-7706](https://cve.now/CVE-2025-7706.md): Improper Access Control in TUBITAK BILGEM's Liderahenk (CVSS 6.1, TUBITAK BILGEM Software Technologies Research Institute Lid…)
- [CVE-2026-25087](https://cve.now/CVE-2026-25087.md): Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering (CVSS 7.0, Apache Software Foundation Apache Arrow · pyarrow)
- [CVE-2026-2615](https://cve.now/CVE-2026-2615.md): Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection (CVSS 8.6, Wavlink WL-NU516U1)
- [CVE-2025-8303](https://cve.now/CVE-2025-8303.md): XSS in EKA Software's Real Estate Script V5 (With Doping Module – Store Module – New Language System) (CVSS 6.5, EKA Software Computer Information Advertising Services Real…)
- [CVE-2025-7631](https://cve.now/CVE-2025-7631.md): Time-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News Software (CVSS 8.6, Tumeva Internet Technologies Software Information Advertisi…)
- [CVE-2026-2247](https://cve.now/CVE-2026-2247.md): SQL Injection in Clickedu's SaaS platform (CVSS 8.3, Clickedu SaaS platform)
- [CVE-2026-2608](https://cve.now/CVE-2026-2608.md): Gutenberg Blocks by Kadence Blocks \<= 3.5.32 - Missing Authorization (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-25903](https://cve.now/CVE-2026-25903.md): Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates (CVSS 8.7, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2026-1216](https://cve.now/CVE-2026-1216.md): RSS Aggregator \<= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter (CVSS 7.2, rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…)
- [CVE-2026-0829](https://cve.now/CVE-2026-0829.md): Frontend File Manager Plugin \<= 23.5 - Unauthenticated Arbitrary Email Sending (CVSS 5.8, Frontend File Manager Plugin)
- [CVE-2026-1657](https://cve.now/CVE-2026-1657.md): EventPrime \<= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep\_upload\_file\_media' AJAX Endpoint (CVSS 5.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2026-2592](https://cve.now/CVE-2026-2592.md): Zarinpal Gateway for WooCommerce \<= 5.0.16 - Improper Access Control to Payment Status Update (CVSS 7.7, Zarinpal Gateway)
- [CVE-2026-2002](https://cve.now/CVE-2026-2002.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-26220](https://cve.now/CVE-2026-26220.md): LightLLM \<= 1.1.0 PD Mode Unsafe Deserialization RCE (CVSS 9.3, ModelTC LightLLM)
- [CVE-2024-55270](https://cve.now/CVE-2024-55270.md): phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. (CVSS 8.8)
- [CVE-2024-55271](https://cve.now/CVE-2024-55271.md): A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. (CVSS 3.5)
- [CVE-2025-32355](https://cve.now/CVE-2025-32355.md): Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. (CVSS 7.9)
- [CVE-2025-59793](https://cve.now/CVE-2025-59793.md): Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able (CVSS 9.4)
- [CVE-2025-65753](https://cve.now/CVE-2025-65753.md): An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root. (CVSS 7.5)
- [CVE-2025-67102](https://cve.now/CVE-2025-67102.md): A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL co (CVSS 7.6)
- [CVE-2025-67905](https://cve.now/CVE-2025-67905.md): Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location (CVSS 8.7)
- [CVE-2025-70397](https://cve.now/CVE-2025-70397.md): jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. (CVSS 7.2)
- [CVE-2025-70828](https://cve.now/CVE-2025-70828.md): An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration (CVSS 8.8)
- [CVE-2025-70829](https://cve.now/CVE-2025-70829.md): An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC con (CVSS 5.7)
- [CVE-2025-70830](https://cve.now/CVE-2025-70830.md): A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers (CVSS 9.9)
- [CVE-2025-70846](https://cve.now/CVE-2025-70846.md): lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field password. (CVSS 7.1)
- [CVE-2026-26731](https://cve.now/CVE-2026-26731.md): TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer\`parameter in the formDnsv (CVSS 8.0)
- [CVE-2026-26732](https://cve.now/CVE-2026-26732.md): TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword\` parameters in (CVSS 8.8)
- [CVE-2026-26736](https://cve.now/CVE-2026-26736.md): TOTOLINK A3002RU\_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static\_ipv6 parameter in the formI (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.