CVEs published February 18, 2026
238 CVEs were published on February 18, 2026: 18 critical, 70 high.
- Published
- 238
- Critical
- 18
- High
- 70
- Medium
- 118
- Low
- 9
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 69
Most affected products
- Linux
- 31
- InvoicePlane
- 11
- NVIDIA NeMo Framework
- 8
- sergejey MajorDoMo
- 8
- Graylog Web Interface
- 7
- IPFire
- 5
- Tsinghua Unigroup Electronic Archives System
- 4
- yaycommerce YayMail – WooCommerce Email Customizer
- 4
- Bosch Rexroth IndraWorks
- 3
- GitHub Enterprise Server
- 3
Critical 18
- CVE-2026-25548InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log PoisoningInvoicePlane
- CVE-2019-25364Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer OverflowTABS Laboratories Win10 MailCarrier
- CVE-2019-25362WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlowAlloksoft WMV to AVI MPEG DVD WMV Convertor
- CVE-2026-27180MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoningsergejey MajorDoMo
- CVE-2026-27175MajorDoMo Command Injection in rc/index.php via Race Conditionsergejey MajorDoMo
- CVE-2026-27174MajorDoMo Unauthenticated Remote Code Execution via Admin Console Evalsergejey MajorDoMo
- CVE-2026-23491InvoicePlane has Unauthenticated Path Traversal in Guest ControllerInvoicePlane
- CVE-2025-14009Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Executionnltk/nltk · nltk
- CVE-2025-15579An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.OpenText™ Directory Services
- CVE-2026-2329Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowGrandstream GXP1610 · Grandstream GXP1615 +4
- CVE-2026-1435Incorrect management of session invalidation vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2025-65791ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.
- CVE-2025-70141SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php.
- CVE-2025-70146Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remot
- CVE-2025-70149CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.
- CVE-2025-70150CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated
- CVE-2025-70152code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/sa
- CVE-2025-70998UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibl
High 70
- CVE-2026-25926Notepad++ has an Untrusted Search Pathnotepad-plus-plus
- CVE-2019-25401Bematech Printer MP-4200 TH Denial of ServiceBematech MP-4200
- CVE-2019-25365ChaosPro 2.0 - Buffer OverflowChaosPro
- CVE-2019-25363WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of ServiceAlloksoft WMV to AVI MPEG DVD WMV Convertor
- CVE-2019-25361Ayukov NFTP client 1.71 - 'SYST' Buffer OverflowAyukov NFTP client
- CVE-2019-25360Aida64 6.10.5200 - Buffer OverflowFinalWire Aida64
- CVE-2019-25359SD.NET RIM 4.7.3c - 'idtyp' SQL InjectionSitzungsdienst SD.NET RIM
- CVE-2019-25358FileOptimizer 14.00.2524 - Denial of Servicenikkhokkho FileOptimizer
- CVE-2019-25357Control Center PRO 6.2.9 - Local Stack Based BufferOverflowWEBGATE Control Center PRO
- CVE-2019-25355Genivia gSOAP 2.8 - 'gSOAP' Path TraversalGenivia gSOAP
- CVE-2019-25352Genivia Crystal Live HTTP Server 6.01 - 'Crystal Live HTTP Server' Path TraversalGenivia Crystal Live HTTP Server
- CVE-2019-25351Centova Cast 3.2.11 - Arbitrary File DownloadCentova Technologies Centova Cast
- CVE-2026-2650Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2026-2649Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2026-2648Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write vGoogle Chrome
- CVE-2026-27181MajorDoMo Unauthenticated Module Uninstall via Market Endpointsergejey MajorDoMo
- CVE-2026-27179MajorDoMo Unauthenticated SQL Injection in Commands Modulesergejey MajorDoMo
- CVE-2026-2670Advantech WISE-6610-NB Background Management openvpn_apply os command injectionAdvantech WISE-6610-NB · Advantech WISE-6610-EB +11
- CVE-2026-27182Saturn Remote Mouse Server UDP Command Injection RCEsaturnremote Saturn Remote Mouse Server
- CVE-2026-1999Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requestsGitHub Enterprise Server
- CVE-2026-0573Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code executionGitHub Enterprise Server
- CVE-2025-1272Kernel: secure boot does not automatically enable kernel lockdownFedora Project Fedora Linux · Red Hat Enterprise Linux +1
- CVE-2026-0875MODEL File Parsing Out-of-Bounds WriteAutodesk Shared Components
- CVE-2026-0874CATPART File Parsing Out-of-Bounds WriteAutodesk Shared Components
- CVE-2026-22860Rack has a Directory Traversal via Rack:Directoryrack
- CVE-2026-2507BIG-IP TMM VulnerabilityF5 BIG-IP
- CVE-2026-23230smb: client: split cached_fid bitfields to avoid shared-byte RMW racesLinux
- CVE-2026-23227drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/freeLinux
- CVE-2026-23226ksmbd: add chann_lock to protect ksmbd_chann_list xarrayLinux
- CVE-2026-23225sched/mmcid: Don't assume CID is CPU owned on mode switchLinux
- CVE-2026-23224erofs: fix UAF issue for file-backed mounts w/ directio optionLinux
- CVE-2026-23222crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctlyLinux
- CVE-2025-71236scsi: qla2xxx: Validate sp before freeing associated memoryLinux
- CVE-2025-71234wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_addLinux
- CVE-2025-61982An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506.OpenCFD OpenFOAM
- CVE-2026-1426Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibilityberocket Advanced AJAX Product Filters
- CVE-2026-27099Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-60038A vulnerability has been identified in Rexroth IndraWorks.Bosch Rexroth IndraWorks
- CVE-2025-60037A vulnerability has been identified in Rexroth IndraWorks.Bosch Rexroth IndraWorks
- CVE-2025-60036A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks.Bosch Rexroth IndraWorks · Bosch Rexroth UA.Testclient
- CVE-2025-60035A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks.Bosch Rexroth IndraWorks
- CVE-2025-33240NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection.NVIDIA Megatron-Bridge
- CVE-2025-33239NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection.NVIDIA Megatron-Bridge
- CVE-2025-33253NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciouslNVIDIA NeMo Framework · nemo-toolkit
- CVE-2025-33252NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution.NVIDIA NeMo Framework
- CVE-2025-33251NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution.NVIDIA NeMo Framework
- CVE-2025-33250NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution.NVIDIA NeMo Framework
- CVE-2025-33249NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attackNVIDIA NeMo Framework
- CVE-2025-33246NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection NVIDIA NeMo Framework
- CVE-2025-33245NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution.NVIDIA NeMo Framework · nemo-toolkit
- CVE-2025-33243NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments.NVIDIA NeMo Framework
- CVE-2025-33241NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciously crafted file.NVIDIA NeMo Framework
- CVE-2025-33236NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection.NVIDIA NeMo Framework
- CVE-2026-2464Directory Traversal in AMR Printer Management by AMRAMR Printer Management Beta web service
- CVE-2025-59920SQL injection in time@work from systems@worksystems at work time at work
- CVE-2025-14340Admin Account Takeover via malicious URL payloadPayara Platform Payara Server
- CVE-2026-1436Improper Access Control (IDOR) vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2026-2495WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameterqdonow WPNakama – Team and multi-Client Collaboration, Edit…
- CVE-2026-2296Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameteracowebs Product Addons for Woocommerce – Product Options wi…
- CVE-2026-1937YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Actionyaycommerce YayMail – WooCommerce Email Customizer
- CVE-2026-2019Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Settingvillatheme Cart All In One For WooCommerce
- CVE-2026-1368Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature GenerationVideo Conferencing with Zoom
- CVE-2026-2576Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameterstrategy11team Business Directory Plugin – Easy Listing Dir…
- CVE-2026-1714ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Actiondevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2026-1931Rent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameterjonschr Rent Fetch
- CVE-2025-70064PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability.
- CVE-2025-70147Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers
- CVE-2025-70148Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated a
- CVE-2025-70151code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload.
- CVE-2026-24708An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1.OpenStack Nova · nova
Medium, low and unrated 150
- CVE-2025-15585Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function.fileflows
- CVE-2026-2684Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted uploadTsinghua Unigroup Electronic Archives System
- CVE-2026-24126Weblate has an argument injection in management consoleWeblateOrg weblate · weblate
- CVE-2026-26281InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice ViewInvoicePlane
- CVE-2026-2683Tsinghua Unigroup Electronic Archives System downLoad.html path traversalTsinghua Unigroup Electronic Archives System
- CVE-2026-26270InvoicePlane has Stored Cross-Site Scripting Issue in Identifier FormattingInvoicePlane
- CVE-2025-15581Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.orthanc-server orthanc
- CVE-2026-25596InvoicePlane has Stored XSS via Product Unit Name in Invoice Item ListInvoicePlane
- CVE-2026-25595InvoicePlane has Stored XSS via Invoice Number in Invoice View and DashboardInvoicePlane
- CVE-2026-25594InvoicePlane has Stored XSS via Family Name in Product FormInvoicePlane
- CVE-2026-24745InvoicePlane has a Stored Cross-Site Scripting (XSS) issueInvoicePlane
- CVE-2026-2682Tsinghua Unigroup Electronic Archives System prinReport.html sql injectionTsinghua Unigroup Electronic Archives System
- CVE-2025-12812Cloud Suite and Privilege Access Service – SQL InjectionDelinea Cloud Suite and Privileged Access Service
- CVE-2025-12811Cloud Suite and Privilege Access Service– HTTP request smuggling vulnerabilityDelinea Cloud Suite and Privileged Access Service
- CVE-2026-2676GoogTech sms-ssm API LoginInterceptor.java preHandle improper authorizationGoogTech sms-ssm
- CVE-2019-25356Bematech Printer MP-4200 TH Cross-Site ScriptingBematech MP-4200 TH
- CVE-2019-25354iSmartViewPro 1.3.34 - Denial of ServiceShenzhen Smarteye Digital Electronics Co. iSmartViewPro
- CVE-2019-25353Foscam Video Management System 1.1.4.9 - 'Username' Denial of ServiceDiy Security SL Foscam Video Management System
- CVE-2019-25350XMedia Recode 3.4.8.6 - '.m3u' Denial Of ServiceXMedia Recode
- CVE-2019-25349scadaApp for iOS 1.1.4.0 - 'Servername' Denial of ServicescadaApp for iOS
- CVE-2019-25326ipPulse 1.92 - 'Enter Key' Denial of ServiceNorthwest Performance Software ipPulse
- CVE-2026-2672Tsinghua Unigroup Electronic Archives System downLoad download path traversalTsinghua Unigroup Electronic Archives System
- CVE-2026-27178MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutboxsergejey MajorDoMo
- CVE-2026-27177MajorDoMo Stored Cross-Site Scripting via Property Set Endpointsergejey MajorDoMo
- CVE-2026-27176MajorDoMo Reflected Cross-Site Scripting in command.phpsergejey MajorDoMo
- CVE-2026-2669Rongzhitong Visual Integrated Command and Dispatch Platform User delete access controlRongzhitong Visual Integrated Command and Dispatch Platform
- CVE-2026-24744InvoicePlane has a Stored Cross-Site Scripting (XSS) issueInvoicePlane
- CVE-2026-24743InvoicePlane has a Stored Cross-Site Scripting (XSS) issueInvoicePlane
- CVE-2019-25400IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgiIPFire
- CVE-2019-25399IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgiIPFire
- CVE-2019-25398IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgiIPFire
- CVE-2019-25397IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgiIPFire
- CVE-2019-25396IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgiIPFire
- CVE-2026-24746InvoicePlane has a Stored Cross-Site Scripting (XSS) issueInvoicePlane
- CVE-2026-0665Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirqqemu · Red Hat Enterprise Linux +1
- CVE-2025-8860Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callbackqemu · Red Hat Enterprise Linux +1
- CVE-2025-14876Qemu-kvm: unbounded allocation in virtio-cryptoqemu · Red Hat Enterprise Linux +1
- CVE-2026-1355Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration ExportsGitHub Enterprise Server
- CVE-2026-2668Rongzhitong Visual Integrated Command and Dispatch Platform User add access controlRongzhitong Visual Integrated Command and Dispatch Platform
- CVE-2026-2667Rongzhitong Visual Integrated Command and Dispatch Platform api access controlRongzhitong Visual Integrated Command and Dispatch Platform
- CVE-2025-12343Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backendffmpeg
- CVE-2025-10256Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)ffmpeg
- CVE-2025-0577Glibc: vdso getrandom acceleration may return predictable randomnessglibc · Red Hat Enterprise Linux
- CVE-2026-1200Remote code execution via segmentation fault in increasebufferto functionhttps://github.com/rgaufman/live555 rgaufman/live555
- CVE-2026-2666mingSoft MCMS Template Archive uploadTemplate.do unrestricted uploadmingSoft MCMS · net.mingsoft:ms-mcms
- CVE-2026-2665huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted uploadhuanzi-qch base-admin
- CVE-2026-2663Alixhan xh-admin-backend Database Query query sql injectionAlixhan xh-admin-backend
- CVE-2026-2662FascinatedBox lily lily_emitter.c count_transforms out-of-boundsFascinatedBox lily
- CVE-2026-2661Squirrel sqobject.h operator heap-based overflowSquirrel
- CVE-2026-25500Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefrack
- CVE-2025-69287BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerabilitybsv-blockchain ts-sdk · @bsv/sdk
- CVE-2026-2660FascinatedBox lily lily_symtab.c shorthash_for_name use after freeFascinatedBox lily
- CVE-2026-2659Squirrel sqfuncstate.cpp PopTarget out-of-boundsSquirrel
- CVE-2026-2658newbee-ltd newbee-mall Multiple Endpoints cross-site request forgerynewbee-ltd newbee-mall
- CVE-2026-20142Sensitive Information Disclosure in "_internal" index in Splunk EnterpriseSplunk Enterprise
- CVE-2026-20138Sensitive Information Disclosure in "_internal" index in Splunk EnterpriseSplunk Enterprise
- CVE-2026-20139Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20144Sensitive Information Disclosure in ''_internal'' index in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20141Improper Access Control in Splunk Monitoring Console AppSplunk Enterprise
- CVE-2026-20137Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-2657wren-lang wren Error Message wren_compiler.c printError stack-based overflowwren-lang wren
- CVE-2026-2230Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modificationwpdevelop Booking Calendar
- CVE-2026-23229crypto: virtio - Add spinlock protection with virtqueue notificationLinux
- CVE-2026-23228smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()Linux
- CVE-2026-23223xfs: fix UAF in xchk_btree_check_block_ownerLinux
- CVE-2026-23221bus: fsl-mc: fix use-after-free in driver_override_show()Linux
- CVE-2026-23220ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error pathsLinux
- CVE-2025-71237nilfs2: Fix potential block overflow that cause system hangLinux
- CVE-2025-71235scsi: qla2xxx: Delay module unload while fabric scan in progressLinux
- CVE-2025-71233PCI: endpoint: Avoid creating sub-groups asynchronouslyLinux
- CVE-2025-71232scsi: qla2xxx: Free sp in error path to fix system crashLinux
- CVE-2025-71231crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_modeLinux
- CVE-2025-71230hfs: ensure sb->s_fs_info is always cleaned upLinux
- CVE-2025-71229wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()Linux
- CVE-2026-2656ChaiScript type_info.hpp bare_equal use after freeChaiScript
- CVE-2026-1404Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parametersultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-23219mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_singleLinux
- CVE-2026-23218gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()Linux
- CVE-2026-23217riscv: trace: fix snapshot deadlock with sbi ecallLinux
- CVE-2026-23216scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()Linux
- CVE-2026-23215x86/vmware: Fix hypercall clobbersLinux
- CVE-2026-23214btrfs: reject new transactions if the fs is fully read-onlyLinux
- CVE-2026-23213drm/amd/pm: Disable MMIO access during SMU Mode 1 resetLinux
- CVE-2025-71227wifi: mac80211: don't WARN for connections on invalid channelsLinux
- CVE-2025-71225md: suspend array while updating raid_disks via sysfsLinux
- CVE-2026-27100Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-23212bonding: annotate data-races around slave->last_rxLinux
- CVE-2026-23211mm, swap: restore swap_space attr aviod kernel panicLinux
- CVE-2026-2655ChaiScript chaiscript_defines.hpp operator use after freeChaiScript
- CVE-2025-8308Reflected XSS in Key Software's INFOREXKey Software Solutions INFOREX- General Information Managem…
- CVE-2026-2654huggingface smolagents LocalPythonExecutor requests.post server-side request forgeryhuggingface smolagents · smolagents
- CVE-2026-1441Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2026-1440Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2026-1439Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2026-1438Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2026-1437Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceGraylog Web Interface
- CVE-2026-1317WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Namesmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2026-1582WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Jugglingsoflyy WP All Export – Drag & Drop Export to Any Custom CSV…
- CVE-2026-2386The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'posimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2025-8781Bookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'Bookster – WordPress Appointment Booking Plugin
- CVE-2025-7630OTP Password Brute Forcing in DorukNet's WispotterDoruk Communication and Automation Industry and Trade Wispo…
- CVE-2025-14799Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Jugglingneeraj_slit Brevo – Email, SMS, Web Push, Chat, and more.
- CVE-2026-2653admesh normals.c stl_check_normal_vector heap-based overflowadmesh
- CVE-2026-2426WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parametergamerz WP-DownloadManager
- CVE-2026-1942Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modificationpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2025-14444RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_paymentmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2025-11185Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeComplianz – GDPR/CCPA Cookie Consent
- CVE-2025-13727Video Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Valuesvideowhisper Video Share VOD – Turnkey Video Site Builder S…
- CVE-2026-2126User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameterspecialk User Submitted Posts – Enable Users to Submit Post…
- CVE-2026-1656Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modificationstrategy11team Business Directory Plugin – Easy Listing Dir…
- CVE-2026-1649Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameterjackdewey Community Events
- CVE-2026-2127SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Executiongpriday SiteOrigin Widgets Bundle
- CVE-2026-1941WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesxylus WP Event Aggregator: Import Eventbrite events, Meetup…
- CVE-2026-2112Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletionwebguyio Dam Spam
- CVE-2026-1831YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activationyaycommerce YayMail – WooCommerce Email Customizer
- CVE-2026-1860Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposurewpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-1943YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elementsyaycommerce YayMail – WooCommerce Email Customizer
- CVE-2026-1938YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpointyaycommerce YayMail – WooCommerce Email Customizer
- CVE-2026-1655EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parametermetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2026-2419WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parametergamerz WP-DownloadManager
- CVE-2026-2644niklasso minisat DIMACS File SolverTypes.h value out-of-boundsniklasso minisat
- CVE-2026-2633Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Uploadstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-2281Private Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Settingedersonpeka Private Comment
- CVE-2026-1640Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment CreationTaskbuilder – Project Management & Task Management Tool Wit…
- CVE-2026-1807InteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeInteractiveCalculator for WordPress
- CVE-2026-1666Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parametercodename065 Download Manager
- CVE-2026-1857Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameterstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-2642ggreer the_silver_searcher search.c search_stream null pointer dereferenceggreer the_silver_searcher
- CVE-2026-2641universal-ctags V Language v.c parseExprList recursionuniversal-ctags ctags
- CVE-2025-12356Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status UpdateTickera – Sell Tickets & Manage Events
- CVE-2026-1304Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settingsstellarwp Membership Plugin – Restrict Content
- CVE-2025-12122Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpcalc Popup Box – Easily Create WordPress Popups
- CVE-2026-1072Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Updatejamesits Keybase.io Verification
- CVE-2026-1906PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modificationwpovernight PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-1639Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' ParametersTaskbuilder – Project Management & Task Management Tool Wit…
- CVE-2025-11737VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Titlekurudrive VK All in One Expansion Unit
- CVE-2026-2023WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creationbrikou WP Plugin Info Card
- CVE-2026-1925EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modificationroxnor EmailKit – Email Customizer for WooCommerce & WP
- CVE-2026-1277URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameterkaizencoders URL Shortify – Simple and Easy URL Shortener
- CVE-2025-12037WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scriptinghwk-fr WP 404 Auto Redirect to Similar Post
- CVE-2025-6460Display During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parametergserafini Display During Conditional Shortcode
- CVE-2026-1296Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameterwpshuffle Frontend Post Submission Manager Lite – Frontend…
- CVE-2025-12075Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposurefahadmahmood Order Splitter for WooCommerce
- CVE-2025-12071Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modificationabsikandar Frontend User Notes
- CVE-2025-13959Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesshanaver Filestack
- CVE-2025-12074Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosurepostmagthemes Context Blog
- CVE-2026-27171zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that zlib
- CVE-2025-65519mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing.
- CVE-2025-70062PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module.
- CVE-2025-70063The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability