# CVEs published 2026-02-18

238 CVEs were published on February 18, 2026: 18 critical, 70 high. Days are UTC.

- [CVE-2025-15585](https://cve.now/CVE-2025-15585.md): Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. (CVSS 6.7, fileflows)
- [CVE-2026-2684](https://cve.now/CVE-2026-2684.md): Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload (CVSS 6.9, Tsinghua Unigroup Electronic Archives System)
- [CVE-2026-25926](https://cve.now/CVE-2026-25926.md): Notepad++ has an Untrusted Search Path (CVSS 7.3, notepad-plus-plus)
- [CVE-2026-24126](https://cve.now/CVE-2026-24126.md): Weblate has an argument injection in management console (CVSS 6.6, WeblateOrg weblate · weblate)
- [CVE-2026-26281](https://cve.now/CVE-2026-26281.md): InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View (CVSS 4.4, InvoicePlane)
- [CVE-2026-2683](https://cve.now/CVE-2026-2683.md): Tsinghua Unigroup Electronic Archives System downLoad.html path traversal (CVSS 5.3, Tsinghua Unigroup Electronic Archives System)
- [CVE-2026-26270](https://cve.now/CVE-2026-26270.md): InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting (CVSS 5.4, InvoicePlane)
- [CVE-2025-15581](https://cve.now/CVE-2025-15581.md): Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. (CVSS 4.7, orthanc-server orthanc)
- [CVE-2026-25596](https://cve.now/CVE-2026-25596.md): InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List (CVSS 4.8, InvoicePlane)
- [CVE-2026-25595](https://cve.now/CVE-2026-25595.md): InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard (CVSS 4.8, InvoicePlane)
- [CVE-2026-25594](https://cve.now/CVE-2026-25594.md): InvoicePlane has Stored XSS via Family Name in Product Form (CVSS 4.8, InvoicePlane)
- [CVE-2026-25548](https://cve.now/CVE-2026-25548.md): InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning (CVSS 9.1, InvoicePlane)
- [CVE-2026-24745](https://cve.now/CVE-2026-24745.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7, InvoicePlane)
- [CVE-2026-2682](https://cve.now/CVE-2026-2682.md): Tsinghua Unigroup Electronic Archives System prinReport.html sql injection (CVSS 5.3, Tsinghua Unigroup Electronic Archives System)
- [CVE-2025-12812](https://cve.now/CVE-2025-12812.md): Cloud Suite and Privilege Access Service – SQL Injection (CVSS 5.3, Delinea Cloud Suite and Privileged Access Service)
- [CVE-2025-12811](https://cve.now/CVE-2025-12811.md): Cloud Suite and Privilege Access Service– HTTP request smuggling vulnerability (CVSS 6.9, Delinea Cloud Suite and Privileged Access Service)
- [CVE-2026-2676](https://cve.now/CVE-2026-2676.md): GoogTech sms-ssm API LoginInterceptor.java preHandle improper authorization (CVSS 5.3, GoogTech sms-ssm)
- [CVE-2019-25401](https://cve.now/CVE-2019-25401.md): Bematech Printer MP-4200 TH Denial of Service (CVSS 8.7, Bematech MP-4200)
- [CVE-2019-25365](https://cve.now/CVE-2019-25365.md): ChaosPro 2.0 - Buffer Overflow (CVSS 8.4, ChaosPro)
- [CVE-2019-25364](https://cve.now/CVE-2019-25364.md): Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer Overflow (CVSS 9.3, TABS Laboratories Win10 MailCarrier)
- [CVE-2019-25363](https://cve.now/CVE-2019-25363.md): WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service (CVSS 8.4, Alloksoft WMV to AVI MPEG DVD WMV Convertor)
- [CVE-2019-25362](https://cve.now/CVE-2019-25362.md): WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow (CVSS 9.3, Alloksoft WMV to AVI MPEG DVD WMV Convertor)
- [CVE-2019-25361](https://cve.now/CVE-2019-25361.md): Ayukov NFTP client 1.71 - 'SYST' Buffer Overflow (CVSS 8.6, Ayukov NFTP client)
- [CVE-2019-25360](https://cve.now/CVE-2019-25360.md): Aida64 6.10.5200 - Buffer Overflow (CVSS 8.4, FinalWire Aida64)
- [CVE-2019-25359](https://cve.now/CVE-2019-25359.md): SD.NET RIM 4.7.3c - 'idtyp' SQL Injection (CVSS 8.8, Sitzungsdienst SD.NET RIM)
- [CVE-2019-25358](https://cve.now/CVE-2019-25358.md): FileOptimizer 14.00.2524 - Denial of Service (CVSS 8.7, nikkhokkho FileOptimizer)
- [CVE-2019-25357](https://cve.now/CVE-2019-25357.md): Control Center PRO 6.2.9 - Local Stack Based BufferOverflow (CVSS 8.4, WEBGATE Control Center PRO)
- [CVE-2019-25356](https://cve.now/CVE-2019-25356.md): Bematech Printer MP-4200 TH Cross-Site Scripting (CVSS 5.1, Bematech MP-4200 TH)
- [CVE-2019-25355](https://cve.now/CVE-2019-25355.md): Genivia gSOAP 2.8 - 'gSOAP' Path Traversal (CVSS 8.7, Genivia gSOAP)
- [CVE-2019-25354](https://cve.now/CVE-2019-25354.md): iSmartViewPro 1.3.34 - Denial of Service (CVSS 4.6, Shenzhen Smarteye Digital Electronics Co. iSmartViewPro)
- [CVE-2019-25353](https://cve.now/CVE-2019-25353.md): Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (CVSS 4.6, Diy Security SL Foscam Video Management System)
- [CVE-2019-25352](https://cve.now/CVE-2019-25352.md): Genivia Crystal Live HTTP Server 6.01 - 'Crystal Live HTTP Server' Path Traversal (CVSS 8.7, Genivia Crystal Live HTTP Server)
- [CVE-2019-25351](https://cve.now/CVE-2019-25351.md): Centova Cast 3.2.11 - Arbitrary File Download (CVSS 7.1, Centova Technologies Centova Cast)
- [CVE-2019-25350](https://cve.now/CVE-2019-25350.md): XMedia Recode 3.4.8.6 - '.m3u' Denial Of Service (CVSS 4.6, XMedia Recode)
- [CVE-2019-25349](https://cve.now/CVE-2019-25349.md): scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (CVSS 4.6, scadaApp for iOS)
- [CVE-2019-25326](https://cve.now/CVE-2019-25326.md): ipPulse 1.92 - 'Enter Key' Denial of Service (CVSS 4.6, Northwest Performance Software ipPulse)
- [CVE-2026-2650](https://cve.now/CVE-2026-2650.md): Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-2649](https://cve.now/CVE-2026-2649.md): Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-2648](https://cve.now/CVE-2026-2648.md): Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write v (CVSS 8.8, Google Chrome)
- [CVE-2026-2672](https://cve.now/CVE-2026-2672.md): Tsinghua Unigroup Electronic Archives System downLoad download path traversal (CVSS 5.3, Tsinghua Unigroup Electronic Archives System)
- [CVE-2026-27181](https://cve.now/CVE-2026-27181.md): MajorDoMo Unauthenticated Module Uninstall via Market Endpoint (CVSS 8.7, sergejey MajorDoMo)
- [CVE-2026-27180](https://cve.now/CVE-2026-27180.md): MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning (CVSS 9.3, sergejey MajorDoMo)
- [CVE-2026-27179](https://cve.now/CVE-2026-27179.md): MajorDoMo Unauthenticated SQL Injection in Commands Module (CVSS 8.8, sergejey MajorDoMo)
- [CVE-2026-27178](https://cve.now/CVE-2026-27178.md): MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutbox (CVSS 5.3, sergejey MajorDoMo)
- [CVE-2026-27177](https://cve.now/CVE-2026-27177.md): MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint (CVSS 5.3, sergejey MajorDoMo)
- [CVE-2026-27176](https://cve.now/CVE-2026-27176.md): MajorDoMo Reflected Cross-Site Scripting in command.php (CVSS 5.1, sergejey MajorDoMo)
- [CVE-2026-27175](https://cve.now/CVE-2026-27175.md): MajorDoMo Command Injection in rc/index.php via Race Condition (CVSS 9.2, sergejey MajorDoMo)
- [CVE-2026-27174](https://cve.now/CVE-2026-27174.md): MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval (CVSS 9.3, sergejey MajorDoMo)
- [CVE-2026-2670](https://cve.now/CVE-2026-2670.md): Advantech WISE-6610-NB Background Management openvpn\_apply os command injection (CVSS 8.6, Advantech WISE-6610-NB · Advantech WISE-6610-EB +11)
- [CVE-2026-2669](https://cve.now/CVE-2026-2669.md): Rongzhitong Visual Integrated Command and Dispatch Platform User delete access control (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2026-24744](https://cve.now/CVE-2026-24744.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7, InvoicePlane)
- [CVE-2026-24743](https://cve.now/CVE-2026-24743.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7, InvoicePlane)
- [CVE-2026-27182](https://cve.now/CVE-2026-27182.md): Saturn Remote Mouse Server UDP Command Injection RCE (CVSS 8.6, saturnremote Saturn Remote Mouse Server)
- [CVE-2019-25400](https://cve.now/CVE-2019-25400.md): IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi (CVSS 4.8, IPFire)
- [CVE-2019-25399](https://cve.now/CVE-2019-25399.md): IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi (CVSS 5.1, IPFire)
- [CVE-2019-25398](https://cve.now/CVE-2019-25398.md): IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi (CVSS 5.1, IPFire)
- [CVE-2019-25397](https://cve.now/CVE-2019-25397.md): IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi (CVSS 5.1, IPFire)
- [CVE-2019-25396](https://cve.now/CVE-2019-25396.md): IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi (CVSS 5.1, IPFire)
- [CVE-2026-24746](https://cve.now/CVE-2026-24746.md): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (CVSS 5.7, InvoicePlane)
- [CVE-2026-0665](https://cve.now/CVE-2026-0665.md): Qemu-kvm: heap off-by-one in kvm xen physdevop\_map\_pirq (CVSS 6.5, qemu · Red Hat Enterprise Linux +1)
- [CVE-2025-8860](https://cve.now/CVE-2025-8860.md): Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi\_vars\_write callback (CVSS 3.3, qemu · Red Hat Enterprise Linux +1)
- [CVE-2025-14876](https://cve.now/CVE-2025-14876.md): Qemu-kvm: unbounded allocation in virtio-crypto (CVSS 5.5, qemu · Red Hat Enterprise Linux +1)
- [CVE-2026-1999](https://cve.now/CVE-2026-1999.md): Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests (CVSS 7.1, GitHub Enterprise Server)
- [CVE-2026-1355](https://cve.now/CVE-2026-1355.md): Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports (CVSS 6.0, GitHub Enterprise Server)
- [CVE-2026-0573](https://cve.now/CVE-2026-0573.md): Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution (CVSS 7.6, GitHub Enterprise Server)
- [CVE-2026-2668](https://cve.now/CVE-2026-2668.md): Rongzhitong Visual Integrated Command and Dispatch Platform User add access control (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2026-2667](https://cve.now/CVE-2026-2667.md): Rongzhitong Visual Integrated Command and Dispatch Platform api access control (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2025-1272](https://cve.now/CVE-2025-1272.md): Kernel: secure boot does not automatically enable kernel lockdown (CVSS 7.7, Fedora Project Fedora Linux · Red Hat Enterprise Linux +1)
- [CVE-2025-12343](https://cve.now/CVE-2025-12343.md): Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend (CVSS 3.3, ffmpeg)
- [CVE-2025-10256](https://cve.now/CVE-2025-10256.md): Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af\_firequalizer.c) (CVSS 5.3, ffmpeg)
- [CVE-2025-0577](https://cve.now/CVE-2025-0577.md): Glibc: vdso getrandom acceleration may return predictable randomness (CVSS 4.8, glibc · Red Hat Enterprise Linux)
- [CVE-2026-1200](https://cve.now/CVE-2026-1200.md): Remote code execution via segmentation fault in increasebufferto function (CVSS 6.3, https://github.com/rgaufman/live555 rgaufman/live555)
- [CVE-2026-2666](https://cve.now/CVE-2026-2666.md): mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload (CVSS 5.1, mingSoft MCMS · net.mingsoft:ms-mcms)
- [CVE-2026-2665](https://cve.now/CVE-2026-2665.md): huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload (CVSS 5.3, huanzi-qch base-admin)
- [CVE-2026-23491](https://cve.now/CVE-2026-23491.md): InvoicePlane has Unauthenticated Path Traversal in Guest Controller (CVSS 9.3, InvoicePlane)
- [CVE-2026-0875](https://cve.now/CVE-2026-0875.md): MODEL File Parsing Out-of-Bounds Write (CVSS 7.8, Autodesk Shared Components)
- [CVE-2026-0874](https://cve.now/CVE-2026-0874.md): CATPART File Parsing Out-of-Bounds Write (CVSS 7.8, Autodesk Shared Components)
- [CVE-2026-2663](https://cve.now/CVE-2026-2663.md): Alixhan xh-admin-backend Database Query query sql injection (CVSS 5.3, Alixhan xh-admin-backend)
- [CVE-2026-2662](https://cve.now/CVE-2026-2662.md): FascinatedBox lily lily\_emitter.c count\_transforms out-of-bounds (CVSS 4.8, FascinatedBox lily)
- [CVE-2026-2661](https://cve.now/CVE-2026-2661.md): Squirrel sqobject.h operator heap-based overflow (CVSS 4.8, Squirrel)
- [CVE-2026-25500](https://cve.now/CVE-2026-25500.md): Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href (CVSS 5.4, rack)
- [CVE-2026-22860](https://cve.now/CVE-2026-22860.md): Rack has a Directory Traversal via Rack:Directory (CVSS 7.5, rack)
- [CVE-2025-69287](https://cve.now/CVE-2025-69287.md): BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability (CVSS 5.4, bsv-blockchain ts-sdk · @bsv/sdk)
- [CVE-2026-2660](https://cve.now/CVE-2026-2660.md): FascinatedBox lily lily\_symtab.c shorthash\_for\_name use after free (CVSS 4.8, FascinatedBox lily)
- [CVE-2025-14009](https://cve.now/CVE-2025-14009.md): Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution (CVSS 10.0, nltk/nltk · nltk)
- [CVE-2026-2659](https://cve.now/CVE-2026-2659.md): Squirrel sqfuncstate.cpp PopTarget out-of-bounds (CVSS 4.8, Squirrel)
- [CVE-2026-2658](https://cve.now/CVE-2026-2658.md): newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery (CVSS 5.3, newbee-ltd newbee-mall)
- [CVE-2026-20142](https://cve.now/CVE-2026-20142.md): Sensitive Information Disclosure in "\_internal" index in Splunk Enterprise (CVSS 6.8, Splunk Enterprise)
- [CVE-2026-20138](https://cve.now/CVE-2026-20138.md): Sensitive Information Disclosure in "\_internal" index in Splunk Enterprise (CVSS 6.8, Splunk Enterprise)
- [CVE-2026-20139](https://cve.now/CVE-2026-20139.md): Client-Side Denial of Service (DoS) through ''/splunkd/\_\_raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20144](https://cve.now/CVE-2026-20144.md): Sensitive Information Disclosure in ''\_internal'' index in Splunk Enterprise (CVSS 6.8, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20141](https://cve.now/CVE-2026-20141.md): Improper Access Control in Splunk Monitoring Console App (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-20137](https://cve.now/CVE-2026-20137.md): Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise (CVSS 3.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-2657](https://cve.now/CVE-2026-2657.md): wren-lang wren Error Message wren\_compiler.c printError stack-based overflow (CVSS 4.8, wren-lang wren)
- [CVE-2026-2230](https://cve.now/CVE-2026-2230.md): Booking Calendar \<= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification (CVSS 4.3, wpdevelop Booking Calendar)
- [CVE-2026-2507](https://cve.now/CVE-2026-2507.md): BIG-IP TMM Vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-15579](https://cve.now/CVE-2025-15579.md): An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services. (CVSS 9.5, OpenText™ Directory Services)
- [CVE-2026-23230](https://cve.now/CVE-2026-23230.md): smb: client: split cached\_fid bitfields to avoid shared-byte RMW races (CVSS 8.8, Linux)
- [CVE-2026-23229](https://cve.now/CVE-2026-23229.md): crypto: virtio - Add spinlock protection with virtqueue notification (no CVSS, Linux)
- [CVE-2026-23228](https://cve.now/CVE-2026-23228.md): smb: server: fix leak of active\_num\_conn in ksmbd\_tcp\_new\_connection() (no CVSS, Linux)
- [CVE-2026-23227](https://cve.now/CVE-2026-23227.md): drm/exynos: vidi: use ctx-\>lock to protect struct vidi\_context member variables related to memory alloc/free (CVSS 7.8, Linux)
- [CVE-2026-23226](https://cve.now/CVE-2026-23226.md): ksmbd: add chann\_lock to protect ksmbd\_chann\_list xarray (CVSS 8.8, Linux)
- [CVE-2026-23225](https://cve.now/CVE-2026-23225.md): sched/mmcid: Don't assume CID is CPU owned on mode switch (CVSS 7.8, Linux)
- [CVE-2026-23224](https://cve.now/CVE-2026-23224.md): erofs: fix UAF issue for file-backed mounts w/ directio option (CVSS 7.8, Linux)
- [CVE-2026-23223](https://cve.now/CVE-2026-23223.md): xfs: fix UAF in xchk\_btree\_check\_block\_owner (no CVSS, Linux)
- [CVE-2026-23222](https://cve.now/CVE-2026-23222.md): crypto: omap - Allocate OMAP\_CRYPTO\_FORCE\_COPY scatterlists correctly (CVSS 7.8, Linux)
- [CVE-2026-23221](https://cve.now/CVE-2026-23221.md): bus: fsl-mc: fix use-after-free in driver\_override\_show() (no CVSS, Linux)
- [CVE-2026-23220](https://cve.now/CVE-2026-23220.md): ksmbd: fix infinite loop caused by next\_smb2\_rcv\_hdr\_off reset in error paths (no CVSS, Linux)
- [CVE-2025-71237](https://cve.now/CVE-2025-71237.md): nilfs2: Fix potential block overflow that cause system hang (no CVSS, Linux)
- [CVE-2025-71236](https://cve.now/CVE-2025-71236.md): scsi: qla2xxx: Validate sp before freeing associated memory (CVSS 7.5, Linux)
- [CVE-2025-71235](https://cve.now/CVE-2025-71235.md): scsi: qla2xxx: Delay module unload while fabric scan in progress (no CVSS, Linux)
- [CVE-2025-71234](https://cve.now/CVE-2025-71234.md): wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu\_sta\_add (CVSS 8.8, Linux)
- [CVE-2025-71233](https://cve.now/CVE-2025-71233.md): PCI: endpoint: Avoid creating sub-groups asynchronously (no CVSS, Linux)
- [CVE-2025-71232](https://cve.now/CVE-2025-71232.md): scsi: qla2xxx: Free sp in error path to fix system crash (no CVSS, Linux)
- [CVE-2025-71231](https://cve.now/CVE-2025-71231.md): crypto: iaa - Fix out-of-bounds index in find\_empty\_iaa\_compression\_mode (no CVSS, Linux)
- [CVE-2025-71230](https://cve.now/CVE-2025-71230.md): hfs: ensure sb-\>s\_fs\_info is always cleaned up (no CVSS, Linux)
- [CVE-2025-71229](https://cve.now/CVE-2025-71229.md): wifi: rtw88: Fix alignment fault in rtw\_core\_enable\_beacon() (no CVSS, Linux)
- [CVE-2025-61982](https://cve.now/CVE-2025-61982.md): An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. (CVSS 7.8, OpenCFD OpenFOAM)
- [CVE-2026-2656](https://cve.now/CVE-2026-2656.md): ChaiScript type\_info.hpp bare\_equal use after free (CVSS 2.0, ChaiScript)
- [CVE-2026-1404](https://cve.now/CVE-2026-1404.md): Ultimate Member \<= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters (CVSS 6.1, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-1426](https://cve.now/CVE-2026-1426.md): Advanced AJAX Product Filters \<= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility (CVSS 8.8, berocket Advanced AJAX Product Filters)
- [CVE-2026-23219](https://cve.now/CVE-2026-23219.md): mm/slab: Add alloc\_tagging\_slab\_free\_hook for memcg\_alloc\_abort\_single (no CVSS, Linux)
- [CVE-2026-23218](https://cve.now/CVE-2026-23218.md): gpio: loongson-64bit: Fix incorrect NULL check after devm\_kcalloc() (no CVSS, Linux)
- [CVE-2026-23217](https://cve.now/CVE-2026-23217.md): riscv: trace: fix snapshot deadlock with sbi ecall (no CVSS, Linux)
- [CVE-2026-23216](https://cve.now/CVE-2026-23216.md): scsi: target: iscsi: Fix use-after-free in iscsit\_dec\_conn\_usage\_count() (no CVSS, Linux)
- [CVE-2026-23215](https://cve.now/CVE-2026-23215.md): x86/vmware: Fix hypercall clobbers (no CVSS, Linux)
- [CVE-2026-23214](https://cve.now/CVE-2026-23214.md): btrfs: reject new transactions if the fs is fully read-only (no CVSS, Linux)
- [CVE-2026-23213](https://cve.now/CVE-2026-23213.md): drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (no CVSS, Linux)
- [CVE-2025-71227](https://cve.now/CVE-2025-71227.md): wifi: mac80211: don't WARN for connections on invalid channels (no CVSS, Linux)
- [CVE-2025-71225](https://cve.now/CVE-2025-71225.md): md: suspend array while updating raid\_disks via sysfs (no CVSS, Linux)
- [CVE-2026-27100](https://cve.now/CVE-2026-27100.md): Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-27099](https://cve.now/CVE-2026-27099.md): Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of (CVSS 8.0, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-23212](https://cve.now/CVE-2026-23212.md): bonding: annotate data-races around slave-\>last\_rx (no CVSS, Linux)
- [CVE-2026-23211](https://cve.now/CVE-2026-23211.md): mm, swap: restore swap\_space attr aviod kernel panic (no CVSS, Linux)
- [CVE-2026-2329](https://cve.now/CVE-2026-2329.md): Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow (CVSS 9.3, Grandstream GXP1610 · Grandstream GXP1615 +4)
- [CVE-2025-60038](https://cve.now/CVE-2025-60038.md): A vulnerability has been identified in Rexroth IndraWorks. (CVSS 7.8, Bosch Rexroth IndraWorks)
- [CVE-2025-60037](https://cve.now/CVE-2025-60037.md): A vulnerability has been identified in Rexroth IndraWorks. (CVSS 7.8, Bosch Rexroth IndraWorks)
- [CVE-2025-60036](https://cve.now/CVE-2025-60036.md): A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. (CVSS 7.8, Bosch Rexroth IndraWorks · Bosch Rexroth UA.Testclient)
- [CVE-2026-2655](https://cve.now/CVE-2026-2655.md): ChaiScript chaiscript\_defines.hpp operator use after free (CVSS 2.0, ChaiScript)
- [CVE-2025-60035](https://cve.now/CVE-2025-60035.md): A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. (CVSS 7.8, Bosch Rexroth IndraWorks)
- [CVE-2025-33240](https://cve.now/CVE-2025-33240.md): NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2025-33239](https://cve.now/CVE-2025-33239.md): NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2025-33253](https://cve.now/CVE-2025-33253.md): NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciousl (CVSS 7.8, NVIDIA NeMo Framework · nemo-toolkit)
- [CVE-2025-33252](https://cve.now/CVE-2025-33252.md): NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33251](https://cve.now/CVE-2025-33251.md): NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33250](https://cve.now/CVE-2025-33250.md): NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33249](https://cve.now/CVE-2025-33249.md): NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attack (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33246](https://cve.now/CVE-2025-33246.md): NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33245](https://cve.now/CVE-2025-33245.md): NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. (CVSS 8.0, NVIDIA NeMo Framework · nemo-toolkit)
- [CVE-2025-33243](https://cve.now/CVE-2025-33243.md): NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33241](https://cve.now/CVE-2025-33241.md): NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciously crafted file. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33236](https://cve.now/CVE-2025-33236.md): NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2026-2464](https://cve.now/CVE-2026-2464.md): Directory Traversal in AMR Printer Management by AMR (CVSS 8.7, AMR Printer Management Beta web service)
- [CVE-2025-59920](https://cve.now/CVE-2025-59920.md): SQL injection in time@work from systems@work (CVSS 8.6, systems at work time at work)
- [CVE-2025-8308](https://cve.now/CVE-2025-8308.md): Reflected XSS in Key Software's INFOREX (CVSS 6.3, Key Software Solutions INFOREX- General Information Managem…)
- [CVE-2025-14340](https://cve.now/CVE-2025-14340.md): Admin Account Takeover via malicious URL payload (CVSS 7.3, Payara Platform Payara Server)
- [CVE-2026-2654](https://cve.now/CVE-2026-2654.md): huggingface smolagents LocalPythonExecutor requests.post server-side request forgery (CVSS 5.3, huggingface smolagents · smolagents)
- [CVE-2026-1441](https://cve.now/CVE-2026-1441.md): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (CVSS 5.3, Graylog Web Interface)
- [CVE-2026-1440](https://cve.now/CVE-2026-1440.md): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (CVSS 5.3, Graylog Web Interface)
- [CVE-2026-1439](https://cve.now/CVE-2026-1439.md): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (CVSS 5.3, Graylog Web Interface)
- [CVE-2026-1438](https://cve.now/CVE-2026-1438.md): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (CVSS 5.3, Graylog Web Interface)
- [CVE-2026-1437](https://cve.now/CVE-2026-1437.md): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (CVSS 5.3, Graylog Web Interface)
- [CVE-2026-1436](https://cve.now/CVE-2026-1436.md): Improper Access Control (IDOR) vulnerability in Graylog Web Interface (CVSS 7.1, Graylog Web Interface)
- [CVE-2026-1435](https://cve.now/CVE-2026-1435.md): Incorrect management of session invalidation vulnerability in Graylog Web Interface (CVSS 9.3, Graylog Web Interface)
- [CVE-2026-1317](https://cve.now/CVE-2026-1317.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name (CVSS 6.5, smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…)
- [CVE-2026-1582](https://cve.now/CVE-2026-1582.md): WP All Export \<= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling (CVSS 3.7, soflyy WP All Export – Drag & Drop Export to Any Custom CSV…)
- [CVE-2026-2386](https://cve.now/CVE-2026-2386.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post\_type' (CVSS 4.3, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2025-8781](https://cve.now/CVE-2025-8781.md): Bookster – WordPress Appointment Booking Plugin \<= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw' (CVSS 4.9, Bookster – WordPress Appointment Booking Plugin)
- [CVE-2025-7630](https://cve.now/CVE-2025-7630.md): OTP Password Brute Forcing in DorukNet's Wispotter (CVSS 5.3, Doruk Communication and Automation Industry and Trade Wispo…)
- [CVE-2025-14799](https://cve.now/CVE-2025-14799.md): Brevo - Email, SMS, Web Push, Chat, and more. \<= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling (CVSS 6.5, neeraj\_slit Brevo – Email, SMS, Web Push, Chat, and more.)
- [CVE-2026-2653](https://cve.now/CVE-2026-2653.md): admesh normals.c stl\_check\_normal\_vector heap-based overflow (CVSS 4.8, admesh)
- [CVE-2026-2426](https://cve.now/CVE-2026-2426.md): WP-DownloadManager \<= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter (CVSS 6.5, gamerz WP-DownloadManager)
- [CVE-2026-1942](https://cve.now/CVE-2026-1942.md): Blog2Social: Social Media Auto Post & Scheduler \<= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification (CVSS 6.5, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2025-14444](https://cve.now/CVE-2025-14444.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 6.0.6.9 - Unauthenticated Payment Bypass via rm\_process\_paypal\_sdk\_payment (CVSS 5.3, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2025-11185](https://cve.now/CVE-2025-11185.md): Complianz | GDPR/CCPA Cookie Consent \<= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Complianz – GDPR/CCPA Cookie Consent)
- [CVE-2025-13727](https://cve.now/CVE-2025-13727.md): Video Share VOD \<= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values (CVSS 4.4, videowhisper Video Share VOD – Turnkey Video Site Builder S…)
- [CVE-2026-2126](https://cve.now/CVE-2026-2126.md): User Submitted Posts \<= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter (CVSS 5.3, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2026-1656](https://cve.now/CVE-2026-1656.md): Business Directory Plugin \<= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification (CVSS 5.3, strategy11team Business Directory Plugin – Easy Listing Dir…)
- [CVE-2026-1649](https://cve.now/CVE-2026-1649.md): Community Events \<= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce\_venue\_name' Parameter (CVSS 4.4, jackdewey Community Events)
- [CVE-2026-2127](https://cve.now/CVE-2026-2127.md): SiteOrigin Widgets Bundle \<= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, gpriday SiteOrigin Widgets Bundle)
- [CVE-2026-2495](https://cve.now/CVE-2026-2495.md): WPNakama \<= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter (CVSS 7.5, qdonow WPNakama – Team and multi-Client Collaboration, Edit…)
- [CVE-2026-1941](https://cve.now/CVE-2026-1941.md): WP Event Aggregator \<= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, xylus WP Event Aggregator: Import Eventbrite events, Meetup…)
- [CVE-2026-2112](https://cve.now/CVE-2026-2112.md): Dam Spam \<= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion (CVSS 4.3, webguyio Dam Spam)
- [CVE-2026-1831](https://cve.now/CVE-2026-1831.md): YayMail \<= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation (CVSS 2.7, yaycommerce YayMail – WooCommerce Email Customizer)
- [CVE-2026-1860](https://cve.now/CVE-2026-1860.md): Kali Forms \<= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure (CVSS 4.3, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-1943](https://cve.now/CVE-2026-1943.md): YayMail \<= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements (CVSS 4.4, yaycommerce YayMail – WooCommerce Email Customizer)
- [CVE-2026-1938](https://cve.now/CVE-2026-1938.md): YayMail \<= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint (CVSS 5.3, yaycommerce YayMail – WooCommerce Email Customizer)
- [CVE-2026-1655](https://cve.now/CVE-2026-1655.md): EventPrime \<= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event\_id' Parameter (CVSS 4.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2026-2419](https://cve.now/CVE-2026-2419.md): WP-DownloadManager \<= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download\_path' Parameter (CVSS 2.7, gamerz WP-DownloadManager)
- [CVE-2026-2644](https://cve.now/CVE-2026-2644.md): niklasso minisat DIMACS File SolverTypes.h value out-of-bounds (CVSS 4.8, niklasso minisat)
- [CVE-2026-2296](https://cve.now/CVE-2026-2296.md): Product Addons for Woocommerce – Product Options with Custom Fields \<= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter (CVSS 7.2, acowebs Product Addons for Woocommerce – Product Options wi…)
- [CVE-2026-2633](https://cve.now/CVE-2026-2633.md): Gutenberg Blocks with AI by Kadence WP \<= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-2281](https://cve.now/CVE-2026-2281.md): Private Comment \<= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting (CVSS 4.4, edersonpeka Private Comment)
- [CVE-2026-1640](https://cve.now/CVE-2026-1640.md): Taskbuilder \<= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation (CVSS 4.3, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-1807](https://cve.now/CVE-2026-1807.md): InteractiveCalculator for WordPress \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, InteractiveCalculator for WordPress)
- [CVE-2026-1937](https://cve.now/CVE-2026-1937.md): YayMail \<= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail\_import\_state' AJAX Action (CVSS 7.2, yaycommerce YayMail – WooCommerce Email Customizer)
- [CVE-2026-1666](https://cve.now/CVE-2026-1666.md): Download Manager \<= 3.3.46 - Reflected Cross-Site Scripting via 'redirect\_to' Parameter (CVSS 6.1, codename065 Download Manager)
- [CVE-2026-1857](https://cve.now/CVE-2026-1857.md): Gutenberg Blocks with AI by Kadence WP \<= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-2019](https://cve.now/CVE-2026-2019.md): Cart All In One For WooCommerce \<= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc\_assign\_page' Setting (CVSS 7.2, villatheme Cart All In One For WooCommerce)
- [CVE-2026-2642](https://cve.now/CVE-2026-2642.md): ggreer the\_silver\_searcher search.c search\_stream null pointer dereference (CVSS 4.8, ggreer the\_silver\_searcher)
- [CVE-2026-1368](https://cve.now/CVE-2026-1368.md): Video Conferencing with Zoom API \< 4.6.6 - Unauthenticated SDK Signature Generation (CVSS 7.5, Video Conferencing with Zoom)
- [CVE-2026-2641](https://cve.now/CVE-2026-2641.md): universal-ctags V Language v.c parseExprList recursion (CVSS 4.8, universal-ctags ctags)
- [CVE-2025-12356](https://cve.now/CVE-2025-12356.md): Tickera – WordPress Event Ticketing \<= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update (CVSS 4.3, Tickera – Sell Tickets & Manage Events)
- [CVE-2026-1304](https://cve.now/CVE-2026-1304.md): Membership Plugin – Restrict Content \<= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings (CVSS 4.4, stellarwp Membership Plugin – Restrict Content)
- [CVE-2025-12122](https://cve.now/CVE-2025-12122.md): Popup Box – Easily Create WordPress Popups \<= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpcalc Popup Box – Easily Create WordPress Popups)
- [CVE-2026-1072](https://cve.now/CVE-2026-1072.md): Keybase.io Verification \<= 1.4.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, jamesits Keybase.io Verification)
- [CVE-2026-1906](https://cve.now/CVE-2026-1906.md): PDF Invoices & Packing Slips for WooCommerce \<= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification (CVSS 4.3, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2026-1639](https://cve.now/CVE-2026-1639.md): Taskbuilder \<= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort\_by' Parameters (CVSS 6.5, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2025-11737](https://cve.now/CVE-2025-11737.md): VK All in One Expansion Unit \<= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title (CVSS 6.4, kurudrive VK All in One Expansion Unit)
- [CVE-2026-2023](https://cve.now/CVE-2026-2023.md): WP Plugin Info Card \<= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation (CVSS 4.3, brikou WP Plugin Info Card)
- [CVE-2026-1925](https://cve.now/CVE-2026-1925.md): EmailKit – Email Customizer for WooCommerce & WP \<= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification (CVSS 4.3, roxnor EmailKit – Email Customizer for WooCommerce & WP)
- [CVE-2026-2576](https://cve.now/CVE-2026-2576.md): Business Directory Plugin \<= 6.4.21 - Unauthenticated SQL Injection via payment Parameter (CVSS 7.5, strategy11team Business Directory Plugin – Easy Listing Dir…)
- [CVE-2026-1714](https://cve.now/CVE-2026-1714.md): ShopLentor \<= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor\_suggest\_price\_action' AJAX Action (CVSS 8.6, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-1277](https://cve.now/CVE-2026-1277.md): URL Shortify \<= 1.12.1 - Unauthenticated Open Redirect via 'redirect\_to' Parameter (CVSS 4.7, kaizencoders URL Shortify – Simple and Easy URL Shortener)
- [CVE-2025-12037](https://cve.now/CVE-2025-12037.md): WP 404 Auto Redirect \<= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, hwk-fr WP 404 Auto Redirect to Similar Post)
- [CVE-2025-6460](https://cve.now/CVE-2025-6460.md): Display During Conditional Shortcode \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter (CVSS 6.4, gserafini Display During Conditional Shortcode)
- [CVE-2026-1296](https://cve.now/CVE-2026-1296.md): Frontend Post Submission Manager Lite \<= 1.2.7 - Unauthenticated Open Redirect via 'requested\_page' Parameter (CVSS 6.1, wpshuffle Frontend Post Submission Manager Lite – Frontend…)
- [CVE-2025-12075](https://cve.now/CVE-2025-12075.md): Order Splitter for WooCommerce \<= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure (CVSS 4.3, fahadmahmood Order Splitter for WooCommerce)
- [CVE-2026-1931](https://cve.now/CVE-2026-1931.md): Rent Fetch \<= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter (CVSS 7.2, jonschr Rent Fetch)
- [CVE-2025-12071](https://cve.now/CVE-2025-12071.md): Frontend User Notes \<= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification (CVSS 4.3, absikandar Frontend User Notes)
- [CVE-2025-13959](https://cve.now/CVE-2025-13959.md): Filestack \<= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, shanaver Filestack)
- [CVE-2025-12074](https://cve.now/CVE-2025-12074.md): Context Blog \<= 1.2.5 - Unauthenticated Private Post Disclosure (CVSS 5.3, postmagthemes Context Blog)
- [CVE-2026-27171](https://cve.now/CVE-2026-27171.md): zlib before 1.3.2 allows CPU consumption via crc32\_combine64 and crc32\_combine\_gen64 because x2nmodp can do right shifts within a loop that (CVSS 2.9, zlib)
- [CVE-2025-65519](https://cve.now/CVE-2025-65519.md): mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. (CVSS 6.5)
- [CVE-2025-65791](https://cve.now/CVE-2025-65791.md): ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. (CVSS 9.8)
- [CVE-2025-70062](https://cve.now/CVE-2025-70062.md): PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. (CVSS 6.5)
- [CVE-2025-70063](https://cve.now/CVE-2025-70063.md): The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability (CVSS 6.5)
- [CVE-2025-70064](https://cve.now/CVE-2025-70064.md): PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. (CVSS 8.8)
- [CVE-2025-70141](https://cve.now/CVE-2025-70141.md): SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. (CVSS 9.4)
- [CVE-2025-70146](https://cve.now/CVE-2025-70146.md): Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remot (CVSS 9.1)
- [CVE-2025-70147](https://cve.now/CVE-2025-70147.md): Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers (CVSS 7.5)
- [CVE-2025-70148](https://cve.now/CVE-2025-70148.md): Missing authentication and authorization in print\_membership\_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated a (CVSS 7.5)
- [CVE-2025-70149](https://cve.now/CVE-2025-70149.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print\_membership\_card.php via the ID parameter. (CVSS 9.8)
- [CVE-2025-70150](https://cve.now/CVE-2025-70150.md): CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete\_members.php that allows unauthenticated (CVSS 9.8)
- [CVE-2025-70151](https://cve.now/CVE-2025-70151.md): code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. (CVSS 8.8)
- [CVE-2025-70152](https://cve.now/CVE-2025-70152.md): code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/sa (CVSS 9.8)
- [CVE-2025-70998](https://cve.now/CVE-2025-70998.md): UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibl (CVSS 9.8)
- [CVE-2026-24708](https://cve.now/CVE-2026-24708.md): An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. (CVSS 8.2, OpenStack Nova · nova)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.