CVEs published February 21, 2026
65 CVEs were published on February 21, 2026: 6 critical, 29 high.
- Published
- 65
- Critical
- 6
- High
- 29
- Medium
- 27
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- openclaw
- 6
- Tenda A21
- 6
- D-Link DWR-M960
- 5
- feathersjs feathers · @feathersjs/authentication-oauth
- 3
- feng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- 3
- funadmin · funadmin/funadmin
- 3
- bigbluebutton
- 2
- moodle · moodle/moodle
- 2
- Tenda A18
- 2
- aardappel lobster
- 1
Critical 6
- CVE-2026-27574OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCEoneuptime · @oneuptime/common
- CVE-2026-27452ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBufferJonathanWilbur asn1-ts
- CVE-2026-27471ERP: Document access through endpoints due to missing validationfrappe erpnext
- CVE-2026-27212Swiper has a Prototype Pollution Vulnerabilitynolimits4web swiper · swiper
- CVE-2026-27211Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abusecloud-hypervisor
- CVE-2026-27197Sentry: Improper Authentication on SAML SSO process allows user identity linkinggetsentry sentry · sentry
High 29
- CVE-2026-2886Tenda A21 SetOnlineDevName set_device_name stack-based overflowTenda A21
- CVE-2026-2885D-Link DWR-M960 formIpv6Setup sub_469104 stack-based overflowD-Link DWR-M960
- CVE-2026-2884D-Link DWR-M960 WAN Interface Setting formWanConfigSetup sub_41914C stack-based overflowD-Link DWR-M960
- CVE-2026-2883D-Link DWR-M960 formIpQoS sub_427D74 stack-based overflowD-Link DWR-M960
- CVE-2026-2882D-Link DWR-M960 formDosCfg sub_46385C stack-based overflowD-Link DWR-M960
- CVE-2026-2881D-Link DWR-M960 Advanced Firewall Configuration Endpoint formFirewallAdv sub_425FF8 stack-based overflowD-Link DWR-M960
- CVE-2026-2877Tenda A18 Httpd Service WifiExtraSet strcpy stack-based overflowTenda A18
- CVE-2026-2876Tenda A18 setBlackRule parse_macfilter_rule stack-based overflowTenda A18
- CVE-2026-2874Tenda A21 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflowTenda A21
- CVE-2026-2873Tenda A21 openSchedWifi setSchedWifi stack-based overflowTenda A21
- CVE-2026-2872Tenda A21 MAC Filtering Configuration Endpoint setBlackRule set_device_name stack-based overflowTenda A21
- CVE-2026-2871Tenda A21 SetIpMacBind fromSetIpMacBind stack-based overflowTenda A21
- CVE-2026-2870Tenda A21 formSetQosBand set_qosMib_list stack-based overflowTenda A21
- CVE-2026-27579CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposurekarnop realtime-collaboration-platform
- CVE-2026-27487OpenClaw: Prevent shell injection in macOS keychain credential writeopenclaw
- CVE-2026-27479Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetchellite Wallos
- CVE-2026-27470ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fieldszoneminder
- CVE-2026-27464Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCEmetabase
- CVE-2026-27466BigBlueButton: Exposed ClamAV port enables Denial of Servicebigbluebutton
- CVE-2026-27206Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()zumba json-serializer · zumba/json-serializer
- CVE-2026-27458LinkAce: Stored XSS in Atom Feed via CDATA Escape in List DescriptionKovah LinkAce
- CVE-2026-26046Moodle: moodle: improper input sanitization in tex filter administration settingmoodle
- CVE-2026-26045Moodle: moodle: improper validation in file restore functionality leading to remote code executionmoodle · moodle/moodle
- CVE-2026-27198Formwork Improperly Manages Privileges During User Creationgetformwork formwork · getformwork/formwork
- CVE-2026-27196Statamic affected by privilege escalation via stored Cross-site Scriptingstatamic cms · statamic/cms
- CVE-2026-27194D-Tale affected by Remote Code Execution through the /save-column-filter endpointman-group dtale · dtale
- CVE-2026-27193Feathers exposes internal headers via unencrypted session cookiefeathersjs feathers · @feathersjs/authentication-oauth
- CVE-2026-27192Feathers has an origin validation bypass via prefix matchingfeathersjs feathers · @feathersjs/authentication-oauth
- CVE-2026-27191Feathers: Open Redirect in OAuth callback enables account takeoverfeathersjs feathers · @feathersjs/authentication-oauth
Medium, low and unrated 30
- CVE-2026-2896funadmin Configuration Ajax.php setConfig improper authorizationfunadmin · funadmin/funadmin
- CVE-2026-2895funadmin Member.php repass password recoveryfunadmin · funadmin/funadmin
- CVE-2026-2894funadmin forget.html getMember information disclosurefunadmin · funadmin/funadmin
- CVE-2026-2889CCExtractor mp4.c processmp4 use after freeCCExtractor
- CVE-2026-2887aardappel lobster idents.h TypeName recursionaardappel lobster
- CVE-2026-2869janet-lang janet handleattr specials.c janetc_varset out-of-boundsjanet-lang janet
- CVE-2026-2867itsourcecode Vehicle Management System billaction.php sql injectionitsourcecode Vehicle Management System
- CVE-2026-1787LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletionthimpress LearnPress – Backup & Migration Tool
- CVE-2026-27492Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reusedlettermint-node · lettermint
- CVE-2026-27576OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputsopenclaw
- CVE-2026-27488OpenClaw hardened cron webhook delivery against SSRFopenclaw
- CVE-2026-27486OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanupopenclaw
- CVE-2025-14339weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletionwedevs weMail: Email Marketing, Email Automation, Newslette…
- CVE-2026-27485OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionopenclaw
- CVE-2026-27484OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flowsopenclaw
- CVE-2026-27482Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)ray-project ray · ray
- CVE-2026-27480Static Web Server: Timing-Based Username Enumeration in Basic Authenticationstatic-web-server
- CVE-2026-2865itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injectionitsourcecode Agri-Trading Online Shopping System
- CVE-2026-2864feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversalfeng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- CVE-2026-27469Isso: Stored XSS via comment website fieldisso-comments isso · isso
- CVE-2026-27467BigBlueButton: Audio from participants to the server initially unmutedbigbluebutton
- CVE-2026-2863feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversalfeng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- CVE-2026-2861Foswiki Changes/Viewfile/Oops information disclosureFoswiki
- CVE-2026-26047Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of servicemoodle · moodle/moodle
- CVE-2026-27210Pannellum has a XSS vulnerability in hot spot attributesmpetroff pannellum · pannellum
- CVE-2026-27205Flask session does not add `Vary: Cookie` header when accessed in some wayspallets flask · flask
- CVE-2026-27199Werkzeug safe_join() allows Windows special device namespallets werkzeug · werkzeug
- CVE-2026-2860feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorizationfeng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- CVE-2025-65995Apache Airflow: Disclosure of secrets to UI via kwargsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-27189OpenSift: Race-prone local persistence could cause state corruption/lossOpenSift