# CVEs published 2026-02-21

65 CVEs were published on February 21, 2026: 6 critical, 29 high. Days are UTC.

- [CVE-2026-2896](https://cve.now/CVE-2026-2896.md): funadmin Configuration Ajax.php setConfig improper authorization (CVSS 6.9, funadmin · funadmin/funadmin)
- [CVE-2026-2895](https://cve.now/CVE-2026-2895.md): funadmin Member.php repass password recovery (CVSS 6.3, funadmin · funadmin/funadmin)
- [CVE-2026-2894](https://cve.now/CVE-2026-2894.md): funadmin forget.html getMember information disclosure (CVSS 6.9, funadmin · funadmin/funadmin)
- [CVE-2026-2889](https://cve.now/CVE-2026-2889.md): CCExtractor mp4.c processmp4 use after free (CVSS 4.8, CCExtractor)
- [CVE-2026-2887](https://cve.now/CVE-2026-2887.md): aardappel lobster idents.h TypeName recursion (CVSS 4.8, aardappel lobster)
- [CVE-2026-2886](https://cve.now/CVE-2026-2886.md): Tenda A21 SetOnlineDevName set\_device\_name stack-based overflow (CVSS 8.7, Tenda A21)
- [CVE-2026-2885](https://cve.now/CVE-2026-2885.md): D-Link DWR-M960 formIpv6Setup sub\_469104 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2884](https://cve.now/CVE-2026-2884.md): D-Link DWR-M960 WAN Interface Setting formWanConfigSetup sub\_41914C stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2883](https://cve.now/CVE-2026-2883.md): D-Link DWR-M960 formIpQoS sub\_427D74 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2882](https://cve.now/CVE-2026-2882.md): D-Link DWR-M960 formDosCfg sub\_46385C stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2881](https://cve.now/CVE-2026-2881.md): D-Link DWR-M960 Advanced Firewall Configuration Endpoint formFirewallAdv sub\_425FF8 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2877](https://cve.now/CVE-2026-2877.md): Tenda A18 Httpd Service WifiExtraSet strcpy stack-based overflow (CVSS 8.7, Tenda A18)
- [CVE-2026-2876](https://cve.now/CVE-2026-2876.md): Tenda A18 setBlackRule parse\_macfilter\_rule stack-based overflow (CVSS 8.7, Tenda A18)
- [CVE-2026-2874](https://cve.now/CVE-2026-2874.md): Tenda A21 fast\_setting\_wifi\_set form\_fast\_setting\_wifi\_set stack-based overflow (CVSS 8.7, Tenda A21)
- [CVE-2026-2873](https://cve.now/CVE-2026-2873.md): Tenda A21 openSchedWifi setSchedWifi stack-based overflow (CVSS 8.7, Tenda A21)
- [CVE-2026-2872](https://cve.now/CVE-2026-2872.md): Tenda A21 MAC Filtering Configuration Endpoint setBlackRule set\_device\_name stack-based overflow (CVSS 8.7, Tenda A21)
- [CVE-2026-2871](https://cve.now/CVE-2026-2871.md): Tenda A21 SetIpMacBind fromSetIpMacBind stack-based overflow (CVSS 8.7, Tenda A21)
- [CVE-2026-2870](https://cve.now/CVE-2026-2870.md): Tenda A21 formSetQosBand set\_qosMib\_list stack-based overflow (CVSS 8.7, Tenda A21)
- [CVE-2026-2869](https://cve.now/CVE-2026-2869.md): janet-lang janet handleattr specials.c janetc\_varset out-of-bounds (CVSS 4.8, janet-lang janet)
- [CVE-2026-2867](https://cve.now/CVE-2026-2867.md): itsourcecode Vehicle Management System billaction.php sql injection (CVSS 6.9, itsourcecode Vehicle Management System)
- [CVE-2026-1787](https://cve.now/CVE-2026-1787.md): LearnPress Export Import \<= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion (CVSS 4.8, thimpress LearnPress – Backup & Migration Tool)
- [CVE-2026-27579](https://cve.now/CVE-2026-27579.md): CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure (CVSS 7.4, karnop realtime-collaboration-platform)
- [CVE-2026-27492](https://cve.now/CVE-2026-27492.md): Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused (CVSS 4.7, lettermint-node · lettermint)
- [CVE-2026-27574](https://cve.now/CVE-2026-27574.md): OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE (CVSS 10.0, oneuptime · @oneuptime/common)
- [CVE-2026-27576](https://cve.now/CVE-2026-27576.md): OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs (CVSS 4.8, openclaw)
- [CVE-2026-27488](https://cve.now/CVE-2026-27488.md): OpenClaw hardened cron webhook delivery against SSRF (CVSS 6.9, openclaw)
- [CVE-2026-27487](https://cve.now/CVE-2026-27487.md): OpenClaw: Prevent shell injection in macOS keychain credential write (CVSS 7.6, openclaw)
- [CVE-2026-27486](https://cve.now/CVE-2026-27486.md): OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup (CVSS 4.3, openclaw)
- [CVE-2025-14339](https://cve.now/CVE-2025-14339.md): weMail \<= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion (CVSS 6.5, wedevs weMail: Email Marketing, Email Automation, Newslette…)
- [CVE-2026-27485](https://cve.now/CVE-2026-27485.md): OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection (CVSS 4.6, openclaw)
- [CVE-2026-27484](https://cve.now/CVE-2026-27484.md): OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows (CVSS 2.3, openclaw)
- [CVE-2026-27482](https://cve.now/CVE-2026-27482.md): Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) (CVSS 5.9, ray-project ray · ray)
- [CVE-2026-27480](https://cve.now/CVE-2026-27480.md): Static Web Server: Timing-Based Username Enumeration in Basic Authentication (CVSS 5.3, static-web-server)
- [CVE-2026-27479](https://cve.now/CVE-2026-27479.md): Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch (CVSS 7.7, ellite Wallos)
- [CVE-2026-27470](https://cve.now/CVE-2026-27470.md): ZoneMinder: Second-Order SQL Injection in \`getNearEvents()\` via Stored Event Name and Cause Fields (CVSS 8.8, zoneminder)
- [CVE-2026-27464](https://cve.now/CVE-2026-27464.md): Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE (CVSS 7.7, metabase)
- [CVE-2026-2865](https://cve.now/CVE-2026-2865.md): itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection (CVSS 6.9, itsourcecode Agri-Trading Online Shopping System)
- [CVE-2026-2864](https://cve.now/CVE-2026-2864.md): feng\_ha\_ha/megagao ssm-erp/production\_ssm PictureController.java pictureDelete path traversal (CVSS 5.3, feng\_ha\_ha ssm-erp · feng\_ha\_ha production\_ssm +2)
- [CVE-2026-27469](https://cve.now/CVE-2026-27469.md): Isso: Stored XSS via comment website field (CVSS 6.1, isso-comments isso · isso)
- [CVE-2026-27467](https://cve.now/CVE-2026-27467.md): BigBlueButton: Audio from participants to the server initially unmuted (CVSS 2.0, bigbluebutton)
- [CVE-2026-27466](https://cve.now/CVE-2026-27466.md): BigBlueButton: Exposed ClamAV port enables Denial of Service (CVSS 7.2, bigbluebutton)
- [CVE-2026-27206](https://cve.now/CVE-2026-27206.md): Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() (CVSS 8.1, zumba json-serializer · zumba/json-serializer)
- [CVE-2026-27458](https://cve.now/CVE-2026-27458.md): LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description (CVSS 8.7, Kovah LinkAce)
- [CVE-2026-27452](https://cve.now/CVE-2026-27452.md): ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer (CVSS 9.2, JonathanWilbur asn1-ts)
- [CVE-2026-27471](https://cve.now/CVE-2026-27471.md): ERP: Document access through endpoints due to missing validation (CVSS 9.3, frappe erpnext)
- [CVE-2026-2863](https://cve.now/CVE-2026-2863.md): feng\_ha\_ha/megagao ssm-erp/production\_ssm FileServiceImpl.java deleteFile path traversal (CVSS 5.3, feng\_ha\_ha ssm-erp · feng\_ha\_ha production\_ssm +2)
- [CVE-2026-2861](https://cve.now/CVE-2026-2861.md): Foswiki Changes/Viewfile/Oops information disclosure (CVSS 6.9, Foswiki)
- [CVE-2026-27212](https://cve.now/CVE-2026-27212.md): Swiper has a Prototype Pollution Vulnerability (CVSS 9.4, nolimits4web swiper · swiper)
- [CVE-2026-26047](https://cve.now/CVE-2026-26047.md): Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2026-26046](https://cve.now/CVE-2026-26046.md): Moodle: moodle: improper input sanitization in tex filter administration setting (CVSS 7.2, moodle)
- [CVE-2026-26045](https://cve.now/CVE-2026-26045.md): Moodle: moodle: improper validation in file restore functionality leading to remote code execution (CVSS 7.2, moodle · moodle/moodle)
- [CVE-2026-27211](https://cve.now/CVE-2026-27211.md): Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse (CVSS 9.1, cloud-hypervisor)
- [CVE-2026-27210](https://cve.now/CVE-2026-27210.md): Pannellum has a XSS vulnerability in hot spot attributes (CVSS 5.3, mpetroff pannellum · pannellum)
- [CVE-2026-27205](https://cve.now/CVE-2026-27205.md): Flask session does not add \`Vary: Cookie\` header when accessed in some ways (CVSS 2.3, pallets flask · flask)
- [CVE-2026-27199](https://cve.now/CVE-2026-27199.md): Werkzeug safe\_join() allows Windows special device names (CVSS 6.3, pallets werkzeug · werkzeug)
- [CVE-2026-27198](https://cve.now/CVE-2026-27198.md): Formwork Improperly Manages Privileges During User Creation (CVSS 8.8, getformwork formwork · getformwork/formwork)
- [CVE-2026-27197](https://cve.now/CVE-2026-27197.md): Sentry: Improper Authentication on SAML SSO process allows user identity linking (CVSS 9.1, getsentry sentry · sentry)
- [CVE-2026-2860](https://cve.now/CVE-2026-2860.md): feng\_ha\_ha/megagao ssm-erp/production\_ssm EmployeeController.java improper authorization (CVSS 5.3, feng\_ha\_ha ssm-erp · feng\_ha\_ha production\_ssm +2)
- [CVE-2026-27196](https://cve.now/CVE-2026-27196.md): Statamic affected by privilege escalation via stored Cross-site Scripting (CVSS 8.1, statamic cms · statamic/cms)
- [CVE-2026-27194](https://cve.now/CVE-2026-27194.md): D-Tale affected by Remote Code Execution through the /save-column-filter endpoint (CVSS 8.1, man-group dtale · dtale)
- [CVE-2026-27193](https://cve.now/CVE-2026-27193.md): Feathers exposes internal headers via unencrypted session cookie (CVSS 8.2, feathersjs feathers · @feathersjs/authentication-oauth)
- [CVE-2026-27192](https://cve.now/CVE-2026-27192.md): Feathers has an origin validation bypass via prefix matching (CVSS 7.6, feathersjs feathers · @feathersjs/authentication-oauth)
- [CVE-2026-27191](https://cve.now/CVE-2026-27191.md): Feathers: Open Redirect in OAuth callback enables account takeover (CVSS 7.4, feathersjs feathers · @feathersjs/authentication-oauth)
- [CVE-2025-65995](https://cve.now/CVE-2025-65995.md): Apache Airflow: Disclosure of secrets to UI via kwargs (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-27189](https://cve.now/CVE-2026-27189.md): OpenSift: Race-prone local persistence could cause state corruption/loss (CVSS 6.6, OpenSift)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.