CVEs published February 22, 2026
59 CVEs were published on February 22, 2026: 1 critical, 34 high.
- Published
- 59
- Critical
- 1
- High
- 34
- Medium
- 23
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- D-Link DWR-M960
- 7
- Tenda HG9
- 6
- Web-ofisi Ticaret
- 3
- YiFang CMS
- 3
- Dolibarr ERP/CRM
- 2
- Dromara UJCMS
- 2
- funadmin · funadmin/funadmin
- 2
- qinming99 dst-admin
- 2
- rymcu forest
- 2
- UTT HiPER
- 2
Critical 1
High 34
- CVE-2026-2959D-Link DWR-M960 formNewSchedule sub_44E0F8 stack-based overflowD-Link DWR-M960
- CVE-2026-2958D-Link DWR-M960 formWsc sub_457C5C stack-based overflowD-Link DWR-M960
- CVE-2019-25462Web Ofisi Rent a Car v3 SQL Injection via klima ParameterWeb-ofisi Rent a Car
- CVE-2019-25461Web Ofisi Platinum E-Ticaret v5 SQL Injection via ajax/productsFilterSearchWeb-ofisi Ticaret
- CVE-2019-25460Web Ofisi Platinum E-Ticaret v5 SQL Injection via q ParameterWeb-ofisi Ticaret
- CVE-2019-25459Web Ofisi Emlak V2 SQL Injection via emlak-ara.htmlWeb-ofisi Emlak
- CVE-2019-25458Web Ofisi Firma Rehberi v1 SQL Injection via firmalar.htmlWeb-ofisi Firma Rehberi
- CVE-2019-25457Web Ofisi Firma v13 SQL Injection via oz ParameterWeb-ofisi Firma
- CVE-2019-25456Web Ofisi Emlak v2 SQL Injection via ara ParameterWeb-ofisi Emlak
- CVE-2019-25455Web Ofisi E-Ticaret v3 SQL Injection via ara.htmlWeb-ofisi Ticaret
- CVE-2019-25391Ashop Shopping Cart Software Lastest Latest SQL Injection via bannedcustomers.phpAshopsoftware Ashop Shopping Cart Software
- CVE-2019-25366microASP Portal+ CMS SQL Injection via pagina.phtmlmicroASP (Portal+) CMS
- CVE-2019-25440WebIncorp ERP Every version SQL Injection via product_detail.phpWebIncorp ERP
- CVE-2019-25439NoviSmart CMS SQL Injection via Referer HTTP HeaderNoviSmart CMS
- CVE-2019-25433XOOPS CMS 2.5.9 SQL Injection via gerar_pdf.phpXOOPS CMS
- CVE-2019-25452Dolibarr ERP/CRM 10.0.1 SQL Injection via elemidDolibarr ERP/CRM
- CVE-2019-25450Dolibarr ERP/CRM 10.0.1 SQL Injection via card.phpDolibarr ERP/CRM
- CVE-2019-25446DIGIT CENTRIS ERP Every version SQL Injection via datum1 ParameterDigit-Rs DIGIT CENTRIS
- CVE-2019-25443Inventory Webapp SQL Injection via add-item.phpedlangley inventory-webapp
- CVE-2019-25442Web Wiz Forums 12.01 SQL Injection via PF ParameterWebwiz Web Wiz Forums
- CVE-2026-2935UTT HiPER 810G ConfigExceptMSN strcpy buffer overflowUTT HiPER
- CVE-2026-2929D-Link DWR-M960 Wireless Access Control Endpoint formWlAc sub_453140 stack-based overflowD-Link DWR-M960
- CVE-2026-2928D-Link DWR-M960 WLAN Encryption Configuration Endpoint formWlEncrypt sub_452CCC stack-based overflowD-Link DWR-M960
- CVE-2026-2927D-Link DWR-M960 Operation Mode Configuration Endpoint formOpMode sub_462590 stack-based overflowD-Link DWR-M960
- CVE-2026-2926D-Link DWR-M960 LTE Configuration Endpoint formLteSetup sub_4237AC stack-based overflowD-Link DWR-M960
- CVE-2026-2925D-Link DWR-M960 Bridge VLAN Configuration Endpoint formBridgeVlan sub_42B5A0 stack-based overflowD-Link DWR-M960
- CVE-2026-2911Tenda FH451 GstDhcpSetSer buffer overflowTenda FH451
- CVE-2026-2910Tenda HG9 formPing6 stack-based overflowTenda HG9
- CVE-2026-2909Tenda HG9 Diagnostic Ping Endpoint formPing stack-based overflowTenda HG9
- CVE-2026-2908Tenda HG9 Loopback Detection Configuration Endpoint formLoopBack stack-based overflowTenda HG9
- CVE-2026-2907Tenda HG9 GPON Configuration Endpoint formgponConf stack-based overflowTenda HG9
- CVE-2026-2906Tenda HG9 Samba Configuration Endpoint formSamba stack-based overflowTenda HG9
- CVE-2026-2905Tenda HG9 Wireless Configuration Endpoint formWlanSetup stack-based overflowTenda HG9
- CVE-2026-2904UTT HiPER 810G ConfigExceptAli strcpy buffer overflowUTT HiPER
Medium, low and unrated 24
- CVE-2026-2957qinming99 dst-admin File BackupController.java deleteBackup denial of serviceqinming99 dst-admin
- CVE-2026-2956qinming99 dst-admin restore revertBackup command injectionqinming99 dst-admin
- CVE-2026-2954Dromara UJCMS ImportDataController import-channel importChanel injectionDromara UJCMS
- CVE-2026-2953Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalDromara UJCMS
- CVE-2026-2952Vaelsys HTTP POST Request tree_server.php os command injectionVaelsys
- CVE-2026-2947rymcu forest User Profile UserInfoController.java updateUserInfo cross site scriptingrymcu forest
- CVE-2026-2946rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scriptingrymcu forest
- CVE-2026-2945JeecgBoot uploadImgByHttp server-side request forgeryJeecgBoot
- CVE-2026-2944Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injectionTosei Online Store Management System ネット店舗管理システム
- CVE-2026-2943SapneshNaik Student Management System index.php cross site scriptingSapneshNaik Student Management System
- CVE-2026-2940Zaher1307 tiny_web_server URL tiny.c out-of-bounds writeZaher1307 tiny_web_server
- CVE-2026-2939itsourcecode Student Management System Add Student add_student cross site scriptingitsourcecode Student Management System
- CVE-2026-2938SourceCodester Student Result Management System update_smtp.php access controlSourceCodester Student Result Management System
- CVE-2026-2385The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relayposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2026-2934YiFang CMS Extended Management D_friendLinkGroup.php update cross site scriptingYiFang CMS
- CVE-2026-2933YiFang CMS Extended Management D_adManage.php update cross site scriptingYiFang CMS
- CVE-2026-2932YiFang CMS Extended Management D_adPosition.php update cross site scriptingYiFang CMS
- CVE-2026-2930Tenda A18 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflowTenda A18
- CVE-2026-1369Conditional CAPTCHA <= 4.0.0 - Open RedirectConditional CAPTCHA
- CVE-2026-2913libvips source.c vips_source_read_to_memory heap-based overflowlibvips
- CVE-2026-2912code-projects Online Reviewer System studentresult-view.php sql injectioncode-projects Online Reviewer System
- CVE-2026-2903skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereferenceskvadrik re2c
- CVE-2026-2898funadmin Backend Endpoint AuthCloudService.php getMember deserializationfunadmin · funadmin/funadmin
- CVE-2026-2897funadmin Backend index.html cross site scriptingfunadmin · funadmin/funadmin