# CVEs published 2026-02-22

59 CVEs were published on February 22, 2026: 1 critical, 34 high. Days are UTC.

- [CVE-2026-2959](https://cve.now/CVE-2026-2959.md): D-Link DWR-M960 formNewSchedule sub\_44E0F8 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2958](https://cve.now/CVE-2026-2958.md): D-Link DWR-M960 formWsc sub\_457C5C stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2588](https://cve.now/CVE-2026-2588.md): Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems (CVSS 9.1, TIMLEGGE Crypt::NaCl::Sodium)
- [CVE-2026-2957](https://cve.now/CVE-2026-2957.md): qinming99 dst-admin File BackupController.java deleteBackup denial of service (CVSS 5.3, qinming99 dst-admin)
- [CVE-2026-2956](https://cve.now/CVE-2026-2956.md): qinming99 dst-admin restore revertBackup command injection (CVSS 5.3, qinming99 dst-admin)
- [CVE-2026-2954](https://cve.now/CVE-2026-2954.md): Dromara UJCMS ImportDataController import-channel importChanel injection (CVSS 5.3, Dromara UJCMS)
- [CVE-2019-25462](https://cve.now/CVE-2019-25462.md): Web Ofisi Rent a Car v3 SQL Injection via klima Parameter (CVSS 8.8, Web-ofisi Rent a Car)
- [CVE-2019-25461](https://cve.now/CVE-2019-25461.md): Web Ofisi Platinum E-Ticaret v5 SQL Injection via ajax/productsFilterSearch (CVSS 8.8, Web-ofisi Ticaret)
- [CVE-2019-25460](https://cve.now/CVE-2019-25460.md): Web Ofisi Platinum E-Ticaret v5 SQL Injection via q Parameter (CVSS 8.8, Web-ofisi Ticaret)
- [CVE-2019-25459](https://cve.now/CVE-2019-25459.md): Web Ofisi Emlak V2 SQL Injection via emlak-ara.html (CVSS 8.8, Web-ofisi Emlak)
- [CVE-2019-25458](https://cve.now/CVE-2019-25458.md): Web Ofisi Firma Rehberi v1 SQL Injection via firmalar.html (CVSS 8.8, Web-ofisi Firma Rehberi)
- [CVE-2019-25457](https://cve.now/CVE-2019-25457.md): Web Ofisi Firma v13 SQL Injection via oz Parameter (CVSS 8.8, Web-ofisi Firma)
- [CVE-2019-25456](https://cve.now/CVE-2019-25456.md): Web Ofisi Emlak v2 SQL Injection via ara Parameter (CVSS 8.8, Web-ofisi Emlak)
- [CVE-2019-25455](https://cve.now/CVE-2019-25455.md): Web Ofisi E-Ticaret v3 SQL Injection via ara.html (CVSS 8.8, Web-ofisi Ticaret)
- [CVE-2026-2953](https://cve.now/CVE-2026-2953.md): Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal (CVSS 5.3, Dromara UJCMS)
- [CVE-2026-2952](https://cve.now/CVE-2026-2952.md): Vaelsys HTTP POST Request tree\_server.php os command injection (CVSS 6.9, Vaelsys)
- [CVE-2019-25391](https://cve.now/CVE-2019-25391.md): Ashop Shopping Cart Software Lastest Latest SQL Injection via bannedcustomers.php (CVSS 8.8, Ashopsoftware Ashop Shopping Cart Software)
- [CVE-2019-25366](https://cve.now/CVE-2019-25366.md): microASP Portal+ CMS SQL Injection via pagina.phtml (CVSS 8.8, microASP (Portal+) CMS)
- [CVE-2019-25440](https://cve.now/CVE-2019-25440.md): WebIncorp ERP Every version SQL Injection via product\_detail.php (CVSS 8.8, WebIncorp ERP)
- [CVE-2019-25439](https://cve.now/CVE-2019-25439.md): NoviSmart CMS SQL Injection via Referer HTTP Header (CVSS 8.8, NoviSmart CMS)
- [CVE-2019-25433](https://cve.now/CVE-2019-25433.md): XOOPS CMS 2.5.9 SQL Injection via gerar\_pdf.php (CVSS 8.8, XOOPS CMS)
- [CVE-2026-2947](https://cve.now/CVE-2026-2947.md): rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting (CVSS 5.1, rymcu forest)
- [CVE-2019-25452](https://cve.now/CVE-2019-25452.md): Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid (CVSS 8.8, Dolibarr ERP/CRM)
- [CVE-2019-25450](https://cve.now/CVE-2019-25450.md): Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php (CVSS 7.1, Dolibarr ERP/CRM)
- [CVE-2019-25446](https://cve.now/CVE-2019-25446.md): DIGIT CENTRIS ERP Every version SQL Injection via datum1 Parameter (CVSS 8.8, Digit-Rs DIGIT CENTRIS)
- [CVE-2019-25443](https://cve.now/CVE-2019-25443.md): Inventory Webapp SQL Injection via add-item.php (CVSS 8.8, edlangley inventory-webapp)
- [CVE-2019-25442](https://cve.now/CVE-2019-25442.md): Web Wiz Forums 12.01 SQL Injection via PF Parameter (CVSS 8.8, Webwiz Web Wiz Forums)
- [CVE-2026-2946](https://cve.now/CVE-2026-2946.md): rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting (CVSS 5.1, rymcu forest)
- [CVE-2026-2945](https://cve.now/CVE-2026-2945.md): JeecgBoot uploadImgByHttp server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-2944](https://cve.now/CVE-2026-2944.md): Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection (CVSS 6.9, Tosei Online Store Management System ネット店舗管理システム)
- [CVE-2026-2943](https://cve.now/CVE-2026-2943.md): SapneshNaik Student Management System index.php cross site scripting (CVSS 5.3, SapneshNaik Student Management System)
- [CVE-2026-2940](https://cve.now/CVE-2026-2940.md): Zaher1307 tiny\_web\_server URL tiny.c out-of-bounds write (CVSS 6.9, Zaher1307 tiny\_web\_server)
- [CVE-2026-2939](https://cve.now/CVE-2026-2939.md): itsourcecode Student Management System Add Student add\_student cross site scripting (CVSS 4.8, itsourcecode Student Management System)
- [CVE-2026-2938](https://cve.now/CVE-2026-2938.md): SourceCodester Student Result Management System update\_smtp.php access control (CVSS 6.9, SourceCodester Student Result Management System)
- [CVE-2026-2385](https://cve.now/CVE-2026-2385.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.7 - Unauthenticated Email Relay (CVSS 5.3, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2026-2935](https://cve.now/CVE-2026-2935.md): UTT HiPER 810G ConfigExceptMSN strcpy buffer overflow (CVSS 8.6, UTT HiPER)
- [CVE-2026-2934](https://cve.now/CVE-2026-2934.md): YiFang CMS Extended Management D\_friendLinkGroup.php update cross site scripting (CVSS 4.8, YiFang CMS)
- [CVE-2026-2933](https://cve.now/CVE-2026-2933.md): YiFang CMS Extended Management D\_adManage.php update cross site scripting (CVSS 4.8, YiFang CMS)
- [CVE-2026-2932](https://cve.now/CVE-2026-2932.md): YiFang CMS Extended Management D\_adPosition.php update cross site scripting (CVSS 4.8, YiFang CMS)
- [CVE-2026-2930](https://cve.now/CVE-2026-2930.md): Tenda A18 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflow (CVSS 5.3, Tenda A18)
- [CVE-2026-1369](https://cve.now/CVE-2026-1369.md): Conditional CAPTCHA \<= 4.0.0 - Open Redirect (CVSS 4.3, Conditional CAPTCHA)
- [CVE-2026-2929](https://cve.now/CVE-2026-2929.md): D-Link DWR-M960 Wireless Access Control Endpoint formWlAc sub\_453140 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2928](https://cve.now/CVE-2026-2928.md): D-Link DWR-M960 WLAN Encryption Configuration Endpoint formWlEncrypt sub\_452CCC stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2927](https://cve.now/CVE-2026-2927.md): D-Link DWR-M960 Operation Mode Configuration Endpoint formOpMode sub\_462590 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2926](https://cve.now/CVE-2026-2926.md): D-Link DWR-M960 LTE Configuration Endpoint formLteSetup sub\_4237AC stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2925](https://cve.now/CVE-2026-2925.md): D-Link DWR-M960 Bridge VLAN Configuration Endpoint formBridgeVlan sub\_42B5A0 stack-based overflow (CVSS 8.7, D-Link DWR-M960)
- [CVE-2026-2913](https://cve.now/CVE-2026-2913.md): libvips source.c vips\_source\_read\_to\_memory heap-based overflow (CVSS 2.0, libvips)
- [CVE-2026-2912](https://cve.now/CVE-2026-2912.md): code-projects Online Reviewer System studentresult-view.php sql injection (CVSS 6.9, code-projects Online Reviewer System)
- [CVE-2026-2911](https://cve.now/CVE-2026-2911.md): Tenda FH451 GstDhcpSetSer buffer overflow (CVSS 8.7, Tenda FH451)
- [CVE-2026-2910](https://cve.now/CVE-2026-2910.md): Tenda HG9 formPing6 stack-based overflow (CVSS 8.7, Tenda HG9)
- [CVE-2026-2909](https://cve.now/CVE-2026-2909.md): Tenda HG9 Diagnostic Ping Endpoint formPing stack-based overflow (CVSS 8.7, Tenda HG9)
- [CVE-2026-2908](https://cve.now/CVE-2026-2908.md): Tenda HG9 Loopback Detection Configuration Endpoint formLoopBack stack-based overflow (CVSS 8.7, Tenda HG9)
- [CVE-2026-2907](https://cve.now/CVE-2026-2907.md): Tenda HG9 GPON Configuration Endpoint formgponConf stack-based overflow (CVSS 8.7, Tenda HG9)
- [CVE-2026-2906](https://cve.now/CVE-2026-2906.md): Tenda HG9 Samba Configuration Endpoint formSamba stack-based overflow (CVSS 8.7, Tenda HG9)
- [CVE-2026-2905](https://cve.now/CVE-2026-2905.md): Tenda HG9 Wireless Configuration Endpoint formWlanSetup stack-based overflow (CVSS 8.7, Tenda HG9)
- [CVE-2026-2904](https://cve.now/CVE-2026-2904.md): UTT HiPER 810G ConfigExceptAli strcpy buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2026-2903](https://cve.now/CVE-2026-2903.md): skvadrik re2c ast.cc check\_and\_merge\_special\_rules null pointer dereference (CVSS 4.8, skvadrik re2c)
- [CVE-2026-2898](https://cve.now/CVE-2026-2898.md): funadmin Backend Endpoint AuthCloudService.php getMember deserialization (CVSS 5.1, funadmin · funadmin/funadmin)
- [CVE-2026-2897](https://cve.now/CVE-2026-2897.md): funadmin Backend index.html cross site scripting (CVSS 4.8, funadmin · funadmin/funadmin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.