CVEs published February 23, 2026
97 CVEs were published on February 23, 2026: 8 critical, 33 high.
- Published
- 97
- Critical
- 8
- High
- 33
- Medium
- 50
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- FastApiAdmin
- 5
- Shenzhen Tenda Technology Co. Tenda F3
- 4
- traccar
- 4
- UTT HiPER
- 4
- Cesanta Mongoose
- 3
- D-Link DWR-M960
- 3
- erzhongxmu JEEWMS
- 3
- free5gc udm
- 3
- Google Chrome
- 3
- valkey-io valkey
- 3
Critical 8
- CVE-2024-58041Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functionsWONKO Smolder
- CVE-2026-23693ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST EndpointRoxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2025-41002SQL injection in InfoticketingMANANTIAL DE IDEAS Infoticketing
- CVE-2026-23552Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicyApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-24494SQL injection vulnerability in Order Up Online Ordering SystemOrder Up Online Ordering System
- CVE-2025-61144libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
- CVE-2025-70043An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master.
- CVE-2025-70327TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttp
High 33
- CVE-2026-3044Tenda AC8 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflowTenda AC8
- CVE-2026-21665The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.31Fiserv Originate Loans Peripherals (formerly Velocity Servi…
- CVE-2026-3063Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a maliGoogle Chrome
- CVE-2026-3062Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memoGoogle Chrome
- CVE-2026-3061Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via aGoogle Chrome
- CVE-2026-25649Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpointstraccar
- CVE-2026-25648Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Uploadtraccar
- CVE-2025-68930Traccar Missing Origin Validation in WebSocketstraccar
- CVE-2026-27623Valkey has Pre-Authentication DOS from malformed RESP requestvalkey-io valkey
- CVE-2026-21863Malformed Valkey Cluster bus message can lead to Remote DoSvalkey-io valkey
- CVE-2025-67733Valkey Affected by RESP Protocol Injection via Lua error_replyvalkey-io valkey
- CVE-2026-27514Tenda F3 Plaintext Credential Exposure in Configuration DownloadShenzhen Tenda Technology Co. Tenda F3
- CVE-2026-22567ZIA Admin UI Input Validation BugZscaler ZIA Admin UI
- CVE-2025-14905389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflowRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-3016UTT HiPER 810G formP2PLimitConfig strcpy buffer overflowUTT HiPER
- CVE-2026-3015UTT HiPER 810G formPolicyRouteConf strcpy buffer overflowUTT HiPER
- CVE-2026-21420Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability.Dell Repository Manager
- CVE-2026-2981UTT HiPER 810G formTaskEdit_ap strcpy buffer overflowUTT HiPER
- CVE-2026-25747Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDBApache Software Foundation Apache Camel LevelDB · org.apach…
- CVE-2026-2980UTT HiPER 810G setSysAdm strcpy buffer overflowUTT HiPER
- CVE-2026-1367SQL InjectionZohocorp ManageEngine ADSelfService Plus
- CVE-2026-2998eAI Technologies｜ERP - DLL HijackingeAI Technologies ERP F2
- CVE-2026-2962D-Link DWR-M960 Scheduled Reboot Configuration Endpoint formDateReboot sub_460F30 stack-based overflowD-Link DWR-M960
- CVE-2026-2961D-Link DWR-M960 VPN Configuration Endpoint formVpnConfigSetup sub_4196C4 stack-based overflowD-Link DWR-M960
- CVE-2026-2960D-Link DWR-M960 formDhcpv6s sub_468D64 stack-based overflowD-Link DWR-M960
- CVE-2025-63945A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute
- CVE-2025-63946A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to exec
- CVE-2025-69700Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via th
- CVE-2025-70045An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master.
- CVE-2025-70058An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.yapi-vendor
- CVE-2025-70328TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttp
- CVE-2025-70329TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd e
- CVE-2025-71056Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing t
Medium, low and unrated 56
- CVE-2025-69252free5GC has Null Pointer Dereference in UDM, Leading to Service Panicfree5gc udm
- CVE-2025-69251free5GC has Improper Input Validation in UDM, Leading to Information Exposurefree5gc udm
- CVE-2025-69250free5GC has Improper Error Handling in UDM, Leading to Information Exposurefree5gc udm
- CVE-2026-3043itsourcecode Event Management System navbar.php cross site scriptingitsourcecode Event Management System
- CVE-2026-3042itsourcecode Event Management System index.php sql injectionitsourcecode Event Management System
- CVE-2026-3041xingfuggz BaykeShop Article Sidebar custom.html cross site scriptingxingfuggz BaykeShop
- CVE-2026-3040DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injectionDrayTek Vigor
- CVE-2026-27741Bludit <= 3.16.1 CSRF in Plugin and Theme Management EndpointsBludit
- CVE-2026-27742Bludit <= 3.16.2 Stored XSS in Post ContentBludit
- CVE-2025-69248free5GC has Array Index Out of Bounds in AMF Leading to Denial of Servicefree5gc amf
- CVE-2025-69247free5GC has Heap Buffer Overflow in UPF Leading to Denial of Servicefree5gc go-upf
- CVE-2026-3028erzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scriptingerzhongxmu JEEWMS
- CVE-2025-69232free5GC hasProtocol Compliance Violation in UPF Leading to SMF Service Disruptionfree5gc go-upf · free5gc smf
- CVE-2025-69208free5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef_PfdManagement GET requestfree5gc udr
- CVE-2026-3027erzhongxmu JEEWMS UEditor getContent.jsp cross site scriptingerzhongxmu JEEWMS
- CVE-2026-23521Traccar vulnerable to Path Traversal and External Control of File Name or Pathtraccar
- CVE-2026-3075WordPress Simple Ajax Chat plugin <= 20251121 - Sensitive Data Exposure vulnerabilityJeff Starr Simple Ajax Chat
- CVE-2026-23694Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX ActionsAruba.it Aruba HiSpeed Cache
- CVE-2026-3026erzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgeryerzhongxmu JEEWMS
- CVE-2026-3025ShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted uploadShuoRen Smart Heating Integrated Management Platform
- CVE-2026-2698Improper Access ControlTenable Security Center
- CVE-2026-27513Tenda F3 CSRF in Web Management InterfaceShenzhen Tenda Technology Co. Tenda F3
- CVE-2026-27512Tenda F3 Reflected Script Execution via Missing nosniff HeaderShenzhen Tenda Technology Co. Tenda F3
- CVE-2026-27511Tenda F3 Clickjacking in Web Management InterfaceShenzhen Tenda Technology Co. Tenda F3
- CVE-2026-22568Unauthorized information retrieval in ZIA Admin UIZscaler ZIA Admin UI
- CVE-2026-2697Indirect Object Reference (IDOR) in Security CenterTenable Security Center
- CVE-2025-59873Session Token Exposure via URL Query ParametersHCL Software ZIE for Web
- CVE-2026-2985Tiandy Video Surveillance System 视频监控平台 CLSBODownLoad.java downloadImage server-side request forgeryTiandy Video Surveillance System 视频监控平台
- CVE-2025-40986Reflected Cross-Site Scripting in PideTuCitaPideTuCita
- CVE-2025-40701Reflected Cross-Site scripting (XSS) in SOTE's SOTESHOPSOTESHOP
- CVE-2026-2984SourceCodester Student Result Management System drop_user.php denial of serviceSourceCodester Student Result Management System
- CVE-2026-2983SourceCodester Student Result Management System Bulk Import import_users.php access controlSourceCodester Student Result Management System
- CVE-2026-2979FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted uploadFastApiAdmin
- CVE-2026-2978FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted uploadFastApiAdmin
- CVE-2026-2977FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted uploadFastApiAdmin
- CVE-2026-2976FastApiAdmin Download Endpoint controller.py download_controller information disclosureFastApiAdmin
- CVE-2026-2975FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosureFastApiAdmin
- CVE-2026-2974AliasVault App Backup aliasvault.xml backupAliasVault App
- CVE-2026-2972a466350665 Smart-SSO Role Edit UserController.java save cross site scriptinga466350665 Smart-SSO
- CVE-2026-2971a466350665 Smart-SSO Login login.html cross site scriptinga466350665 Smart-SSO
- CVE-2026-2970datapizza-labs datapizza-ai cache.py RedisCache deserializationdatapizza-labs datapizza-ai · datapizza-ai-core
- CVE-2026-2969datapizza-labs datapizza-ai Jinja2 Template prompt.py ChatPromptTemplate special elements used in a template enginedatapizza-labs datapizza-ai · datapizza-ai-core
- CVE-2026-2968Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verificationCesanta Mongoose
- CVE-2026-2967Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of sourceCesanta Mongoose
- CVE-2026-2966Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random valuesCesanta Mongoose
- CVE-2026-2997WisdomGarden｜Tronclass - Insecure Direct Object ReferenceWisdomGarden Tronclass
- CVE-2026-296507FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting07FLYCMS · 07FLY-CMS +1
- CVE-2026-2964higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollutionhiguma web-audio-recorder-js
- CVE-2026-2963Jinher OA C6 OfficeSupplyTypeRight.aspx sql injectionJinher OA C6
- CVE-2025-61143libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
- CVE-2025-61145libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
- CVE-2025-61146saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.
- CVE-2025-61147strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(
- CVE-2025-70044An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3.
- CVE-2026-26365Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming requestAkamai Ghost
- CVE-2026-26464Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote a