CVEs published February 26, 2026
171 CVEs were published on February 26, 2026: 11 critical, 60 high.
- Published
- 171
- Critical
- 11
- High
- 60
- Medium
- 81
- Low
- 19
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 96
Most affected products
- discourse
- 17
- arcinfo PcVue
- 7
- Elastic Kibana
- 5
- fleetdm fleet · github.com/fleetdm/fleet/v4
- 5
- A3factura
- 4
- chargemap.com
- 4
- cloudcharge.se
- 4
- ev2go.io
- 4
- Golioth Firmware SDK
- 3
- hoppscotch
- 3
Critical 11
- CVE-2026-27767SWITCH EV swtchenergy.com Missing Authentication for Critical FunctionSWITCH EV swtchenergy.com
- CVE-2026-24731EV2GO ev2go.io Missing Authentication for Critical Functionev2go.io
- CVE-2026-20781CloudCharge cloudcharge.se Missing Authentication for Critical Functioncloudcharge.se
- CVE-2026-25851Chargemap chargemap.com Missing Authentication for Critical Functionchargemap.com
- CVE-2026-28215hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeoverhoppscotch
- CVE-2026-28213EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Responseevershopcommerce evershop
- CVE-2026-22207OpenViking Missing root_api_key Allows Anonymous ROOT AccessVolcengine OpenViking
- CVE-2026-27966Langflow has Remote Code Execution in CSV Agentlangflow-ai langflow · langflow
- CVE-2026-27969Vitess users with backup storage access can write to arbitrary file paths on restorevitessio vitess · vitess.io/vitess
- CVE-2026-27941OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflowsopenlit
- CVE-2025-50857ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php.
High 60
- CVE-2026-25113SWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication AttemptsSWITCH EV swtchenergy.com
- CVE-2026-20895EV2GO ev2go.io Insufficient Session Expirationev2go.io
- CVE-2026-25945EV2GO ev2go.io Improper Restriction of Excessive Authentication Attemptsev2go.io
- CVE-2026-1585An unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 may allow a local attaCanon IJ Scan Utility
- CVE-2026-27652CloudCharge cloudcharge.se Insufficient Session Expirationcloudcharge.se
- CVE-2025-40932Apache::SessionX versions through 2.01 for Perl create insecure session idGRICHTER Apache::SessionX
- CVE-2026-2597Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()LEONT Crypt::SysRandom::XS
- CVE-2026-25114CloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attemptscloudcharge.se
- CVE-2026-25711Chargemap chargemap.com Insufficient Session Expirationchargemap.com
- CVE-2026-20792Chargemap chargemap.com Improper Restriction of Excessive Authentication Attemptschargemap.com
- CVE-2026-28279`osctrl-admin` Vulnerable to OS Command Injection via Environment Configurationjmpsec osctrl · github.com/jmpsec/osctrl
- CVE-2026-28276Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ EndpointMorelitea initiative
- CVE-2026-28275Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)Morelitea initiative
- CVE-2026-28274Initiative Vulnerable to Token Theft via Stored XSS in Document UploadsMorelitea initiative
- CVE-2026-28216hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironmenthoppscotch
- CVE-2026-28211Arbitrary code execution in log reader via untrusted log fileCyrilleB79 NVDA-Dev-Test-Toolbox
- CVE-2026-27449Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API EndpointsUmbraco.Engage.Forms
- CVE-2026-25741Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Userszulip
- CVE-2023-31364Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to fAMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +31
- CVE-2026-22205SPIP < 4.4.10 Authentication Bypass via PHP Type JugglingSPIP
- CVE-2026-22206SPIP < 4.4.10 SQL Injection RCE via Union & PHP TagsSPIP
- CVE-2026-1565User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Uploadwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2026-1241Authentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP CamerasPelco Sarix Professional IMP 3 Series · Pelco Sarix Prof… +2
- CVE-2026-27509Unitree Go2 Missing DDS Authentication Enables Adjacent RCEUnitreeRobotics Unitree Go2
- CVE-2026-27141Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/netgolang.org/x/net/http2 · golang.org/x/net
- CVE-2026-26938Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)Elastic Kibana
- CVE-2026-23750Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer OverflowGolioth Pouch
- CVE-2026-26265Discourse has IDOR vulnerability in the directory items endpointdiscourse
- CVE-2026-26078Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpointdiscourse
- CVE-2026-3071Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code executiFlair
- CVE-2026-2244Sensitive Data Exposure in Google Cloud Vertex AI WorkbenchGoogle Cloud Vertex AI Workbench
- CVE-2025-14343Reflected XSS in Dokuzsoft Technology's E-Commerce ProductDokuzsoft Technology E-Commerce Product
- CVE-2026-1198SQL Injection in SIMPLE.ERPSimple SA Simple.ERP
- CVE-2025-64999Cross-site scripting in HTML logs of Synthetic Monitoring test servicesCheckmk
- CVE-2026-28138WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerabilityStylemix uListing
- CVE-2026-28136WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerabilityVeronaLabs WP SMS
- CVE-2026-25191The installer of FinalCode Client provided by Digital Arts Inc.Digital Arts FinalCode Ver.5 series · Digital Arts FinalCod…
- CVE-2026-23703The installer of FinalCode Client provided by Digital Arts Inc.Digital Arts FinalCode Ver.5 series · Digital Arts FinalCod…
- CVE-2026-1311Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Uploadbearsthemes Worry Proof Backup
- CVE-2026-27975Ajenti has a potential Remote Code Executionajenti · aj
- CVE-2026-1779User Registration & Membership <= 5.1.2 - Authentication Bypasswpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-27970Angular i18n vulnerable to Cross-Site Scripting (XSS)angular · @angular/core
- CVE-2026-27965Vitess users with backup storage access can gain unauthorized access to production deployment environmentsvitessio vitess · vitess.io/vitess
- CVE-2026-27959Koa has Host Header Injection via `ctx.hostname`koajs koa · koa
- CVE-2026-27961Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCEAgenta-AI agenta · agenta
- CVE-2026-27952Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)Agenta-AI agenta-api · agenta
- CVE-2026-1557WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via srcstuartbates WP Responsive Images
- CVE-2026-27938WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflowwp-graphql
- CVE-2026-27904minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsisaacs minimatch · minimatch
- CVE-2026-27903minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsisaacs minimatch · minimatch
- CVE-2026-27899WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Updateh44z wg-portal · github.com/h44z/wg-portal
- CVE-2026-27896MCP Go SDK Vulnerable to Improper Handling of Case Sensitivitymodelcontextprotocol go-sdk · github.com/modelcontextprotoc…
- CVE-2026-27830c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString propertyswaldman c3p0 · com.mchange:c3p0
- CVE-2026-27946ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIzitadel · github.com/zitadel/zitadel
- CVE-2026-27831rldns Vulnerable to Heap-based Out-of-Bounds Readbluedragonsecurity rldns
- CVE-2026-27821GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflowgpac
- CVE-2026-27818TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlistterriajs-server
- CVE-2026-27812Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account TakeoverWei-Shaw sub2api
- CVE-2025-71057Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking att
- CVE-2026-26682An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component
Medium, low and unrated 100
- CVE-2026-22890EV2GO ev2go.io Insufficiently Protected Credentialsev2go.io
- CVE-2026-20733CloudCharge cloudcharge.se Insufficiently Protected Credentialscloudcharge.se
- CVE-2026-3270psi-probe PSI Probe Whois Whois.java lookup server-side request forgerypsi-probe PSI Probe · com.github.psi-probe:psi-probe-core
- CVE-2026-3269psi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of servicepsi-probe PSI Probe · com.github.psi-probe:psi-probe-core
- CVE-2026-20791Chargemap chargemap.com Insufficiently Protected Credentialschargemap.com
- CVE-2026-3268psi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access controlpsi-probe PSI Probe
- CVE-2026-28280`osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query Listjmpsec osctrl · github.com/jmpsec/osctrl
- CVE-2026-28269Kiteworks Core has an OS Command Injectionkiteworks security-advisories
- CVE-2026-28230In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)steve-community steve
- CVE-2026-28226Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listingphishingclub
- CVE-2026-28225Manyfold has IDOR in ModelFilesControllermanyfold3d manyfold
- CVE-2026-28217IDOR in GraphQL userCollection Query Exposes Other Users' Private Collectionshoppscotch
- CVE-2026-3265go2ismail Free-CRM Security API improper authorizationgo2ismail Free-CRM
- CVE-2026-28208Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unixjunrar · com.github.junrar:junrar
- CVE-2026-28207Zen-C Vulnerable to Command Injection via Malicious Output Filenamez-libs Zen-C
- CVE-2026-27638ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user modeactualbudget actual · @actual-app/sync-server
- CVE-2026-27839wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookupwger-project wger · wger
- CVE-2026-27838wger: IDOR via user-unscoped cache keys on routine API actions exposes workout datawger-project wger · wger
- CVE-2026-3264go2ismail Free-CRM Administrative redirectgo2ismail Free-CRM
- CVE-2026-27835wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout datawger-project wger · wger
- CVE-2026-27457Weblate: Missing access control for the AddonViewSet API exposes all addon configurationsWeblateOrg weblate · weblate
- CVE-2026-3263go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorizationgo2ismail Asp.Net-Core-Inventory-Order-Management-System
- CVE-2026-28227Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_categorydiscourse
- CVE-2026-28219Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Bannersdiscourse
- CVE-2026-28218Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Executiondiscourse
- CVE-2026-27154Discourse has XSS when editing a malicious postdiscourse
- CVE-2026-27153Discourse doesn't prevent moderators from exporting user Chat DMsdiscourse
- CVE-2026-3262go2ismail Asp.Net-Core-Inventory-Order-Management-System Administrative redirectgo2ismail Asp.Net-Core-Inventory-Order-Management-System
- CVE-2026-3261itsourcecode School Management System Setting index.php sql injectionitsourcecode School Management System
- CVE-2026-27152DIscourse has DM communication-preference bypass when adding membersdiscourse
- CVE-2026-27162DIscourse doesn't prevent whispers to leak in excerptsdiscourse
- CVE-2026-27151Discourse doesn't validate destination topic when moving postsdiscourse
- CVE-2026-27150Discourse doesn't ensure guardian check when creating QueryGroupBookmarkdiscourse
- CVE-2026-27149Discourse has SQL injection in PM tag filteringdiscourse
- CVE-2026-27021Discourse: Poll voters endpoint lacked post visibility checksdiscourse
- CVE-2026-23939Path Traversal in Local File Store Backendhexpm
- CVE-2026-26979Discourse: TL4 users are able to change status of restricted topicsdiscourse
- CVE-2026-26973Discourse doesn't scope reviewable notes to user-visible reviewablesdiscourse
- CVE-2026-27510Unitree Go2 Mobile Program Tampering Enables Root RCEUnitreeRobotics Unitree Go2
- CVE-2026-22722VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crashVMware Workstation
- CVE-2026-22715VMware Workstation/Fusion NAT vulnerabilityVMware Workstation · VMware Fusion
- CVE-2026-26937Uncontrolled Resource Consumption in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-26227VLC for Android < 3.7.0 Remote Access OTP Authentication BypassVideoLAN VLC for Android
- CVE-2026-23749Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds ReadGolioth Firmware SDK
- CVE-2026-23748Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds ReadGolioth Firmware SDK
- CVE-2026-23747Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer OverflowGolioth Firmware SDK
- CVE-2026-26936Inefficient Regular Expression Complexity in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-26935Improper Input Validation in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-26934Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-26932Improper Validation of Array Index in Packetbeat Leading to Denial of ServiceElastic Packetbeat
- CVE-2026-28295Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responsesRed Hat Enterprise Linux
- CVE-2026-26228VLC for Android < 3.7.0 Remote Access Path TraversalVideoLAN VLC for Android
- CVE-2026-28296Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file pathsRed Hat Enterprise Linux
- CVE-2026-26207DIscourse's discourse-policy plugin lacks post access checkdiscourse
- CVE-2026-26077Discourse doesn't ensure webhooks require a tokendiscourse
- CVE-2026-2680Multiple vulnerabilities in A3factura softwareA3factura
- CVE-2026-2679Multiple vulnerabilities in A3factura softwareA3factura
- CVE-2026-2678Multiple vulnerabilities in A3factura softwareA3factura
- CVE-2026-2677Multiple vulnerabilities in A3factura softwareA3factura
- CVE-2026-28132WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerabilityvillatheme WooCommerce Photo Reviews
- CVE-2026-28131WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerabilityWPVibes Elementor Addon Elements
- CVE-2026-28083WordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerabilityUX-themes Flatsome
- CVE-2026-1698HTTP Host header vulnerability in WebClient and WebScheduler web appsarcinfo PcVue
- CVE-2026-1697Use of unsecure cookies for GraphicalData web service and WebClient web apparcinfo PcVue
- CVE-2026-1696Missing security HTTP headersarcinfo PcVue
- CVE-2026-1695XSS vulnerability upon unsuccessful authenticationarcinfo PcVue
- CVE-2026-1694Server configuration details in HTTP headersarcinfo PcVue
- CVE-2026-1693Use of vulnerable Resource Owner Password Credentials flowarcinfo PcVue
- CVE-2026-1692Missing origin validation in GraphicalData web service requestsarcinfo PcVue
- CVE-2026-27465Fleet: Sensitive Google Calendar credentials disclosed to low-privileged usersfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-25963Fleet: Authorization Bypass in certificate template batch deletion for team administratorsfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-23999Fleet: Device lock PIN can be predicted if lock time is knownfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-24004Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpointfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-2356User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletionwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-27974Audiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player)advplyr audiobookshelf-app
- CVE-2026-27963Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadataadvplyr audiobookshelf
- CVE-2026-27973Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App)advplyr audiobookshelf · advplyr audiobookshelf-app
- CVE-2026-27968Packistry accepts expired access tokenspackistry
- CVE-2026-27954LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpointslivehelperchat
- CVE-2026-27948Copyparty vulnerable to eflected cross-site scripting via setck parameter9001 copyparty · copyparty
- CVE-2026-27943OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownershipopenemr
- CVE-2026-2499Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Settingtgrk Custom Logo
- CVE-2026-2029Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode AttributesLivemesh Addons for Beaver Builder
- CVE-2026-2489TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textareareadymadeweb TP2WP Importer
- CVE-2026-2498WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settingsbulktheme WP Social Meta
- CVE-2026-2506EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'motahar1 EM Cost Calculator
- CVE-2026-27942fast-xml-parser has stack overflow in XMLBuilder with preserveOrderNaturalIntelligence fast-xml-parser · fast-xml-parser
- CVE-2026-27902Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markerssveltejs svelte · svelte
- CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`sveltejs svelte · svelte
- CVE-2026-27887Spin has memory leaks in various WIT interfacesspinframework spin · spinframework SpinKube +1
- CVE-2026-27900Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposureterraform-provider-linode · github.com/linode/terraform-… +2
- CVE-2026-22728sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotationsBitnami sealed-secrets · github.com/bitnami-labs/sealed-sec…
- CVE-2026-27888pypdf: Manipulated FlateDecode XFA streams can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2026-27884NetExec vulnerable to arbitrary file write via path traversal in spider_plus modulePennyw0rth NetExec
- CVE-2026-27829Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSizewithastro astro · @astrojs/node
- CVE-2026-27945ZITADEL has potential SSRF via Actionszitadel · github.com/zitadel/zitadel/v2 +1
- CVE-2026-27840ZITADEL's truncated opaque tokens are still validzitadel · github.com/zitadel/zitadel
- CVE-2026-27837Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()mickhansen dottie.js · dottie
- CVE-2026-26186Fleet has a SQL injection via backtick escape in ORDER BY parameterfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2025-56605A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0