# CVEs published 2026-02-26

171 CVEs were published on February 26, 2026: 11 critical, 60 high. Days are UTC.

- [CVE-2026-25113](https://cve.now/CVE-2026-25113.md): SWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, SWITCH EV swtchenergy.com)
- [CVE-2026-27767](https://cve.now/CVE-2026-27767.md): SWITCH EV swtchenergy.com Missing Authentication for Critical Function (CVSS 9.4, SWITCH EV swtchenergy.com)
- [CVE-2026-22890](https://cve.now/CVE-2026-22890.md): EV2GO ev2go.io Insufficiently Protected Credentials (CVSS 6.5, ev2go.io)
- [CVE-2026-20895](https://cve.now/CVE-2026-20895.md): EV2GO ev2go.io Insufficient Session Expiration (CVSS 7.3, ev2go.io)
- [CVE-2026-25945](https://cve.now/CVE-2026-25945.md): EV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, ev2go.io)
- [CVE-2026-24731](https://cve.now/CVE-2026-24731.md): EV2GO ev2go.io Missing Authentication for Critical Function (CVSS 9.4, ev2go.io)
- [CVE-2026-1585](https://cve.now/CVE-2026-1585.md): An unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 may allow a local atta (CVSS 8.4, Canon IJ Scan Utility)
- [CVE-2026-20733](https://cve.now/CVE-2026-20733.md): CloudCharge cloudcharge.se Insufficiently Protected Credentials (CVSS 6.5, cloudcharge.se)
- [CVE-2026-27652](https://cve.now/CVE-2026-27652.md): CloudCharge cloudcharge.se Insufficient Session Expiration (CVSS 7.3, cloudcharge.se)
- [CVE-2025-40932](https://cve.now/CVE-2025-40932.md): Apache::SessionX versions through 2.01 for Perl create insecure session id (CVSS 8.2, GRICHTER Apache::SessionX)
- [CVE-2026-3270](https://cve.now/CVE-2026-3270.md): psi-probe PSI Probe Whois Whois.java lookup server-side request forgery (CVSS 5.3, psi-probe PSI Probe · com.github.psi-probe:psi-probe-core)
- [CVE-2026-3269](https://cve.now/CVE-2026-3269.md): psi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of service (CVSS 5.3, psi-probe PSI Probe · com.github.psi-probe:psi-probe-core)
- [CVE-2026-2597](https://cve.now/CVE-2026-2597.md): Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random\_bytes() (CVSS 7.5, LEONT Crypt::SysRandom::XS)
- [CVE-2026-25114](https://cve.now/CVE-2026-25114.md): CloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, cloudcharge.se)
- [CVE-2026-20781](https://cve.now/CVE-2026-20781.md): CloudCharge cloudcharge.se Missing Authentication for Critical Function (CVSS 9.4, cloudcharge.se)
- [CVE-2026-20791](https://cve.now/CVE-2026-20791.md): Chargemap chargemap.com Insufficiently Protected Credentials (CVSS 6.5, chargemap.com)
- [CVE-2026-25711](https://cve.now/CVE-2026-25711.md): Chargemap chargemap.com Insufficient Session Expiration (CVSS 7.3, chargemap.com)
- [CVE-2026-20792](https://cve.now/CVE-2026-20792.md): Chargemap chargemap.com Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, chargemap.com)
- [CVE-2026-25851](https://cve.now/CVE-2026-25851.md): Chargemap chargemap.com Missing Authentication for Critical Function (CVSS 9.4, chargemap.com)
- [CVE-2026-3268](https://cve.now/CVE-2026-3268.md): psi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control (CVSS 5.3, psi-probe PSI Probe)
- [CVE-2026-28280](https://cve.now/CVE-2026-28280.md): \`osctrl-admin\` has Stored Cross-Site Scripting (XSS) in On-Demand Query List (CVSS 6.1, jmpsec osctrl · github.com/jmpsec/osctrl)
- [CVE-2026-28279](https://cve.now/CVE-2026-28279.md): \`osctrl-admin\` Vulnerable to OS Command Injection via Environment Configuration (CVSS 7.4, jmpsec osctrl · github.com/jmpsec/osctrl)
- [CVE-2026-28276](https://cve.now/CVE-2026-28276.md): Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint (CVSS 7.5, Morelitea initiative)
- [CVE-2026-28275](https://cve.now/CVE-2026-28275.md): Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid) (CVSS 8.1, Morelitea initiative)
- [CVE-2026-28274](https://cve.now/CVE-2026-28274.md): Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads (CVSS 8.7, Morelitea initiative)
- [CVE-2026-28269](https://cve.now/CVE-2026-28269.md): Kiteworks Core has an OS Command Injection (CVSS 5.9, kiteworks security-advisories)
- [CVE-2026-28230](https://cve.now/CVE-2026-28230.md): In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction) (CVSS 5.7, steve-community steve)
- [CVE-2026-28226](https://cve.now/CVE-2026-28226.md): Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing (CVSS 6.5, phishingclub)
- [CVE-2026-28225](https://cve.now/CVE-2026-28225.md): Manyfold has IDOR in ModelFilesController (CVSS 5.3, manyfold3d manyfold)
- [CVE-2026-28217](https://cve.now/CVE-2026-28217.md): IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections (CVSS 6.5, hoppscotch)
- [CVE-2026-28216](https://cve.now/CVE-2026-28216.md): hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment (CVSS 8.3, hoppscotch)
- [CVE-2026-28215](https://cve.now/CVE-2026-28215.md): hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover (CVSS 9.1, hoppscotch)
- [CVE-2026-3265](https://cve.now/CVE-2026-3265.md): go2ismail Free-CRM Security API improper authorization (CVSS 5.3, go2ismail Free-CRM)
- [CVE-2026-28213](https://cve.now/CVE-2026-28213.md): EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response (CVSS 9.8, evershopcommerce evershop)
- [CVE-2026-28211](https://cve.now/CVE-2026-28211.md): Arbitrary code execution in log reader via untrusted log file (CVSS 7.8, CyrilleB79 NVDA-Dev-Test-Toolbox)
- [CVE-2026-28208](https://cve.now/CVE-2026-28208.md): Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix (CVSS 5.9, junrar · com.github.junrar:junrar)
- [CVE-2026-28207](https://cve.now/CVE-2026-28207.md): Zen-C Vulnerable to Command Injection via Malicious Output Filename (CVSS 6.6, z-libs Zen-C)
- [CVE-2026-27638](https://cve.now/CVE-2026-27638.md): ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode (CVSS 5.7, actualbudget actual · @actual-app/sync-server)
- [CVE-2026-27839](https://cve.now/CVE-2026-27839.md): wger: IDOR in nutritional\_values endpoints exposes private dietary data via direct ORM lookup (CVSS 4.3, wger-project wger · wger)
- [CVE-2026-27838](https://cve.now/CVE-2026-27838.md): wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data (CVSS 3.1, wger-project wger · wger)
- [CVE-2026-3264](https://cve.now/CVE-2026-3264.md): go2ismail Free-CRM Administrative redirect (CVSS 5.3, go2ismail Free-CRM)
- [CVE-2026-27835](https://cve.now/CVE-2026-27835.md): wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data (CVSS 4.3, wger-project wger · wger)
- [CVE-2026-27457](https://cve.now/CVE-2026-27457.md): Weblate: Missing access control for the AddonViewSet API exposes all addon configurations (CVSS 4.3, WeblateOrg weblate · weblate)
- [CVE-2026-27449](https://cve.now/CVE-2026-27449.md): Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints (CVSS 7.5, Umbraco.Engage.Forms)
- [CVE-2026-25741](https://cve.now/CVE-2026-25741.md): Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users (CVSS 7.1, zulip)
- [CVE-2026-3263](https://cve.now/CVE-2026-3263.md): go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization (CVSS 5.3, go2ismail Asp.Net-Core-Inventory-Order-Management-System)
- [CVE-2026-28227](https://cve.now/CVE-2026-28227.md): Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish\_to\_category (CVSS 1.2, discourse)
- [CVE-2026-28219](https://cve.now/CVE-2026-28219.md): Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners (CVSS 1.3, discourse)
- [CVE-2026-28218](https://cve.now/CVE-2026-28218.md): Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution (CVSS 5.3, discourse)
- [CVE-2026-27154](https://cve.now/CVE-2026-27154.md): Discourse has XSS when editing a malicious post (CVSS 1.3, discourse)
- [CVE-2026-27153](https://cve.now/CVE-2026-27153.md): Discourse doesn't prevent moderators from exporting user Chat DMs (CVSS 1.3, discourse)
- [CVE-2026-3262](https://cve.now/CVE-2026-3262.md): go2ismail Asp.Net-Core-Inventory-Order-Management-System Administrative redirect (CVSS 5.3, go2ismail Asp.Net-Core-Inventory-Order-Management-System)
- [CVE-2026-3261](https://cve.now/CVE-2026-3261.md): itsourcecode School Management System Setting index.php sql injection (CVSS 6.9, itsourcecode School Management System)
- [CVE-2026-22207](https://cve.now/CVE-2026-22207.md): OpenViking Missing root\_api\_key Allows Anonymous ROOT Access (CVSS 9.3, Volcengine OpenViking)
- [CVE-2023-31364](https://cve.now/CVE-2023-31364.md): Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to f (CVSS 8.3, AMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +31)
- [CVE-2026-22205](https://cve.now/CVE-2026-22205.md): SPIP \< 4.4.10 Authentication Bypass via PHP Type Juggling (CVSS 8.7, SPIP)
- [CVE-2026-22206](https://cve.now/CVE-2026-22206.md): SPIP \< 4.4.10 SQL Injection RCE via Union & PHP Tags (CVSS 8.7, SPIP)
- [CVE-2026-27152](https://cve.now/CVE-2026-27152.md): DIscourse has DM communication-preference bypass when adding members (CVSS 1.3, discourse)
- [CVE-2026-27162](https://cve.now/CVE-2026-27162.md): DIscourse doesn't prevent whispers to leak in excerpts (CVSS 4.9, discourse)
- [CVE-2026-27151](https://cve.now/CVE-2026-27151.md): Discourse doesn't validate destination topic when moving posts (CVSS 1.3, discourse)
- [CVE-2026-27150](https://cve.now/CVE-2026-27150.md): Discourse doesn't ensure guardian check when creating QueryGroupBookmark (CVSS 1.3, discourse)
- [CVE-2026-27149](https://cve.now/CVE-2026-27149.md): Discourse has SQL injection in PM tag filtering (CVSS 4.9, discourse)
- [CVE-2026-27021](https://cve.now/CVE-2026-27021.md): Discourse: Poll voters endpoint lacked post visibility checks (CVSS 6.9, discourse)
- [CVE-2026-23939](https://cve.now/CVE-2026-23939.md): Path Traversal in Local File Store Backend (CVSS 6.9, hexpm)
- [CVE-2026-26979](https://cve.now/CVE-2026-26979.md): Discourse: TL4 users are able to change status of restricted topics (CVSS 0.0, discourse)
- [CVE-2026-1565](https://cve.now/CVE-2026-1565.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.2.8 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, wedevs User Frontend: AI Powered Frontend Posting, User Dir…)
- [CVE-2026-1241](https://cve.now/CVE-2026-1241.md): Authentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP Cameras (CVSS 8.7, Pelco Sarix Professional IMP 3 Series · Pelco Sarix Prof… +2)
- [CVE-2026-26973](https://cve.now/CVE-2026-26973.md): Discourse doesn't scope reviewable notes to user-visible reviewables (CVSS 4.3, discourse)
- [CVE-2026-27510](https://cve.now/CVE-2026-27510.md): Unitree Go2 Mobile Program Tampering Enables Root RCE (CVSS 6.4, UnitreeRobotics Unitree Go2)
- [CVE-2026-27509](https://cve.now/CVE-2026-27509.md): Unitree Go2 Missing DDS Authentication Enables Adjacent RCE (CVSS 8.5, UnitreeRobotics Unitree Go2)
- [CVE-2026-27141](https://cve.now/CVE-2026-27141.md): Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net (CVSS 7.5, golang.org/x/net/http2 · golang.org/x/net)
- [CVE-2026-22722](https://cve.now/CVE-2026-22722.md): VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash (CVSS 6.1, VMware Workstation)
- [CVE-2026-22715](https://cve.now/CVE-2026-22715.md): VMware Workstation/Fusion NAT vulnerability (CVSS 5.9, VMware Workstation · VMware Fusion)
- [CVE-2026-26938](https://cve.now/CVE-2026-26938.md): Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) (CVSS 8.6, Elastic Kibana)
- [CVE-2026-26937](https://cve.now/CVE-2026-26937.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-26227](https://cve.now/CVE-2026-26227.md): VLC for Android \< 3.7.0 Remote Access OTP Authentication Bypass (CVSS 6.3, VideoLAN VLC for Android)
- [CVE-2026-23750](https://cve.now/CVE-2026-23750.md): Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow (CVSS 7.2, Golioth Pouch)
- [CVE-2026-23749](https://cve.now/CVE-2026-23749.md): Golioth Firmware SDK \< 0.22.0 Blockwise Transfer Path Out-of-Bounds Read (CVSS 2.1, Golioth Firmware SDK)
- [CVE-2026-23748](https://cve.now/CVE-2026-23748.md): Golioth Firmware SDK \< 0.22.0 LightDB State Out-of-Bounds Read (CVSS 6.3, Golioth Firmware SDK)
- [CVE-2026-23747](https://cve.now/CVE-2026-23747.md): Golioth Firmware SDK \< 0.22.0 Payload Utils Stack-based Buffer Overflow (CVSS 6.3, Golioth Firmware SDK)
- [CVE-2026-26936](https://cve.now/CVE-2026-26936.md): Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service (CVSS 4.9, Elastic Kibana)
- [CVE-2026-26935](https://cve.now/CVE-2026-26935.md): Improper Input Validation in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-26934](https://cve.now/CVE-2026-26934.md): Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-26932](https://cve.now/CVE-2026-26932.md): Improper Validation of Array Index in Packetbeat Leading to Denial of Service (CVSS 5.7, Elastic Packetbeat)
- [CVE-2026-28295](https://cve.now/CVE-2026-28295.md): Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-26228](https://cve.now/CVE-2026-26228.md): VLC for Android \< 3.7.0 Remote Access Path Traversal (CVSS 2.3, VideoLAN VLC for Android)
- [CVE-2026-28296](https://cve.now/CVE-2026-28296.md): Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-26265](https://cve.now/CVE-2026-26265.md): Discourse has IDOR vulnerability in the directory items endpoint (CVSS 7.5, discourse)
- [CVE-2026-26207](https://cve.now/CVE-2026-26207.md): DIscourse's discourse-policy plugin lacks post access check (CVSS 5.4, discourse)
- [CVE-2026-26078](https://cve.now/CVE-2026-26078.md): Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint (CVSS 7.5, discourse)
- [CVE-2026-26077](https://cve.now/CVE-2026-26077.md): Discourse doesn't ensure webhooks require a token (CVSS 6.5, discourse)
- [CVE-2026-3071](https://cve.now/CVE-2026-3071.md): Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code executi (CVSS 8.4, Flair)
- [CVE-2026-2244](https://cve.now/CVE-2026-2244.md): Sensitive Data Exposure in Google Cloud Vertex AI Workbench (CVSS 8.4, Google Cloud Vertex AI Workbench)
- [CVE-2026-2680](https://cve.now/CVE-2026-2680.md): Multiple vulnerabilities in A3factura software (CVSS 4.8, A3factura)
- [CVE-2026-2679](https://cve.now/CVE-2026-2679.md): Multiple vulnerabilities in A3factura software (CVSS 4.8, A3factura)
- [CVE-2026-2678](https://cve.now/CVE-2026-2678.md): Multiple vulnerabilities in A3factura software (CVSS 4.8, A3factura)
- [CVE-2026-2677](https://cve.now/CVE-2026-2677.md): Multiple vulnerabilities in A3factura software (CVSS 4.8, A3factura)
- [CVE-2025-14343](https://cve.now/CVE-2025-14343.md): Reflected XSS in Dokuzsoft Technology's E-Commerce Product (CVSS 7.6, Dokuzsoft Technology E-Commerce Product)
- [CVE-2026-1198](https://cve.now/CVE-2026-1198.md): SQL Injection in SIMPLE.ERP (CVSS 8.6, Simple SA Simple.ERP)
- [CVE-2025-64999](https://cve.now/CVE-2025-64999.md): Cross-site scripting in HTML logs of Synthetic Monitoring test services (CVSS 7.3, Checkmk)
- [CVE-2026-28138](https://cve.now/CVE-2026-28138.md): WordPress uListing plugin \<= 2.2.0 - PHP Object Injection vulnerability (CVSS 7.2, Stylemix uListing)
- [CVE-2026-28136](https://cve.now/CVE-2026-28136.md): WordPress WP SMS plugin \<= 6.9.12 - SQL Injection vulnerability (CVSS 7.6, VeronaLabs WP SMS)
- [CVE-2026-28132](https://cve.now/CVE-2026-28132.md): WordPress WooCommerce Photo Reviews plugin \<= 1.4.4 - Content Injection vulnerability (CVSS 5.3, villatheme WooCommerce Photo Reviews)
- [CVE-2026-28131](https://cve.now/CVE-2026-28131.md): WordPress Elementor Addon Elements plugin \<= 1.14.4 - Sensitive Data Exposure vulnerability (CVSS 6.5, WPVibes Elementor Addon Elements)
- [CVE-2026-28083](https://cve.now/CVE-2026-28083.md): WordPress Flatsome theme \<= 3.20.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, UX-themes Flatsome)
- [CVE-2026-1698](https://cve.now/CVE-2026-1698.md): HTTP Host header vulnerability in WebClient and WebScheduler web apps (CVSS 5.3, arcinfo PcVue)
- [CVE-2026-1697](https://cve.now/CVE-2026-1697.md): Use of unsecure cookies for GraphicalData web service and WebClient web app (CVSS 5.3, arcinfo PcVue)
- [CVE-2026-1696](https://cve.now/CVE-2026-1696.md): Missing security HTTP headers (CVSS 2.3, arcinfo PcVue)
- [CVE-2026-1695](https://cve.now/CVE-2026-1695.md): XSS vulnerability upon unsuccessful authentication (CVSS 5.3, arcinfo PcVue)
- [CVE-2026-1694](https://cve.now/CVE-2026-1694.md): Server configuration details in HTTP headers (CVSS 2.3, arcinfo PcVue)
- [CVE-2026-1693](https://cve.now/CVE-2026-1693.md): Use of vulnerable Resource Owner Password Credentials flow (CVSS 5.3, arcinfo PcVue)
- [CVE-2026-1692](https://cve.now/CVE-2026-1692.md): Missing origin validation in GraphicalData web service requests (CVSS 5.3, arcinfo PcVue)
- [CVE-2026-25191](https://cve.now/CVE-2026-25191.md): The installer of FinalCode Client provided by Digital Arts Inc. (CVSS 7.8, Digital Arts FinalCode Ver.5 series · Digital Arts FinalCod…)
- [CVE-2026-23703](https://cve.now/CVE-2026-23703.md): The installer of FinalCode Client provided by Digital Arts Inc. (CVSS 7.8, Digital Arts FinalCode Ver.5 series · Digital Arts FinalCod…)
- [CVE-2026-1311](https://cve.now/CVE-2026-1311.md): Worry Proof Backup \<= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload (CVSS 8.8, bearsthemes Worry Proof Backup)
- [CVE-2026-27465](https://cve.now/CVE-2026-27465.md): Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users (CVSS 1.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-25963](https://cve.now/CVE-2026-25963.md): Fleet: Authorization Bypass in certificate template batch deletion for team administrators (CVSS 1.2, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-23999](https://cve.now/CVE-2026-23999.md): Fleet: Device lock PIN can be predicted if lock time is known (CVSS 0.6, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-24004](https://cve.now/CVE-2026-24004.md): Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint (CVSS 1.7, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-27975](https://cve.now/CVE-2026-27975.md): Ajenti has a potential Remote Code Execution (CVSS 8.1, ajenti · aj)
- [CVE-2026-1779](https://cve.now/CVE-2026-1779.md): User Registration & Membership \<= 5.1.2 - Authentication Bypass (CVSS 8.1, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-2356](https://cve.now/CVE-2026-2356.md): User Registration & Membership \<= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion (CVSS 5.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-27974](https://cve.now/CVE-2026-27974.md): Audiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player) (CVSS 4.8, advplyr audiobookshelf-app)
- [CVE-2026-27963](https://cve.now/CVE-2026-27963.md): Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata (CVSS 4.8, advplyr audiobookshelf)
- [CVE-2026-27973](https://cve.now/CVE-2026-27973.md): Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App) (CVSS 4.0, advplyr audiobookshelf · advplyr audiobookshelf-app)
- [CVE-2026-27970](https://cve.now/CVE-2026-27970.md): Angular i18n vulnerable to Cross-Site Scripting (XSS) (CVSS 7.6, angular · @angular/core)
- [CVE-2026-27968](https://cve.now/CVE-2026-27968.md): Packistry accepts expired access tokens (CVSS 4.3, packistry)
- [CVE-2026-27966](https://cve.now/CVE-2026-27966.md): Langflow has Remote Code Execution in CSV Agent (CVSS 9.8, langflow-ai langflow · langflow)
- [CVE-2026-27969](https://cve.now/CVE-2026-27969.md): Vitess users with backup storage access can write to arbitrary file paths on restore (CVSS 9.3, vitessio vitess · vitess.io/vitess)
- [CVE-2026-27965](https://cve.now/CVE-2026-27965.md): Vitess users with backup storage access can gain unauthorized access to production deployment environments (CVSS 8.4, vitessio vitess · vitess.io/vitess)
- [CVE-2026-27959](https://cve.now/CVE-2026-27959.md): Koa has Host Header Injection via \`ctx.hostname\` (CVSS 7.5, koajs koa · koa)
- [CVE-2026-27954](https://cve.now/CVE-2026-27954.md): LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints (CVSS 4.9, livehelperchat)
- [CVE-2026-27961](https://cve.now/CVE-2026-27961.md): Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE (CVSS 8.8, Agenta-AI agenta · agenta)
- [CVE-2026-27952](https://cve.now/CVE-2026-27952.md): Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE) (CVSS 8.8, Agenta-AI agenta-api · agenta)
- [CVE-2026-27948](https://cve.now/CVE-2026-27948.md): Copyparty vulnerable to eflected cross-site scripting via setck parameter (CVSS 5.4, 9001 copyparty · copyparty)
- [CVE-2026-27943](https://cve.now/CVE-2026-27943.md): OpenEMR's Eye Exam View Trusts form\_id Without Verifying Patient/Encounter Ownership (CVSS 6.5, openemr)
- [CVE-2026-2499](https://cve.now/CVE-2026-2499.md): Custom Logo \<= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting (CVSS 4.4, tgrk Custom Logo)
- [CVE-2026-2029](https://cve.now/CVE-2026-2029.md): Livemesh Addons for Beaver Builder \<= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes (CVSS 6.4, Livemesh Addons for Beaver Builder)
- [CVE-2026-2489](https://cve.now/CVE-2026-2489.md): TP2WP Importer \<= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea (CVSS 4.4, readymadeweb TP2WP Importer)
- [CVE-2026-2498](https://cve.now/CVE-2026-2498.md): WP Social Meta \<= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (CVSS 4.4, bulktheme WP Social Meta)
- [CVE-2026-1557](https://cve.now/CVE-2026-1557.md): WP Responsive Images \<= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src (CVSS 7.5, stuartbates WP Responsive Images)
- [CVE-2026-2506](https://cve.now/CVE-2026-2506.md): EM Cost Calculator \<= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer\_name' (CVSS 6.1, motahar1 EM Cost Calculator)
- [CVE-2026-27942](https://cve.now/CVE-2026-27942.md): fast-xml-parser has stack overflow in XMLBuilder with preserveOrder (CVSS 2.7, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2026-27941](https://cve.now/CVE-2026-27941.md): OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of \`pull\_request\_target\` in GitHub Actions Workflows (CVSS 10.0, openlit)
- [CVE-2026-27938](https://cve.now/CVE-2026-27938.md): WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow (CVSS 7.7, wp-graphql)
- [CVE-2026-27904](https://cve.now/CVE-2026-27904.md): minimatch ReDoS: nested \*() extglobs generate catastrophically backtracking regular expressions (CVSS 7.5, isaacs minimatch · minimatch)
- [CVE-2026-27903](https://cve.now/CVE-2026-27903.md): minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (CVSS 7.5, isaacs minimatch · minimatch)
- [CVE-2026-27902](https://cve.now/CVE-2026-27902.md): Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers (CVSS 5.3, sveltejs svelte · svelte)
- [CVE-2026-27901](https://cve.now/CVE-2026-27901.md): Svelte vulnerable to XSS during SSR with contenteditable \`bind:innerText\` and \`bind:textContent\` (CVSS 5.3, sveltejs svelte · svelte)
- [CVE-2026-27887](https://cve.now/CVE-2026-27887.md): Spin has memory leaks in various WIT interfaces (CVSS 6.9, spinframework spin · spinframework SpinKube +1)
- [CVE-2026-27900](https://cve.now/CVE-2026-27900.md): Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure (CVSS 5.0, terraform-provider-linode · github.com/linode/terraform-… +2)
- [CVE-2026-22728](https://cve.now/CVE-2026-22728.md): sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations (CVSS 4.9, Bitnami sealed-secrets · github.com/bitnami-labs/sealed-sec…)
- [CVE-2026-27899](https://cve.now/CVE-2026-27899.md): WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update (CVSS 8.8, h44z wg-portal · github.com/h44z/wg-portal)
- [CVE-2026-27896](https://cve.now/CVE-2026-27896.md): MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity (CVSS 7.0, modelcontextprotocol go-sdk · github.com/modelcontextprotoc…)
- [CVE-2026-27830](https://cve.now/CVE-2026-27830.md): c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property (CVSS 8.9, swaldman c3p0 · com.mchange:c3p0)
- [CVE-2026-27888](https://cve.now/CVE-2026-27888.md): pypdf: Manipulated FlateDecode XFA streams can exhaust RAM (CVSS 6.6, py-pdf pypdf · pypdf)
- [CVE-2026-27884](https://cve.now/CVE-2026-27884.md): NetExec vulnerable to arbitrary file write via path traversal in spider\_plus module (CVSS 5.3, Pennyw0rth NetExec)
- [CVE-2026-27829](https://cve.now/CVE-2026-27829.md): Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize (CVSS 6.5, withastro astro · @astrojs/node)
- [CVE-2026-27946](https://cve.now/CVE-2026-27946.md): ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API (CVSS 8.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-27945](https://cve.now/CVE-2026-27945.md): ZITADEL has potential SSRF via Actions (CVSS 2.1, zitadel · github.com/zitadel/zitadel/v2 +1)
- [CVE-2026-27840](https://cve.now/CVE-2026-27840.md): ZITADEL's truncated opaque tokens are still valid (CVSS 4.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-27837](https://cve.now/CVE-2026-27837.md): Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform() (CVSS 6.3, mickhansen dottie.js · dottie)
- [CVE-2026-27831](https://cve.now/CVE-2026-27831.md): rldns Vulnerable to Heap-based Out-of-Bounds Read (CVSS 7.5, bluedragonsecurity rldns)
- [CVE-2026-27821](https://cve.now/CVE-2026-27821.md): GPAC NHML Demuxer (dmx\_nhml.c) Vulnerable to Stack Buffer Overflow (CVSS 7.7, gpac)
- [CVE-2026-26186](https://cve.now/CVE-2026-26186.md): Fleet has a SQL injection via backtick escape in ORDER BY parameter (CVSS 5.1, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-27818](https://cve.now/CVE-2026-27818.md): TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist (CVSS 8.7, terriajs-server)
- [CVE-2026-27812](https://cve.now/CVE-2026-27812.md): Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover (CVSS 8.0, Wei-Shaw sub2api)
- [CVE-2025-50857](https://cve.now/CVE-2025-50857.md): ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. (CVSS 9.8)
- [CVE-2025-56605](https://cve.now/CVE-2025-56605.md): A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0 (CVSS 5.4)
- [CVE-2025-71057](https://cve.now/CVE-2025-71057.md): Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME\_1.00 allows attackers to execute a session hijacking att (CVSS 8.2)
- [CVE-2026-26682](https://cve.now/CVE-2026-26682.md): An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.