# CVEs published 2026-02-28

16 CVEs were published on February 28, 2026: 2 critical, 6 high. Days are UTC.

- [CVE-2026-3377](https://cve.now/CVE-2026-3377.md): Tenda F453 SafeUrlFilter fromSafeUrlFilter buffer overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-3376](https://cve.now/CVE-2026-3376.md): Tenda F453 SafeMacFilter fromSafeMacFilter buffer overflow (CVSS 8.7, Tenda F453)
- [CVE-2026-28562](https://cve.now/CVE-2026-28562.md): wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter (CVSS 8.8, gVectors Team wpForo Forum)
- [CVE-2026-28561](https://cve.now/CVE-2026-28561.md): wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates (CVSS 4.8, gVectors Team wpForo Forum)
- [CVE-2026-28560](https://cve.now/CVE-2026-28560.md): wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script (CVSS 4.8, gVectors Team wpForo Forum)
- [CVE-2026-28559](https://cve.now/CVE-2026-28559.md): wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed (CVSS 6.9, gVectors Team wpForo Forum)
- [CVE-2026-28558](https://cve.now/CVE-2026-28558.md): wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload (CVSS 5.1, gVectors Team wpForo Forum)
- [CVE-2026-28557](https://cve.now/CVE-2026-28557.md): wpForo Forum \< 2.4.16 Privilege Escalation via Role Synchronization Handler (CVSS 7.1, gVectors Team wpForo Forum)
- [CVE-2026-28556](https://cve.now/CVE-2026-28556.md): wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers (CVSS 5.3, gVectors Team wpForo Forum)
- [CVE-2026-28555](https://cve.now/CVE-2026-28555.md): wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler (CVSS 5.3, gVectors Team wpForo Forum)
- [CVE-2026-28554](https://cve.now/CVE-2026-28554.md): wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler (CVSS 5.3, gVectors Team wpForo Forum)
- [CVE-2026-3010](https://cve.now/CVE-2026-3010.md): TimePictra Stored Cross-Site Scripting (CVSS 9.3, Microchip TimePictra)
- [CVE-2026-2844](https://cve.now/CVE-2026-2844.md): TimePictra Authentication Bypass Vulnerability (CVSS 9.3, Microchip TimePictra)
- [CVE-2025-13673](https://cve.now/CVE-2025-13673.md): Tutor LMS \<= 3.9.6 - Unauthenticated SQL Injection via coupon\_code (CVSS 7.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-2471](https://cve.now/CVE-2026-2471.md): WP Mail Logging \<= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field (CVSS 7.5, smub WP Mail Logging)
- [CVE-2026-1542](https://cve.now/CVE-2026-1542.md): Super Stage WP \<= 1.0.1 - Unauthenticated PHP Object Injection (CVSS 6.5, Super Stage WP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.