CVEs published February 11, 2026
77,396 CVEs in 2026
set-in provides the set value of nested associative structure given array of keys.
A buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.
Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.
An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.
METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication.
METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication.
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123.
manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution.
A race condition was addressed with improved handling of symbolic links.
Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML…
Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security…
Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A logic issue was addressed with improved checks.
An out-of-bounds write issue was addressed with improved bounds checking.
The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class.
The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function.
A stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.
A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.
A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1
Kanboard is project management software focused on Kanban methodology.
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code.
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator.
A memory corruption issue was addressed with improved state management.
A package validation issue was addressed by blocking the vulnerable package.
This issue was addressed with improved checks.
A path handling issue was addressed with improved validation.
A path handling issue was addressed with improved validation.
An out-of-bounds access issue was addressed with improved bounds checking.
This issue was addressed with improved handling of symlinks.
An out-of-bounds read issue was addressed with improved input validation.
Calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres).
A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled input.
An out-of-bounds write may be triggered when loading a specially crafted PSD image.
MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter.
Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object…
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication.
A path handling issue was addressed with improved logic.
The issue was addressed with improved memory handling.
A denial-of-service issue was addressed with improved validation.
A logging issue was addressed with improved data redaction.
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory.
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated…
There is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant.
A privacy issue was addressed with improved checks.
A permissions issue was addressed with additional restrictions.
This issue was addressed by removing the vulnerable code.
A flaw was found in BusyBox.
A flaw was found in BusyBox.
A race condition was addressed with improved state handling.
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service…
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed…
A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously…
A regular organization member can retrieve all ciphers within an organization, regardless of collection permissions.
Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML…
Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted…
Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
A path traversal vulnerability has been reported to affect File Station 6.
The issue was addressed with additional restrictions on the observability of app states.
The issue was addressed with improved memory handling.
The issue was addressed with improved memory handling.
The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU…
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of…
The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to,…
The Slideshow Wp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sswpid' attribute of the 'sswp-slide' shortcode in all versions up to, and including, 1.1.
The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all versions up to, and including, 1.1 due to insufficient input…
The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and including, 1.0.0 due to insufficient input…
The OpenPOS Lite – Point of Sale for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter of the order_qrcode shortcode in all versions up to, and…
The Microtango plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'restkey' parameter of the mt_reservation shortcode in all versions up to, and including, 0.9.29 due to insufficient…
The HTML Tag Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1 due to insufficient input sanitization and…
The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup-title' shortcode in all versions up to, and including, 1.3.6 due to insufficient…
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `js` Global Settings parameter in all versions up to, and including,…
A cross site scripting vulnerability has been found in the web application chat frontend when using echarts.
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter.
User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL.
Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging…
During the JSON import process, the value of attachments[].key from the imported JSON is passed directly to path.join(rootPath, node.key) and then read using fs.readFile without validation.
An authorization issue was addressed with improved state management.
The issue was addressed with improved bounds checks.
A parsing issue in the handling of directory paths was addressed with improved path validation.
An authorization issue was addressed with improved state management.
An authorization issue was addressed with improved state management.
The issue was addressed with improved memory handling.
A parsing issue in the handling of directory paths was addressed with improved path validation.
A privacy issue was addressed by moving sensitive data to a protected location.
This issue was addressed with improved data protection.
A logic issue was addressed with improved checks.
The issue was addressed with improved memory handling.
A permissions issue was addressed with additional restrictions.
A privacy issue was addressed with improved handling of temporary files.
An issue existed in the handling of environment variables.
A parsing issue in the handling of directory paths was addressed with improved path validation.
An injection issue was addressed with improved validation.
A permissions issue was addressed by removing the vulnerable code.
The issue was addressed with improved memory handling.
A logging issue was addressed with improved data redaction.
An issue was addressed with improved handling of temporary files.
A privacy issue was addressed with improved checks.
This issue was addressed through improved state management.
The issue was addressed with improved handling of caches.
TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description.
Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML…
Security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches.
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function…
A logic issue was addressed with improved state management.
This issue was addressed through improved state management.
A logic issue was addressed with improved checks.
The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1.
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
A privacy issue was addressed by removing sensitive data.
An authorization issue was addressed with improved state management.
An authorization issue was addressed with improved state management.
An inconsistent user interface issue was addressed with improved state management.
An inconsistent user interface issue was addressed with improved state management.
The issue was addressed with improved memory handling.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.
The issue was addressed with improved memory handling.
This issue was addressed with improved redaction of sensitive information.
The Category Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag-image' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output…
The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to insufficient input…
Users without permission to view assets are able are able to download them and view their metadata.
Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
The issue was addressed with improved memory handling.
The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and…
The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15.
GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user…
The RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL.
The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious…
A privacy issue was addressed with improved private data redaction for log entries.
The issue was resolved by sanitizing logging.
A logic issue was addressed with improved validation.
A logging issue was addressed with improved data redaction.
A permissions issue was addressed with additional restrictions.
A logic issue was addressed with improved checks.
An input validation issue was addressed.
An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even if the PAN-OS configuration would not normally…