CVEs published February 21, 2026

Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images.

Custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner…

Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint.

Certain endpoints lacked access validation which allowed for unauthorized document access.

Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another…

Versions 1.1.2-alpha and below render untrusted user/model content in chat tool UI surfaces using unsafe HTML interpolation patterns, leading to XSS.

A weakness has been identified in Tenda A21 1.0.0.0.

A security flaw has been discovered in D-Link DWR-M960 1.01.07.

A vulnerability was identified in D-Link DWR-M960 1.01.07.

A vulnerability was determined in D-Link DWR-M960 1.01.07.

A vulnerability was found in D-Link DWR-M960 1.01.07.

A vulnerability has been found in D-Link DWR-M960 1.01.07.

A vulnerability has been found in Tenda A18 15.13.07.13.

A vulnerability was determined in Tenda A18 15.13.07.13.

A flaw has been found in Tenda A21 1.0.0.0.

A vulnerability was detected in Tenda A21 1.0.0.0.

A security vulnerability has been detected in Tenda A21 1.0.0.0.

A weakness has been identified in Tenda A21 1.0.0.0.

A security flaw has been discovered in Tenda A21 1.0.0.0.

There is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function.

The application fails to properly enforce role-based authorization during account creation.

All versions are vulnerable to Heap-based Buffer Overflow through the XWD parser's use of the bytes_per_line value.

All versions are vulnerable to Environment Variable Injection through the updateEnvFile function.

The library allows deserialization of PHP objects from JSON using a special @type field.

Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious…

Origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks…

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations.

Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability.

Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality.

Authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials.

When using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w ....

All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads.

All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/.

The Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests.

A vulnerability was determined in itsourcecode Vehicle Management System 1.0.

A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0.

Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks.

The official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service.

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection.

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing.

URL ingest allows overly permissive server-side fetch behavior and can be coerced into requesting unsafe targets.

Use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concurrent operations to lose updates or corrupt local state across…

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor.

A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097.

There is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields.

The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks.

Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection.

Thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default.

A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097.

A flaw has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097.

Versions 2.4.2 and below have a Stored Cross-site Scripting vulnerability through the Atom feed endpoint for lists (/lists/feed).

All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads.

A vulnerability was identified in funadmin up to 7.1.0-rc4.

A vulnerability was detected in Foswiki up to 2.1.10.

The process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process.

A timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames, enabling targeted brute-force or…

ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER).

The safe_join function allows Windows device names as filenames if preceded by other path segments.

All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in…

Email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls.

All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint.

Skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives.

The Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context.

When the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability.

The ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send.

A security flaw has been discovered in funadmin up to 7.1.0-rc4.

A vulnerability was detected in CCExtractor up to 0.96.5.

A security vulnerability has been detected in aardappel lobster up to 2025.4.

A vulnerability was identified in janet-lang janet up to 1.40.1.

When first joining a session with the microphone muted, the client sends audio to the server regardless of mute state.