CVEs published February 23, 2026
77,396 CVEs in 2026
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint…
Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a…
Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.
A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114.
A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114.
A vulnerability was found in UTT HiPER 810G up to 1.7.7-1711.
A vulnerability was found in D-Link DWR-M960 1.01.07.
A vulnerability has been found in D-Link DWR-M960 1.01.07.
A flaw has been found in D-Link DWR-M960 1.01.07.
A vulnerability was detected in D-Link DWR-M960 1.01.07.
A security vulnerability has been detected in D-Link DWR-M960 1.01.07.
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.
Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by…
Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.
ERP developed by eAI Technologies has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a crafted DLL file in the same directory as the program, thereby executing arbitrary code.
The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses deprecated .NET Remoting TCP channels that allow…
Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.
A malicious actor with network access to Valkey can cause the system to abort by triggering an assertion.
8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing.
A vulnerability has been found in erzhongxmu JEEWMS 3.7.
A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0.
A vulnerability was determined in SourceCodester Student Result Management System 1.0.
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect…
Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability.
A vulnerability has been found in UTT HiPER 810G up to 1.7.7-1711.
A vulnerability was identified in SourceCodester Student Result Management System 1.0.
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality.
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path.
A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0.
A flaw has been found in FastApiAdmin up to 2.2.0.
A vulnerability was detected in FastApiAdmin up to 2.2.0.
A security vulnerability has been detected in FastApiAdmin up to 2.2.0.
A vulnerability was determined in Jinher OA C6 up to 20260210.
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface.
Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is…
Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.
Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page…
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.
Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Jeff Starr Simple Ajax Chat simple-ajax-chat allows Retrieve Embedded Sensitive Data.This issue affects Simple…
A security flaw has been discovered in FastApiAdmin up to 2.2.0.
Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple administrative AJAX actions.
A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1.
A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6.
A flaw has been found in datapizza-labs datapizza-ai 0.0.2.
A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2.
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7.
A vulnerability was found in erzhongxmu JEEWMS up to 3.7.
A weakness has been identified in FastApiAdmin up to 2.2.0.
A vulnerability was found in a466350665 Smart-SSO up to 2.1.1.
Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints.
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface.
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface.
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could…
A vulnerability was detected in Cesanta Mongoose up to 7.20.
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
A weakness has been identified in Cesanta Mongoose up to 7.20.
A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS.
A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20.
A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1.
A security flaw has been discovered in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.9.