Skip to content
OpenAdvisories

Archive

3 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /3 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-24514 Public exploit

    ingress-nginx Admission Controller denial of service

    A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which m…

    Kubernetes ingress-nginx ingress-nginx-controller-1.12 k8s.io/ingress-nginx Wolfi Go
  • Medium 5.3
    CVE-2026-1801 Public exploit

    Libsoup: libsoup: http request smuggling via malformed chunk headers

    A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line fee…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-1814 Public exploit

    Rapid7 Nexpose Insecure Java Keystore Password Generation

    Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient le…

    Rapid7 InsightVM/Nexpose
  • Medium 5.4
    CVE-2026-1312 Public exploit

    Potential SQL injection via QuerySet.order_by and FilteredRelation

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansi…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 5.4
    CVE-2026-1207 Public exploit Scanner template EPSS 13%

    Potential SQL injection via raster lookups on PostGIS

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Medium 6.4
    CVE-2026-1210 Public exploit

    Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field

    The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, and including, 3.20.7 due to insufficient input sanitization and output escaping. This makes it possib…

    thehappymonster Happy Addons for Elementor Web / CMS
  • Medium 5.4
    CVE-2025-69848 Public exploit

    NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site sc…

  • Medium 6.1
    CVE-2025-70849 Public exploit

    Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

    Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Co…

    github.com/stefanprodan/podinfo Go
  • Medium 6.5
    CVE-2025-70559 Public exploit

    Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

    pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in …

    pdfminer-six pdfminer pdfminer Debian Ubuntu PyPI