Skip to content
OpenAdvisories

Archive

5 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /5 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Low 3.7
    CVE-2025-68157

    webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects

    Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x …

    webpack webpack langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2025-68458

    webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

    Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo…

    webpack webpack langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Low 3.5
    CVE-2026-1970

    Edimax BR-6258n formStaDrvSetup redirect

    A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of the argument submit-url causes open redirect. The attack can be initiated remotely. The exploit has …

    Edimax BR-6258n
  • Low 3.2
    CVE-2026-25815

    Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as ex…

    Fortinet FortiOS Network devices
  • Low 2.7
    CVE-2025-15321

    Tanium addressed an improper input validation vulnerability in Tanium Appliance.

    Tanium addressed an improper input validation vulnerability in Tanium Appliance.

    Tanium Tanium Appliance
  • Low 3.7
    CVE-2025-15323

    Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.

    Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.

    Tanium Tanium Appliance
  • Low 3.1
    CVE-2025-15289

    Tanium addressed an improper access controls vulnerability in Interact.

    Tanium addressed an improper access controls vulnerability in Interact.

    Tanium Interact
  • Low 3.5
    CVE-2020-37148

    P5 FNIP-8x16A/FNIP-4xSH 1.0.20, 1.0.11 - Stored Cross-Site Scripting (XSS)

    P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not properly sanitized before being returned to the user, allowing attackers to execute arbitrary HTML a…

    P5 FNIP-8x16A FNIP-4xSH
  • Low 3.5
    CVE-2020-37118

    P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)

    P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interaction. Attackers can craft malicious web pages to add new admin users, change passwords, and modify s…

    P5 FNIP-8x16A
  • Low 2.4
    CVE-2026-1966

    YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

    YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory se…

    YugabyteDB YugabyteDB Anywhere