Skip to content
OpenAdvisories

Archive

6 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /6 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.4
    CVE-2025-68621 Public exploit

    Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

    Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticat…

    TriliumNext Trilium
  • High 7.5
    CVE-2026-25732 Public exploit

    NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

    NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames cont…

    zauberzeug nicegui nicegui PyPI
  • High 7.8
    CVE-2026-25731 Public exploit

    Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export

    calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template…

    Kovid Goyal calibre calibre calibre Debian Ubuntu
  • High 8.2
    CVE-2026-23989 Public exploit

    REVA Public Link Exploit

    REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiv…

    opencloud-eu reva github.com/opencloud-eu/reva github.com/opencloud-eu/reva/v2 Go
  • High 8.7
    CVE-2025-69214 Public exploit

    OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

    OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inje…

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 8.7
    CVE-2025-69216 Public exploit

    OpenSTAManager has an SQL Injection in Scadenzario Print Template

    OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template allows any authenticated user to …

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 8.7
    CVE-2026-24416 Public exploit

    OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

    OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application fails to …

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 8.7
    CVE-2026-24417 Public exploit

    OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

    OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properl…

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 8.7
    CVE-2026-24418 Public exploit

    OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module

    OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) mod…

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 8.7
    CVE-2026-24419 Public exploit

    OpenSTAManager has an SQL Injection in the Prima Nota module

    OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the Prima Nota (Journal Entry) module's add.php file. The application …

    devcode-it openstamanager devcode-it/openstamanager Packagist
  • High 7.2
    CVE-2026-24135 Public exploit

    Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitr…

    Gogs Gogs gogs.io/gogs Go
  • High 7.3
    CVE-2026-2058 Public exploit

    mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection

    A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /postquerypublic.php of the component Post Query Details Page. This manipulation of the argument gnam…

    mathurvishal CloudClassroom-PHP-Project