Skip to content
OpenAdvisories

Archive

9 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /9 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-25895 Public exploit Scanner template EPSS 13%

    FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through ver…

    frangoteam FUXA fuxa-server npm
  • Critical 9.3
    CVE-2026-25939 Public exploit Scanner template EPSS 13%

    FUXA Unauthenticated Remote Arbitrary Scheduler Write

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing conne…

    frangoteam FUXA fuxa-server npm
  • Critical 9.5
    CVE-2026-25938 Public exploit

    FUXA Unauthenticated Remote Code Execution in Node-RED Integration

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is …

    frangoteam FUXA fuxa-server npm
  • High 7.5
    CVE-2026-25961 Public exploit

    SumatraPDF Update MITM -> Arbitrary Code Execution

    SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any vali…

    sumatrapdfreader sumatrapdf
  • High 8.1
    CVE-2026-25890 Public exploit

    File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

    File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the …

    filebrowser filebrowser filebrowser github.com/filebrowser/filebrowser/v2 Wolfi Go
  • Critical 9.1
    CVE-2026-25057 Public exploit

    Zip Slip in MarkUs config upload allowing RCE

    MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The upl…

    MarkUsProject Markus
  • High 8.1
    CVE-2026-1529 Public exploit

    Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

    A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attack…

    Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.9 Wolfi Maven
  • Medium 4.3
    CVE-2026-25916 Public exploit

    Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

    Roundcube Webmail roundcube roundcube Debian Ubuntu
  • Low 2.4
    CVE-2026-2222 Public exploit

    code-projects Online Reviewer System btn_functions.php cross site scripting

    A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/system/admins/manage/users/btn_functions.php. Executing a manipulation of the argument firstname can lea…

    code-projects Online Reviewer System