Skip to content
OpenAdvisories

Archive

10 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /10 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-26009

    Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution

    Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerizat…

    karutoil catalyst
  • Critical 9.8
    CVE-2026-21531 Public exploit

    Azure SDK for Python Remote Code Execution Vulnerability

    Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

    Microsoft Azure AI Language Authoring azure-ai-language-conversations-authoring PyPI
  • Critical 9.3
    CVE-2026-25993 Public exploit

    EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

    EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes th…

    evershopcommerce evershop
  • Critical 9.3
    CVE-2026-25728

    ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition

    ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to…

    MacWarrior clipbucket-v5
  • Critical 9.8
    CVE-2026-1774

    CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

    CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

    CASL Ability CASL Ability @casl/ability npm
  • Critical 9.8
    CVE-2026-23906

    Apache Druid: Authentication Bypass via LDAP Anonymous Bind

    Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind    …

    Apache Software Foundation Apache Druid org.apache.druid.extensions:druid-basic-security Maven
  • Critical 9.8
    CVE-2025-11242

    SSRF in Teknolist Computer's Okulistik

    Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request Forgery. This issue affects Okulistik: through 21102025.

    Teknolist Computer Systems Software Publishing Industry and Trade Okulistik
  • Critical 9.8
    CVE-2026-2096

    Flowring｜Agentflow - Missing Authenticaton

    Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.

    Flowring Agentflow
  • Critical 9.8
    CVE-2026-2095

    Flowring｜Agentflow - Authentication Bypass

    Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

    Flowring Agentflow
  • Critical 9.6
    CVE-2026-0509

    Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and avail…

    SAP SAP NetWeaver Application Server ABAP and ABAP Platform
  • Critical 9.9
    CVE-2026-0488

    Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)

    An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a…

    SAP SAP CRM and SAP S/4HANA (Scripting Editor)