Skip to content
OpenAdvisories

Archive

11 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /11 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.8
    CVE-2026-20700 Exploited Public exploit

    A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3…

    Apple macOS iOS and iPadOS watchOS macOS iOS
    KEV Feb 12, 2026
  • Medium 5.5
    CVE-2026-20660 Public exploit

    A path handling issue was addressed with improved logic. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers
  • Low 3.5
    CVE-2025-43537 Public exploit

    A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS …

    Apple iOS and iPadOS iOS
  • Critical 9.3
    CVE-2026-26215 Public exploit

    manga-image-translator Shared API Unsafe Deserialization RCE

    manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize atta…

    zyddnys manga-image-translator
  • Medium 6.5
    CVE-2026-26012 Public exploit

    vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

    vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphe…

    dani-garcia vaultwarden
  • High 8.1
    CVE-2026-25994 Public exploit

    PJSIP has a heap buffer overflow in ICE with long username

    PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 8.5
    CVE-2026-25924 Public exploit

    Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE

    Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly h…

    kanboard kanboard kanboard-cli python-kanboard Ubuntu
  • High 7.0
    CVE-2026-26157 Public exploit

    Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization

    A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead t…

    Red Hat Red Hat Enterprise Linux 6 Red Hat Hardened Images busybox Linux Debian Ubuntu Azure Linux Wolfi
  • High 8.8
    CVE-2026-1560 Public exploit EPSS 10%

    Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution

    The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Co…

    nko Custom Block Builder – Lazy Blocks Web / CMS
  • Critical 9.8
    CVE-2026-1357 Public exploit Scanner template EPSS 39%

    Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload

    The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS