Skip to content
OpenAdvisories

Archive

11 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /11 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

131 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-13431

    SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter

    The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…

    VeronaLabs Slimstat Analytics Web / CMS
  • Medium 6.4
    CVE-2026-1231

    Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings

    The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `js` Global Settings parameter in all versions up to, and including, 2.10.0.5 due to missing capability checks on save_gl…

    Beaver Builder Beaver Builder Page Builder – Drag and Drop Website Builder Web / CMS
  • Medium 4.3
    CVE-2025-15524

    Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure

    The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versions up to, and including, 3.1.9. This makes it possible for authenticated attacke…

    FooPlugins Gallery by FooGallery Web / CMS
  • Medium 5.3
    CVE-2026-1571

    Reflected XSS Vulnerability on TP-Link Archer C60

    User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential the…

    TP-Link Systems Archer C60 v3 Network devices
  • Medium 4.3
    CVE-2024-50618

    A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 al…

  • Medium 5.3
    CVE-2024-26479

    An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Comman…

  • Medium 5.3
    CVE-2024-26478

    An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/u…

  • Medium 5.3
    CVE-2025-64074

    A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows…

  • Medium 6.5
    CVE-2025-65127

    A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remo…

  • Medium 5.4
    CVE-2025-70296

    A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticat…

  • Medium 6.1
    CVE-2025-70297

    A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.…