Skip to content
OpenAdvisories

Archive

13 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /13 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-26273

    Known affected by Account Takeover via Password Reset Token Leakage

    Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows an…

    idno known idno/known Packagist
  • Critical —
    GHSA-p5vf-5754-x7p3

    `polymarket-client-sdks` was removed from crates.io for malicious code

    It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`sdks` vs `sdk`) and attempting to steal credentials from local files. The malicious crate had 1 version published on 2026-02-09 and had …

    polymarket-client-sdks crates.io
  • Critical 10.0
    CVE-2026-26333

    Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE

    Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatt…

    Calero VeraSMART
  • Critical 9.3
    CVE-2026-26335 Public exploit

    Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE

    Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a va…

    Calero VeraSMART
  • Critical 9.8
    CVE-2026-26190 Public exploit Scanner template EPSS 39%

    Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

    Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication…

    milvus-io milvus github.com/milvus-io/milvus Go
  • Critical 9.8
    CVE-2026-26221 Public exploit

    Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE

    Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/…

    Hyland OnBase Workflow Timer Service
  • Critical 9.8
    CVE-2026-23112

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-69633

    A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through…

  • Critical 10.0
    CVE-2025-69770

    A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to exec…