Archive
13 February 2026
Vulnerabilities first published on this day (UTC), newest first.
31 results · Clear filters · Feed
-
High 8.1
Caido has an insufficient patch for DNS rebind leading to RCE
Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: …
-
High 7.2
PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficie…
-
High 8.8
Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all vers…
-
High 7.2CVE-2026-1844 Public exploit
PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting
The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output …
-
High —
rPGP affected by crash in message handling for deeply nested messages
### Summary Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures. rPGP 0.19.0 resolves this issue with a more robust message handling imp…
-
High —
rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895
### Summary It was possible to trigger an unhandled edge case in the Rust Crypto rsa crate through rPGP packet parsing functionality, and crash the process that runs rPGP. This problem has been patched in a new rsa version. The new release of rPGP ensures a p…
-
High 8.5
Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials
Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. …
-
High —
Bug fixes in hpke-rs, hpke-rs-rust-crypto
We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes: ## hpke-rs - [#127](https://githu…
-
High 7.8
ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization
ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with Type…
-
High 8.1
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. Th…
-
High 7.7CVE-2026-25991 Public exploit
Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fa…
-
High 8.8
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code insid…
KEV Feb 17, 2026 -
High 7.8
BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The i…
-
High 7.5
BACnet Stack Improperly Limits Pathnames to a Restricted Directory
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attacke…
-
High 8.1CVE-2026-26268 Public exploit
Cursor sandbox escape via Git hooks
Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which m…
-
High 7.8CVE-2026-23111 Public exploit
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…
-
High 8.3
IDOR in Universal Sotware's FlexCity/Kiosk
Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc. FlexCity/Kiosk allows Exploitation of Trusted Identifiers. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.
-
High 8.8
Admin Account Takeover in Universal Sotware's FlexCity/Kiosk
Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc. FlexCity/Kiosk allows Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.
-
High 8.8
Business Logic Error in Universal Software's FlexCity/Kiosk
Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation. This issue affects FlexCity/Kios…
-
High 7.3
Apache Avro Java SDK: Code injection on Java generated code
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are re…
-
High 8.8CVE-2026-25108 Exploited
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in use…
KEV Feb 24, 2026 -
High 7.7
Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they …
-
High 7.5
A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial o…
-
High 7.5
A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. The issue exists in th…
-
High 7.4
An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.
-
High 7.5
A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025…
-
High 8.8
LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User ro…
-
High 7.5
A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems…
-
High 7.5
An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a de…
-
High 7.5
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a…
-
High 7.5
A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises…