Skip to content
OpenAdvisories

Archive

16 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /16 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-2439

    Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids

    Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand …

    BVA Concierge::Sessions
  • Critical 9.8
    CVE-2025-15578

    Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely

    Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

    TEEJAY Maypole
  • Critical 9.8
    CVE-2026-2550

    EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload

    A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made publi…

    EFM iptime A6004MX
  • Critical 10.0
    CVE-2026-2577

    Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge

    The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge …

    HKUDS nanobot