Skip to content
OpenAdvisories

Archive

17 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /17 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-1670

    Honeywell CCTV Products Missing Authentication for Critical Function

    The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.

    Honeywell SMB NDAA MVO-3 25M IPC I-HIB2PI-UL 2MP IP ICS / OT
  • Critical 10.0
    CVE-2026-22769 Exploited EPSS 13%

    Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. Th…

    Dell RecoverPoint for Virtual Machines
    KEV Feb 18, 2026
  • Critical 9.8
    CVE-2026-23647

    Glory RBG-100 Recycler System Hard-coded OS Credentials

    Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privilege…

    Glory Global Solutions RBG-100
  • Critical 9.6
    CVE-2026-22208

    OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access

    OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restri…

    OpenS100 Project OpenS100
  • Critical 9.3
    CVE-2026-26220

    LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

    LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() …

    ModelTC LightLLM
  • Critical 9.9
    CVE-2025-59793

    Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authentic…

  • Critical 9.9
    CVE-2025-70830 Public exploit

    A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows au…