Skip to content
OpenAdvisories

Archive

17 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /17 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.8
    CVE-2026-26119 Public exploit EPSS 11%

    Windows Admin Center Elevation of Privilege Vulnerability

    Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

    Microsoft Windows Admin Center Windows
  • Medium 6.5
    CVE-2026-24733 Public exploit

    Apache Tomcat: Security constraint bypass with HTTP/0.9

    Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET req…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-1657 Public exploit

    EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

    The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implemen…

    Metagauss EventPrime – Events Calendar, Bookings and Tickets Web / CMS
  • Medium 4.4
    CVE-2026-2002 Public exploit

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and outpu…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 8.8
    CVE-2024-55270 Public exploit

    phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdat…

  • Low 3.5
    CVE-2024-55271 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This iss…

  • High 7.5
    CVE-2025-65753 Public exploit

    An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as …

  • Critical 9.9
    CVE-2025-70830 Public exploit

    A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows au…

  • High 8.8
    CVE-2025-70828 Public exploit

    An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configurati…

  • Medium 5.7
    CVE-2025-70829 Public exploit

    An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via…