Skip to content
OpenAdvisories

Archive

17 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /17 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

51 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-2617

    Beetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource

    A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local n…

    Beetel 777VR1
  • Medium 6.5
    CVE-2024-31118

    WordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerability

    Missing Authorization vulnerability in Smartypants SP Project & Document Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Project & Document Manager: from n/a through 4.70.

    smartypants SP Project & Document Manager
  • Medium 6.5
    CVE-2022-41650

    WordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Country (by Shield Security): from n/a through 3.1.2.

    Paul Custom Content by Country (by Shield Security)
  • Medium 5.4
    CVE-2026-23861

    Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Ge…

    Dell Unisphere for PowerMax vApp,
  • Medium 6.1
    CVE-2025-7706

    Improper Access Control in TUBITAK BILGEM's Liderahenk

    Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion. This issue affects Liderahenk: from 3.0.0 to 3.3.1 before 3.5.0.

    TUBITAK BILGEM Software Technologies Research Institute Liderahenk
  • Medium 6.5
    CVE-2025-8303

    XSS in EKA Software's Real Estate Script V5 (With Doping Module – Store Module – New Language System)

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 (With Doping Module – Store Module – New Language System) allows Cro…

    EKA Software Computer Information Advertising Services Real Estate Script V5 (With Doping Module – Store Module – New Language System)
  • Medium 4.3
    CVE-2026-2608

    Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization

    The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for authenticated att…

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • Medium 5.8
    CVE-2026-0829 Scanner template

    Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending

    The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attacke…

    Web / CMS
  • Medium 5.3
    CVE-2026-1657 Public exploit

    EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

    The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implemen…

    Metagauss EventPrime – Events Calendar, Bookings and Tickets Web / CMS
  • Medium 4.4
    CVE-2026-2002 Public exploit

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and outpu…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Medium 5.7
    CVE-2025-70829 Public exploit

    An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via…