Skip to content
OpenAdvisories

Archive

17 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /17 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

103 results · Feed

  • Medium 4.3
    CVE-2026-2608

    Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization

    The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for authenticated att…

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • High 8.7
    CVE-2026-25903

    Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates

    Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges requ…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-web-api Maven
  • High 7.2
    CVE-2026-1216

    RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter

    The RSS Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'template' parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This make…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 5.8
    CVE-2026-0829 Scanner template

    Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending

    The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attacke…

    Web / CMS
  • Medium 5.3
    CVE-2026-1657 Public exploit

    EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

    The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implemen…

    Metagauss EventPrime – Events Calendar, Bookings and Tickets Web / CMS
  • Medium 4.4
    CVE-2026-2002 Public exploit

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and outpu…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.7
    CVE-2026-2592

    Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update

    The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to valid…

    zarinpal Zarinpal Gateway Web / CMS
  • Critical 9.3
    CVE-2026-26220

    LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

    LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() …

    ModelTC LightLLM
  • High 8.8
    CVE-2024-55270 Public exploit

    phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdat…

  • Low 3.5
    CVE-2024-55271 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This iss…

  • High 8.7
    CVE-2025-67905

    Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in whic…

  • High 7.6
    CVE-2025-67102

    A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to exe…

  • Critical 9.9
    CVE-2025-59793

    Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authentic…

  • High 7.3
    CVE-2025-32355 Scanner template

    Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is…

  • High 7.5
    CVE-2025-65753 Public exploit

    An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as …

  • High 7.2
    CVE-2025-70397

    jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.

  • Critical 9.9
    CVE-2025-70830 Public exploit

    A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows au…

  • High 7.1
    CVE-2025-70846

    lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field pas…

  • High 8.8
    CVE-2025-70828 Public exploit

    An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configurati…

  • Medium 5.7
    CVE-2025-70829 Public exploit

    An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via…

  • High 8.8
    CVE-2026-26736

    TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 p…

  • High 8.0
    CVE-2026-26731

    TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`para…

  • High 8.8
    CVE-2026-26732

    TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPa…