Skip to content
OpenAdvisories

Archive

18 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /18 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-25548 Public exploit

    InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An aut…

    InvoicePlane InvoicePlane
  • Critical 9.8
    CVE-2026-27180 Public exploit

    MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning

    MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without …

    sergejey MajorDoMo
  • Critical 9.8
    CVE-2026-27174 Public exploit Scanner template

    MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

    MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, all…

    sergejey MajorDoMo
  • Critical 9.8
    CVE-2026-27175 Public exploit Scanner template EPSS 24%

    MajorDoMo Command Injection in rc/index.php via Race Condition

    MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command…

    sergejey MajorDoMo
  • Critical 9.3
    CVE-2026-23491 Public exploit Scanner template

    InvoicePlane has Unauthenticated Path Traversal in Guest Controller

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The …

    InvoicePlane InvoicePlane
  • Critical 9.3
    CVE-2026-2329 Public exploit EPSS 42%

    Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow

    An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target dev…

    Grandstream GXP1625 GXP1620 GXP1628
  • Critical 9.8
    CVE-2025-65791 Public exploit

    ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user …

    zoneminder zoneminder Debian Ubuntu
  • Critical 9.8
    CVE-2025-70149 Public exploit

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID param…