Skip to content
OpenAdvisories

Archive

18 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /18 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.2
    CVE-2026-27179 Public exploit

    MajorDoMo Unauthenticated SQL Injection in Commands Module

    MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parame…

    sergejey MajorDoMo
  • High 7.2
    CVE-2026-2670 Public exploit EPSS 14%

    Advantech WISE-6610-NB Background Management openvpn_apply os command injection

    A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_2025…

    Advantech WISE-6610P-DEA WISE-6610-JB WISE-6610P-DTA
  • High 7.1
    CVE-2026-1999 Public exploit

    Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests

    An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository without having push access by exploiting an authorization bypass in the enable_auto_merge mutation f…

    GitHub Enterprise Server
  • High 7.3
    CVE-2025-14340 Public exploit Scanner template

    Admin Account Takeover via malicious URL payload

    Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

    Payara Platform Payara Server
  • High 7.2
    CVE-2026-1937 Public exploit

    YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action

    The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `yaymail_import_state` AJAX action in all versions up to, and inc…

    YayCommerce YayMail – WooCommerce Email Customizer Web / CMS
  • High 7.5
    CVE-2026-2576 Public exploit

    Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter

    The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied par…

    Strategy11 Team Business Directory Plugin – Easy Listing Directories for WordPress Web / CMS