Skip to content
OpenAdvisories

Archive

18 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /18 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.6
    CVE-2026-24126 Public exploit

    Weblate has an argument injection in management console

    Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, pro…

    WeblateOrg weblate weblate PyPI
  • Medium 4.8
    CVE-2026-25596 Public exploit

    InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject mali…

    InvoicePlane InvoicePlane
  • Medium 4.8
    CVE-2026-25595 Public exploit

    InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject maliciou…

    InvoicePlane InvoicePlane
  • Medium 4.8
    CVE-2026-25594 Public exploit

    InvoicePlane has Stored XSS via Family Name in Product Form

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML enco…

    InvoicePlane InvoicePlane
  • Medium 4.7
    CVE-2026-1277 Public exploit Scanner template

    URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter

    The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated at…

    KaizenCoders URL Shortify – Simple and Easy URL Shortener Web / CMS
  • Medium 6.1
    CVE-2026-1296 Public exploit Scanner template

    Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter

    The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This m…

    WP Shuffle Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin Web / CMS