Skip to content
OpenAdvisories

Archive

19 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /19 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-27475 Public exploit

    SPIP < 4.4.9 Insecure Deserialization

    SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another…

    SPIP SPIP spip spip Debian Ubuntu
  • High 7.5
    CVE-2026-1581 Public exploit Scanner template

    wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection

    The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi…

    Tomdever wpForo Forum Web / CMS
  • High 7.5
    CVE-2026-26336 Public exploit

    Hyland Alfresco Improper Authorization Arbitrary File Read

    Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.

    Hyland Alfresco Community Alfresco Enterprise
  • High 8.1
    CVE-2026-25940 Public exploit

    jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

    jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to on…

    parallax jsPDF opensearch-dashboards-3-dashboards-observability opensearch-dashboards-3-dashboards-reporting Wolfi npm
  • High 8.1
    CVE-2026-25755 Public exploit

    jsPDF has PDF Object Injection via Unsanitized Input in addJS Method

    jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string deli…

    parallax jsPDF opensearch-dashboards-3-dashboards-reporting opensearch-dashboards-3-dashboards-observability Wolfi npm
  • High 7.1
    CVE-2026-25232 Public exploit

    Gogs has a Protected Branch Deletion Bypass in Web Interface

    Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a dire…

    Gogs Gogs gogs.io/gogs Go
  • High 7.8
    CVE-2025-4960 Public exploit

    macOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer

    The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. It fails to properly authenticate clients over the XPC protocol and does …

    EPSON EPSON Printer Controller Installer