Skip to content
OpenAdvisories

Archive

20 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /20 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.6
    CVE-2026-2472 Public exploit

    Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

    Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaSc…

    Google Cloud Vertex AI SDK for Python google-cloud-aiplatform PyPI
  • Critical 9.3
    CVE-2025-69295 Public exploit

    WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injection.This issue affects Coven Core: from n/a through <= 1.3.

    TeconceTheme Coven Core
  • Critical 9.5
    CVE-2026-21627 Public exploit

    Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

    The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

    tassos.gr Smile Pack Novarain/Tassos Framework (plg_system_nrframework) EngageBox
  • Critical 9.3
    CVE-2026-26988 Public exploit

    LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processi…

    librenms librenms librenms/librenms Packagist
  • Critical 9.4
    CVE-2026-26980 Public exploit Scanner template EPSS 71%

    Ghost has a SQL Injection in its Content API

    Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

    TryGhost Ghost ghost npm
  • High 8.8
    CVE-2026-26746 Public exploit

    OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An att…