Skip to content
OpenAdvisories

Archive

20 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /20 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

104 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-52387

    WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

    Liton Arefin Master Addons for Elementor
  • Medium 6.5
    CVE-2024-51915

    WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2024-54222

    WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.

    Seraphinite Solutions Seraphinite Accelerator
  • Medium 5.3
    CVE-2024-34438

    WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.

    Anssi Laitila Shared Files
  • Medium 5.3
    CVE-2024-43228

    WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

    SecuPress SecuPress Free
  • Medium 6.4
    CVE-2026-2486

    Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'

    The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it pos…

    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Web / CMS
  • Medium 6.5
    CVE-2025-59819

    Authenticated Arbitrary File Read via filepath parameter

    This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.

    Zenitel alphacom_xe_audio_server
  • Medium 6.1
    CVE-2026-26370

    WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulner…

    Ays Pro Survey Maker Web / CMS
  • Medium 6.3
    CVE-2026-2824 EPSS 17%

    Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection

    A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection.…

    Comfast CF-E7
  • Medium 6.3
    CVE-2026-2823 EPSS 19%

    Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection

    A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in com…

    Comfast CF-E7
  • Medium 5.3
    CVE-2026-2739

    bn.js affected by an infinite loop

    This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

    opensearch-dashboards-3 nextcloud-server-33 sqlpad reaper Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.3
    CVE-2026-2822

    JeecgBoot Backend airag_app,1,create_by sql injection

    A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads…

  • Medium 6.5
    CVE-2026-26994

    uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries

    uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. In versions 1.6.7 and below, uTLS did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4…

    refraction-networking utls nuclei github.com/refraction-networking/utls Debian Ubuntu Wolfi Go
  • Medium 4.6
    CVE-2026-26993

    Flare has XSS vulnerability in Raw File Preview

    Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG (or ot…

    FlintSH Flare
  • Medium 5.1
    CVE-2026-26992

    LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a…

    librenms librenms librenms/librenms Packagist
  • Medium 6.4
    CVE-2026-2384

    Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including, 6.7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    Ays Pro Quiz Maker Web / CMS
  • Medium 5.1
    CVE-2026-26991

    LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds…

    librenms librenms librenms/librenms Packagist
  • Medium 5.4
    CVE-2026-27016

    LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (n…

    librenms librenms librenms/librenms Packagist
  • Medium 6.3
    CVE-2026-2819

    Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization

    A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization.…

    dromara RuoYi-Vue-Plus
  • Medium 4.3
    CVE-2026-26989

    LibreNMS has Stored XSS in Alert Rule

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malic…

    librenms librenms librenms/librenms Packagist
  • Medium 5.3
    CVE-2026-26987

    LibreNMS affected by reflected XSS via email field

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.

    librenms librenms librenms/librenms Packagist
  • Medium 6.9
    CVE-2026-26977

    Frappe Learning Management System exposes details of unpublished courses to unauthorized users

    Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned fo…

    Frappe Technologies lms
  • Medium 6.1
    CVE-2025-67438

    Sync-in Server has a stored cross-site scripting (XSS) vulnerability

    A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and…

    @sync-in/server npm
  • Medium 5.3
    CVE-2026-26745

    OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration…