Skip to content
OpenAdvisories

Archive

21 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /21 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-27574 Public exploit

    OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

    OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing triv…

    OneUptime oneuptime @oneuptime/common npm
  • Critical 9.2
    CVE-2026-27452

    ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer

    ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in…

    JonathanWilbur asn1-ts
  • Critical 9.3
    CVE-2026-27471

    ERP: Document access through endpoints due to missing validation

    ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.…

    Frappe Technologies erpnext
  • Critical 9.4
    CVE-2026-27212 Public exploit

    Swiper has a Prototype Pollution Vulnerability

    Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function …

    nolimits4web swiper swiper npm
  • Critical 9.1
    CVE-2026-27211

    Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse

    Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious guest can ove…

    cloud-hypervisor cloud-hypervisor cloud-hypervisor Azure Linux
  • Critical 9.1
    CVE-2026-27197

    Sentry: Improper Authentication on SAML SSO process allows user identity linking

    Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity …

    getsentry sentry sentry PyPI