Skip to content
OpenAdvisories

Archive

21 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /21 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2026-27579 Public exploit

    CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure

    CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An…

    karnop realtime-collaboration-platform
  • Critical 10.0
    CVE-2026-27574 Public exploit

    OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

    OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing triv…

    OneUptime oneuptime @oneuptime/common npm
  • High 8.8
    CVE-2026-27470 Public exploit

    ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

    ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu Alpine
  • Critical 9.4
    CVE-2026-27212 Public exploit

    Swiper has a Prototype Pollution Vulnerability

    Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function …

    nolimits4web swiper swiper npm
  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI