Skip to content
OpenAdvisories

Archive

22 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /22 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-2957

    qinming99 dst-admin File BackupController.java deleteBackup denial of service

    A weakness has been identified in qinming99 dst-admin up to 1.5.0. This impacts the function deleteBackup of the file src/main/java/com/tugos/dst/admin/controller/BackupController.java of the component File Handler. This manipulation causes denial of service.…

    qinming99 dst-admin
  • Medium 6.3
    CVE-2026-2956

    qinming99 dst-admin restore revertBackup command injection

    A security flaw has been discovered in qinming99 dst-admin up to 1.5.0. This affects the function revertBackup of the file /home/restore. The manipulation of the argument Name results in command injection. The attack can be launched remotely. The exploit has …

    qinming99 dst-admin
  • Medium 6.3
    CVE-2026-2954

    Dromara UJCMS ImportDataController import-channel importChanel injection

    A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in in…

    dromara UJCMS
  • Medium 5.4
    CVE-2026-2953

    Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal

    A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from …

    dromara UJCMS
  • Medium 6.3
    CVE-2026-2945

    JeecgBoot uploadImgByHttp server-side request forgery

    A weakness has been identified in JeecgBoot 3.9.0. Affected by this vulnerability is an unknown functionality of the file /sys/common/uploadImgByHttp. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack may be …

  • Medium 4.3
    CVE-2026-2943

    SapneshNaik Student Management System index.php cross site scripting

    A vulnerability was identified in SapneshNaik Student Management System up to f4b4f0928f0b5551a28ee81ae7e7fe47d9345318. This impacts an unknown function of the file index.php. Such manipulation of the argument Error leads to cross site scripting. The attack c…

    SapneshNaik Student Management System
  • Medium 5.3
    CVE-2026-2385

    The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay

    The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plug…

    posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Web / CMS
  • Medium 6.3
    CVE-2026-2930

    Tenda A18 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflow

    A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. Such manipulation of the argument boundary leads to stack-based buffer overflow. T…

    Tenda A18
  • Medium 4.3
    CVE-2026-1369

    Conditional CAPTCHA <= 4.0.0 - Open Redirect

    The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue

    Web / CMS
  • Medium 5.5
    CVE-2026-2898 Public exploit

    funadmin Backend Endpoint AuthCloudService.php getMember deserialization

    A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserializatio…

    funadmin/funadmin Packagist