Skip to content
OpenAdvisories

Archive

24 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /24 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-22553 Public exploit

    InSAT MasterSCADA BUK-TS OS Command Injection

    All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

    InSAT MasterSCADA BUK-TS
  • High 8.8
    CVE-2026-22765 Public exploit

    Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged …

    Dell Wyse Management Suite
  • Critical 9.8
    CVE-2026-27507 Public exploit

    Binardat 10G08-0800GSM Network Switch Hard-coded Credentials

    Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative credentials that cannot be changed by users. Knowledge of these credentials allows full administrative access to the device.

    Binardat 10G08-0800GSM Network Switch
  • Medium 6.3
    CVE-2026-3102 Public exploit

    exiftool PNG File MacOS.pm SetMacOSTags os command injection

    A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command inject…

  • High 8.8
    CVE-2026-27483 Public exploit Scanner template EPSS 11%

    MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

    MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execut…

    MindsDB MindsDB mindsdb PyPI
  • Critical 9.8
    CVE-2026-2796 Public exploit

    JIT miscompilation in the JavaScript: WebAssembly component

    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Critical 9.8
    CVE-2026-2766 Public exploit

    Use-after-free in the JavaScript Engine: JIT component

    Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2026-2764 Public exploit

    JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

    JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2026-2763 Public exploit

    Use-after-free in the JavaScript Engine component

    Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-23980 Public exploit

    Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

    Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affec…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • High 7.2
    CVE-2026-1459 Public exploit

    A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG36…

    Zyxel VMG3625-T50B firmware Network devices
  • High 8.8
    CVE-2026-26331 Public exploit

    yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

    yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injecti…

    yt-dlp yt-dlp yt-dlp yt-dlp Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2026-26198 Public exploit

    ormar is vulnerable to SQL Injection through aggregate functions min() and max()

    Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The…

    collerek ormar ormar ormar Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2025-67445 Public exploit

    TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI rea…

  • Critical 9.8
    CVE-2025-69985 Public exploit Scanner template

    FUXA has JWT Authentication Bypass via HTTP Referer header spoofing

    FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. …

    @frangoteam/fuxa npm