Skip to content
OpenAdvisories

Archive

25 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /25 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-25746 Public exploit

    OpenEMR has SQL Injection Vulnerability

    OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists d…

    Open-Emr openemr
  • High 8.8
    CVE-2026-27701 Public exploit

    LiveCodes vulnerable to JavaScript Injection via untrusted PR title in i18n-update-pull workflow

    LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions workflow is vulnerable to JavaScript injection. The title of the Pull Request associated with the t…

    live-codes livecodes
  • High 8.8
    CVE-2026-27636 Public exploit

    FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOver…

    freescout-help-desk freescout
  • High 8.1
    CVE-2026-27607 Public exploit

    RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

    RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, …

    rustfs rustfs rustfs crates.io
  • High 8.8
    CVE-2026-27606 Public exploit

    Rollup 4 has Arbitrary File Write via Path Traversal

    Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization…

    rollup rollup langfuse-3-worker langfuse-3 Debian Ubuntu Wolfi npm