Skip to content
OpenAdvisories

Archive

25 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /25 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-3193

    Chia Blockchain send_transaction cross-site request forgery

    A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexi…

    Chia Blockchain
  • Low 3.1
    CVE-2026-3189

    feiyuchuixue sz-boot-parent download server-side request forgery

    A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The att…

    feiyuchuixue sz-boot-parent
  • Low 2.7
    CVE-2026-22866

    ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation

    Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the `RSASHA256Algorithm` and `RSASHA1Algorithm` contracts fail to validate PKCS#1 v1.5 padding structure when verif…

    ensdomains ens-contracts @ensdomains/ens-contracts npm
  • Low 1.3
    CVE-2026-3206

    Improper management of context cancelations

    Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.

    KrakenD KrakenD-EE KrakenD-CE
  • Low 2.3
    CVE-2026-28196

    In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

    JetBrains TeamCity
  • Low 2.6
    CVE-2026-21725

    Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name

    A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specifi…

    Grafana Grafana grafana grafana-12.3 Web / CMS Ubuntu Wolfi
  • Low 3.8
    CVE-2025-67860

    NeuVector scanner insecurely handles passwords as command arguments

    A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive credentials to local users.

    SUSE Harvester github.com/neuvector/scanner Go
  • Low 3.5
    CVE-2026-3171 Public exploit

    SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting

    A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /queue.php. This manipulation of the argument firstname/lastname causes cross site …

    SourceCodester Patrick Mvuma Patients Waiting Area Queue Management System Patients Waiting Area Queue Management System
  • Low 2.4
    CVE-2026-3170

    SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting

    A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /patient-search.php. The manipulation of the argument First Name/Last Name results in cross site script…

    SourceCodester Patrick Mvuma Patients Waiting Area Queue Management System Patients Waiting Area Queue Management System
  • Low 3.3
    CVE-2026-3146

    libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference

    A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally…

    vips vips libvips-8.17 libvips-dev Debian Ubuntu Wolfi
  • Low 2.6
    CVE-2026-27632

    Talishar Vulnerable to Cross-Site Request Forgery (CSRF)

    Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request Forgery (CSRF) protections on critical state-changing endpoints, specifically within `SubmitChat.php` a…

    Talishar Talishar
  • Low 1.2
    CVE-2026-27628

    pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

    pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may appl…

    py-pdf pypdf open-webui pypdf Debian Ubuntu Wolfi PyPI
  • Low 1.2
    CVE-2026-21443

    OpenEMR allows inconsistent escaping of translation function output

    OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation function returns unescaped strings. While wrapper functions exist for escaping in different contexts (`xlt(…

    Open-Emr openemr