Skip to content
OpenAdvisories

Archive

26 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /26 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-22722 Public exploit

    VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash

    A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference error. To Remediate CVE-2026-22722, apply the patches listed in the "Fixed version" column of the 'Response Matrix'

    VMware Workstation
  • Critical 9.8
    CVE-2026-27966 Public exploit EPSS 35%

    Langflow has Remote Code Execution in CSV Agent

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a res…

    langflow-ai langflow langflow PyPI
  • High 7.5
    CVE-2026-27959 Public exploit

    Koa has Host Header Injection via `ctx.hostname`

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC …

    koajs koa koa npm
  • Critical 10.0
    CVE-2026-27941 Public exploit

    OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

    OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. Thes…

    openlit openlit openlit PyPI
  • High 7.7
    CVE-2026-27938 Public exploit

    WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

    WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull_request.bod…

    WPGraphQL wp-graphql
  • Medium 5.3
    CVE-2026-27884 Public exploit

    NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

    NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path trave…

    Pennyw0rth NetExec
  • High 7.5
    CVE-2026-27831 Public exploit

    rldns Vulnerable to Heap-based Out-of-Bounds Read

    rldns is an open source DNS server. Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Version 1.4 contains a patch for the issue.

    bluedragonsecurity rldns
  • Medium 5.4
    CVE-2025-56605 Public exploit

    A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event …