Skip to content
OpenAdvisories

Archive

28 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /28 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-3377

    Tenda F453 SafeUrlFilter fromSafeUrlFilter buffer overflow

    A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. Th…

    Tenda F453
  • High 8.8
    CVE-2026-3376

    Tenda F453 SafeMacFilter fromSafeMacFilter buffer overflow

    A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible to launch the…

    Tenda F453
  • High 8.2
    CVE-2026-28562

    wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter

    wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perf…

    gVectors Team wpForo Forum
  • High 7.5
    CVE-2025-13673 Public exploit

    Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of suffic…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.5
    CVE-2026-2471

    WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field

    The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor calling `mayb…

    smub WP Mail Logging Web / CMS
  • High 8.1
    GHSA-5c6j-r48x-rmvq

    Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

    ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output witho…

    serialize-javascript npm