Archive
February 2026
Vulnerabilities first published in this month (UTC), newest first.
99 results · Clear filters · Feed
-
High 8.7CVE-2026-24419 Public exploit
OpenSTAManager has an SQL Injection in the Prima Nota module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the Prima Nota (Journal Entry) module's add.php file. The application …
-
High 7.2CVE-2026-24135 Public exploit
Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitr…
-
High 7.3CVE-2026-2058 Public exploit
mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /postquerypublic.php of the component Post Query Details Page. This manipulation of the argument gnam…
-
High 8.2CVE-2026-1953 Public exploit
Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2
Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in the databa…
-
High 8.8CVE-2025-69906 Public exploit
Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies …
-
High 8.8CVE-2025-68722 Public exploit
Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability …
-
High 8.1CVE-2025-68721 Public exploit
Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delega…
-
High 8.1CVE-2026-22038 Public exploit
AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authe…
-
High 7.8CVE-2026-25546 Public exploit
Godot MCP is vulnerable to Command Injection via unsanitized projectPath
Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input (e.g…
-
High 8.3CVE-2026-25513 Public exploit
FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries t…
-
High 8.7CVE-2026-25514 Public exploit
FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensi…
-
High 8.7CVE-2025-69215 Public exploit
OpenSTAManager has an SQL Injection in the Stampe Module
OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability in the Stampe Module. At time of publication, no known patch exists.
-
High 8.7CVE-2025-69213 Public exploit
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can…
-
High 7.0CVE-2026-20980 Public exploit
Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary command…
-
High 8.1CVE-2026-1375 Public exploit
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_…
-
High 7.7
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traff…
KEV Feb 12, 2026 -
High 8.5CVE-2026-22226 Public exploit
Command Injection Vulnerability on TP-Link Archer BE230 and AX73
A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an attacker to gain full administrative control of …
-
High 8.0CVE-2025-9974 Public exploit
Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product
The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated a…
-
High 8.8
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.