Archive
February 2026
Vulnerabilities first published in this month (UTC), newest first.
1,979 results · Clear filters · Feed
-
Medium 4.3
PostgreSQL oidvector discloses a few bytes of memory
Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely.…
-
Medium 6.5
Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File
The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_action() function in all versions up to, and including, 1.2.8. This makes it possible for authenticat…
-
Medium 6.5
Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection
When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the "registration number" using a pro…
-
Medium 5.3
Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models
The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cry…
-
Medium 5.3
Reflected Cross-Site Scripting in the Wix web application
Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker coul…
-
Medium 4.8
Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauth…
-
Medium 6.8
XSS in Grafana Explore stack trace
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear …
-
Medium 5.3
Public Dashboards time range restriction on annotations can be bypassed
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked t…
-
Medium 5.3
markdown-it is has a Regular Expression Denial of Service (ReDoS)
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a n…
-
Medium 5.3
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_step() function in all versions up to, and including, 5.2.6. This makes it poss…
-
Medium 4.3
An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to vie…
-
Medium 6.5
@farmfe/core is Missing Origin Validation in WebSocket
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their web…
-
Medium 6.1
lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field i…
-
Medium 5.5
A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execut…
-
Medium 5.4
grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection becaus…
-
Medium 5.5
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An ap…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5…
-
Medium 4.6
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequo…
-
Medium 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15…
-
Medium 4.4
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 an…
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 1…
-
Medium 5.5
An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14…
-
Medium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequ…
-
Medium 5.3
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15…
-
Medium 6.0
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 1…
-
Medium 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …
-
Medium 4.6
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 an…
-
Medium 5.5
A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, m…
-
Medium 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …
-
Medium 5.5
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.4, macOS T…
-
Medium 4.6
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker …
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5…
-
Medium 4.6
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS…
-
Medium 5.7
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and …
-
Medium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.…
-
Medium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.…
-
Medium 4.4
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Tahoe 26.3. An …