Archive
February 2026
Vulnerabilities first published in this month (UTC), newest first.
1,979 results · Clear filters · Feed
-
Medium 6.5
Azure DevOps Server Cross-Site Scripting Vulnerability
Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.
-
Medium 4.7
Windows App for Mac Installer Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Audition | Access of Memory Location After End of Buffer (CWE-788)
Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresp…
-
Medium 5.5
Audition | Out-of-bounds Read (CWE-125)
Audition versions 25.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user…
-
Medium 5.5
Audition | Out-of-bounds Read (CWE-125)
Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires us…
-
Medium 5.5
Audition | Out-of-bounds Read (CWE-125)
Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires us…
-
Medium 5.5
Audition | Out-of-bounds Read (CWE-125)
Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires us…
-
Medium 6.1
Frappe Affected by XSS and Open Redirect in Sign Up
Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. T…
-
Medium 6.9
Certain HP OfficeJet Pro Printers – Denial of Service
Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.
-
Medium 6.9CVE-2026-0651 Public exploit
Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the …
-
Medium 6.4
Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.
Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even…
-
Medium 4.3
Kanboard is missing authorization check in getSwimlane API allows cross-project data access
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is …
-
Medium 5.7
Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the …
-
Medium 6.7
Incorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later. within Ring 3…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applic…
-
Medium 6.7
Incorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) …
-
Medium 4.7
Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a deni…
-
Medium 5.5
Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a deni…
-
Medium 4.1
Use of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an informat…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an…
-
Medium 6.7
Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an…
-
Medium 6.7
Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Appl…
-
Medium 4.4
Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information dis…
-
Medium 6.5
Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, …
-
Medium 5.3
Race condition for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow a denial of service. Autho…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow…
-
Medium 6.5
Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may al…
-
Medium 4.1
Out-of-bounds read for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclos…
-
Medium 4.1
Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) with…
-
Medium 4.1
Exposure of sensitive information during transient execution for some TDX within Ring 0: Hypervisor may allow an inform…
-
Medium 6.0
Loop with unreachable exit condition ('infinite loop') for some Intel(R) Platform within Ring 0: Kernel may allow a den…
-
Medium 5.3
Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. before ver…
-
Medium 6.0
Out-of-bounds write in the firmware for some Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Rin…
-
Medium 6.0
Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x with…
-
Medium 4.7
Improper buffer restrictions in the firmware for the TDX Module may allow an escalation of privilege. System software a…
-
Medium 6.7
Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.358…
-
Medium 6.7
Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolk…
-
Medium 6.8
Null pointer dereference in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability within Ring 0: Kerne…
-
Medium 6.7
Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, C…
-
Medium 6.4CVE-2025-62676 Public exploit
An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet Fort…