Archive
February 2026
Vulnerabilities first published in this month (UTC), newest first.
1,979 results · Clear filters · Feed
-
Medium 5.3
mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has…
-
Medium 5.3
kalyan02 NanoCMS User Information pagesdata.txt direct request
A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to …
-
Medium 6.3
isaacwasserman mcp-vegalite-server visualize_data eval code injection
A security vulnerability has been detected in isaacwasserman mcp-vegalite-server up to 16aefed598b8cd897b78e99b907f6e2984572c61. Affected by this vulnerability is the function eval of the component visualize_data. Such manipulation of the argument vegalite_sp…
-
Medium 5.3
Free5GC SMF SessionDeletionResponse null pointer dereference
A weakness has been identified in Free5GC up to 4.1.0. Affected is the function SessionDeletionResponse of the component SMF. This manipulation causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made avail…
-
Medium 5.3
Free5GC pfcp_reports.go identityTriggerType null pointer dereference
A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to …
-
Medium 4.3
Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute
The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing…
-
Medium 5.3
Free5GC SMF datapath.go ResolveNodeIdToIp denial of service
A vulnerability was identified in Free5GC up to 4.1.0. This affects the function ResolveNodeIdToIp of the file internal/sbi/processor/datapath.go of the component SMF. The manipulation leads to denial of service. Remote exploitation of the attack is possible.…
-
Medium 5.3
Free5GC SMF establishPfcpSession null pointer dereference
A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been pub…
-
Medium 5.3
Edimax BR-6208AC auth_check_userpass2 default credentials
A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument Username/Password results in use of default credentials. The attack may be initiated remotely. The explo…
-
Medium 5.3
Collabora Online vulnerable to Authorization Bypass
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only right…
-
Medium 6.5
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.3
WeKan REST Endpoint boards.js BoardTitleRESTBleed access control
A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to ve…
-
Medium 6.3
WeKan Attachment Storage attachments.js MoveStorageBleed access control
A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to vers…
-
Medium 6.3
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated re…
-
Medium 5.3
Truncated 802.15.4 packet leads to denial of service
A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service.
-
Medium 6.8
Out-of-bounds Write in o6 Automation GmbH Open62541
In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.
-
Medium 6.6
Tanium addressed an improper output sanitization vulnerability in TanOS.
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.
-
Medium 6.6
Tanium addressed a local privilege escalation vulnerability in Engage.
Tanium addressed a documentation issue in Engage.
-
Medium 6.3
Tanium addressed an improper input validation vulnerability in Discover.
Tanium addressed an improper input validation vulnerability in Discover.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Patch.
Tanium addressed an improper access controls vulnerability in Patch.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Deploy.
Tanium addressed an improper access controls vulnerability in Deploy.
-
Medium 5.0
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
-
Medium 4.3
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
-
Medium 4.9
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.9
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Discover.
Tanium addressed an incorrect default permissions vulnerability in Discover.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Comply.
Tanium addressed an incorrect default permissions vulnerability in Comply.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Patch.
Tanium addressed an incorrect default permissions vulnerability in Patch.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Performance.
Tanium addressed an incorrect default permissions vulnerability in Performance.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Reputation.
Tanium addressed an improper access controls vulnerability in Reputation.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Enforce.
Tanium addressed an incorrect default permissions vulnerability in Enforce.
-
Medium 5.3
Infinite parsing loop in golang.org/x/net
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
-
Medium 5.3
Quadratic parsing complexity in golang.org/x/net/html
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
-
Medium 5.9
LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N
The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Mi…
-
Medium 5.1
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This…