Skip to content
OpenAdvisories

Archive

February 2026

Vulnerabilities first published in this month (UTC), newest first.

← January 2026 2026 / February March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

4,674 results · Feed

  • Medium 6.5
    CVE-2025-67973

    WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.

    sunshinephotocart Sunshine Photo Cart
  • Medium 5.9
    CVE-2025-67970

    WordPress Schedula plugin <= 1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.

    vertim Schedula
  • Medium 6.5
    CVE-2025-67624

    WordPress Optimize More! – Images plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from n/a through <= 1.1.3.

    Arya Dhiratara Optimize More! – Images
  • Medium 6.5
    CVE-2025-67969

    WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommer…

    Knit Pay UPI QR Code Payment Gateway for WooCommerce Web / CMS
  • High 7.1
    CVE-2025-67971

    WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0.

    WP ManageNinja FluentCart
  • Medium 6.5
    CVE-2025-67547

    WordPress Konte theme <= 2.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.

    uixthemes Konte
  • High 7.1
    CVE-2025-53233

    WordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through <= 0.6.14.

    RylanH Storyform
  • High 7.1
    CVE-2025-53237

    WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through <= 1.0.1.

    Soflyy WP Wizard Cloak
  • High 8.1
    CVE-2025-60087

    WordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon allows PHP Local File Inclusion.This issue affects Extens…

    nenad-obradovic Extensive VC Addons for WPBakery page builder
  • Medium 5.9
    CVE-2025-60183

    WordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.

    silence Silencesoft RSS Reader
  • Medium 6.5
    CVE-2024-56208

    WordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This issue affects NewsMash: from n/a through <= 1.0.71.

    desertthemes NewsMash
  • High 7.6
    CVE-2025-53217

    WordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2.

    staviravn AIO WP Builder
  • High 7.1
    CVE-2025-53231

    WordPress Easy Taxonomy Images plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevstudio Easy Taxonomy Images easy-taxonomy-images allows Stored XSS.This issue affects Easy Taxonomy Images: from n/a through <= 1.0.1.

    wpdevstudio Easy Taxonomy Images
  • High 7.1
    CVE-2025-53228

    WordPress bbpress Simple Advert Units Plugin <= 0.41 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jezza101 bbpress Simple Advert Units bbpress-simple-advert-units allows Reflected XSS.This issue affects bbpress Simple Advert Units: from n/a through <= 0.4…

    jezza101 bbpress Simple Advert Units
  • High 7.7
    CVE-2025-52744

    WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0.

    inpersttion Inpersttion For Theme
  • Medium 6.5
    CVE-2024-50555

    WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0.

    Elementor Elementor Website Builder
  • Medium 6.5
    CVE-2024-50452

    WordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Stored XSS.This issue affects Nexter Blocks: from n/a through <= 3.3.3.

    POSIMYTH Nexter Blocks
  • Medium 5.9
    CVE-2024-52387

    WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

    Liton Arefin Master Addons for Elementor
  • Medium 6.5
    CVE-2024-51915

    WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2024-54222

    WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.

    Seraphinite Solutions Seraphinite Accelerator
  • Medium 5.3
    CVE-2024-34438

    WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.

    Anssi Laitila Shared Files
  • Medium 5.3
    CVE-2024-43228

    WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

    SecuPress SecuPress Free
  • Low 3.7
    CVE-2026-22885

    EnOcean SmartServer IoT Out-of-bounds Read

    A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory.

    EnOcean Edge SmartServer IoT
  • High 8.1
    CVE-2026-20761

    EnOcean SmartServer IoT Command Injection

    A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device.

    EnOcean Edge SmartServer IoT
  • High 7.2
    CVE-2026-2847 EPSS 10%

    UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection

    A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The at…

    UTT HiPER 520
  • High 7.2
    CVE-2026-2846 EPSS 11%

    UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection

    A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command inje…

    UTT HiPER 520
  • Low 3.5
    CVE-2025-52603

    HCL Connections is vulnerable to information disclosure

    HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

    HCL Software Connections
  • Low 2.4
    CVE-2025-14055

    Integer underflow in Secure NCP host

    An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet.

    silabs.com Simplicity SDK, Gecko SDK
  • Critical 9.5
    CVE-2026-21627 Public exploit

    Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

    The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

    tassos.gr Smile Pack Novarain/Tassos Framework (plg_system_nrframework) EngageBox
  • Low 2.3
    CVE-2025-14547

    ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIs

    An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service.

    silabs.com Gecko SDK Simplicity SDK
  • Unscored —
    RUSTSEC-2026-0017

    `clob-sdk` was removed from crates.io for malicious code

    This is part of an ongoing campaign to attempt to typosquat crates in the [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) ecosystem to exfiltrate user credentials. The malicious crate had 1 version published on 2026-02-20 approximate…

    clob-sdk crates.io
  • Unscored —
    RUSTSEC-2026-0016

    `polymarkets-rs-clob-client` was removed from crates.io for malicious code

    This is part of an ongoing campaign to attempt to typosquat crates in the [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) ecosystem to exfiltrate user credentials. The malicious crate had 1 version published on 2026-02-19 approximate…

    polymarkets-rs-clob-client crates.io
  • Critical 9.8
    CVE-2025-10970

    SQLi in Kolay Software's Talentics

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection. This issue affects Talentics: through 20022026. NOTE: The vendor was contacted early about this dis…

    Kolay Software Talentics
  • Medium 6.4
    CVE-2026-2486

    Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'

    The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it pos…

    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Web / CMS
  • Low 2.3
    CVE-2026-21620

    TFTP Path Traversal

    Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is ass…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-26050

    The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search pa…

    Ricoh Company ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール
  • Medium 6.5
    CVE-2025-59819

    Authenticated Arbitrary File Read via filepath parameter

    This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.

    Zenitel alphacom_xe_audio_server
  • Medium 6.1
    CVE-2026-26370

    WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulner…

    Ays Pro Survey Maker Web / CMS
  • Low 3.5
    CVE-2026-2825

    rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting

    A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Module. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely…

    rachelos WeRSS we-mp-rss
  • Medium 6.3
    CVE-2026-2824 EPSS 17%

    Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection

    A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection.…

    Comfast CF-E7