Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2026

318 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 4

  • CVE-2026-21244
    29Monitor

    Windows Hyper-V Remote Code Execution Vulnerability

    HighCVSS 7.3Proof of conceptEPSS 1%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21248
    29Monitor

    Windows Hyper-V Remote Code Execution Vulnerability

    HighCVSS 7.3Proof of conceptEPSS 1%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21249
    16Monitor

    Windows NTLM Spoofing Vulnerability

    LowCVSS 3.3No exploitEPSS 11%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21250
    31Monitor

    Windows HTTP.sys Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows 11 24h2Feb 10, 2026

  • CVE-2026-21508
    28Monitor

    Windows Storage Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 0%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21510
    83Now

    Windows Shell Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 61%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21513
    70This week

    MSHTML Framework Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 15%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21514
    61This week

    Microsoft Word Security Feature Bypass Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · 365 appsFeb 10, 2026

  • CVE-2026-21519
    62This week

    Desktop Window Manager Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21525
    56Plan

    Windows Remote Access Connection Manager Denial of Service Vulnerability

    MediumCVSS 6.2KEVWeaponizedEPSS 5%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-21531
    40Plan

    Azure SDK for Python Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    microsoft · azure conversation authoring client libraryFeb 10, 2026

  • CVE-2026-21533
    62This week

    Windows Remote Desktop Services Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    microsoft · windows 10 1607Feb 10, 2026

  • CVE-2026-25993
    37Monitor

    EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    evershop · evershopFeb 10, 2026

  • CVE-2026-1357
    50Plan

    Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    wpvividplugins · wpvivid — backup, migration & stagingFeb 11, 2026

  • CVE-2026-1560
    38Monitor

    Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution

    HighCVSS 8.8Proof of conceptEPSS 9%

    nko · custom block builder – lazy blocksFeb 11, 2026

  • CVE-2026-25924
    33Monitor

    Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE

    HighCVSS 8.4Proof of conceptEPSS 0%

    kanboard · kanboardFeb 11, 2026

  • CVE-2026-25935
    34Monitor

    Vikunja Affected by XSS Via Task Preview

    HighCVSS 8.6No exploitEPSS 0%

    vikunja · vikunjaFeb 11, 2026

  • CVE-2026-25994
    33Monitor

    PJSIP has a heap buffer overflow in ICE with long username

    HighCVSS 8.1Proof of conceptEPSS 2%

    pjsip · pjsipFeb 11, 2026

  • CVE-2026-26012
    26Monitor

    vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

    MediumCVSS 6.5Proof of conceptEPSS 0%

    dani-garcia · vaultwardenFeb 11, 2026

  • CVE-2025-43537
    22Monitor

    A path handling issue was addressed with improved validation.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · ipadosFeb 11, 2026

  • CVE-2026-20660
    30Monitor

    A path handling issue was addressed with improved logic.

    HighCVSS 7.5Proof of conceptEPSS 0%

    apple · safariFeb 11, 2026

  • CVE-2026-20700
    62This week

    A memory corruption issue was addressed with improved state management.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    apple · ipadosFeb 11, 2026

  • CVE-2026-26215
    37Monitor

    manga-image-translator Shared API Unsafe Deserialization RCE

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    zyddnys · manga-image-translatorFeb 11, 2026

  • CVE-2026-26157
    28Monitor

    Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization

    HighCVSS 7.0Proof of conceptEPSS 0%

    red hat · red hat hardened imagesFeb 11, 2026

  • CVE-2026-26235
    35Monitor

    JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication

    HighCVSS 8.7Proof of conceptEPSS 1%

    jung-group · smart visu server firmwareFeb 12, 2026

  • CVE-2026-25676
    28Monitor

    The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link

    HighCVSS 7.1Proof of conceptEPSS 0%

    m-audio · m-track duo hdFeb 12, 2026

  • CVE-2026-2005
    35Monitor

    PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

    HighCVSS 8.8Proof of conceptEPSS 1%

    postgresql · postgresqlFeb 12, 2026

  • CVE-2025-70886
    30Monitor

    An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submi

    HighCVSS 7.5Proof of conceptEPSS 0%

    halo · haloFeb 12, 2026

  • CVE-2025-61880
    35Monitor

    In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.

    HighCVSS 8.8No exploitEPSS 0%

    infoblox · niosFeb 12, 2026

  • CVE-2026-26216
    42Plan

    Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter

    CriticalCVSS 10.0Proof of conceptEPSS 6%

    kidocode · crawl4aiFeb 12, 2026

  • CVE-2026-26217
    37Monitor

    Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling

    CriticalCVSS 9.2Proof of conceptEPSS 2%

    kidocode · crawl4aiFeb 12, 2026

  • CVE-2026-25108
    66This week

    FileZen contains an OS command injection vulnerability.

    HighCVSS 8.7KEVWeaponizedEPSS 5%

    soliton · filezenFeb 13, 2026

  • CVE-2026-26221
    37Monitor

    Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    hyland · onbase workflow timer serviceFeb 13, 2026

  • CVE-2026-26268
    39Monitor

    Cursor sandbox escape via Git hooks

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    anysphere · cursorFeb 13, 2026

  • CVE-2026-23111
    31Monitor

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelFeb 13, 2026

  • CVE-2025-66676
    24Monitor

    An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.

    MediumCVSS 6.2Proof of conceptEPSS 0%

    iobit · iobit unlockerFeb 13, 2026

  • CVE-2026-25964
    19Monitor

    Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read

    MediumCVSS 4.9Proof of conceptEPSS 0%

    tandoor · recipesFeb 13, 2026

  • CVE-2026-25991
    30Monitor

    Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import

    HighCVSS 7.7Proof of conceptEPSS 0%

    tandoor · recipesFeb 13, 2026

  • CVE-2026-26190
    51Plan

    Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    milvus · milvusFeb 13, 2026

  • CVE-2026-2441
    81Now

    Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra

    HighCVSS 8.8KEVWeaponizedEPSS 54%

    google · chromeFeb 13, 2026

  • CVE-2026-26335
    38Monitor

    Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    calero · verasmartFeb 13, 2026

  • CVE-2026-1844
    28Monitor

    PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting

    HighCVSS 7.2Proof of conceptEPSS 0%

    pixelyoursite · pixelyoursite pro – your smart pixel (tag) managerFeb 13, 2026

  • CVE-2026-0692
    30Monitor

    BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation

    HighCVSS 7.5Proof of conceptEPSS 1%

    bluesnap · bluesnap payment gateway for woocommerceFeb 14, 2026

  • CVE-2025-6792
    21Monitor

    One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception

    MediumCVSS 5.3Proof of conceptEPSS 0%

    amentotechpvtltd · one to one user chat by wpguppyFeb 14, 2026

  • CVE-2026-0745
    22Monitor

    User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter

    MediumCVSS 5.5Proof of conceptEPSS 0%

    webilop · user language switchFeb 14, 2026

  • CVE-2026-1096
    25Monitor

    Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute

    MediumCVSS 6.4Proof of conceptEPSS 0%

    raju_ahmed · best-wp-google-mapFeb 14, 2026

  • CVE-2026-1306
    40Plan

    midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    adminkov · midi-synthFeb 14, 2026

  • CVE-2026-2534
    13Monitor

    Comfast CF-N1 V2 mbox-config sub_44AC4C command injection

    LowCVSS 2.1No exploitEPSS 15%

    comfast · cf-n1 firmwareFeb 16, 2026

  • CVE-2026-2535
    13Monitor

    Comfast CF-N1 V2 mbox-config sub_44AB9C command injection

    LowCVSS 2.1No exploitEPSS 15%

    comfast · cf-n1 firmwareFeb 16, 2026

  • CVE-2026-2537
    16Monitor

    Comfast CF-E4 HTTP POST Request mbox-config command injection

    LowCVSS 2.0No exploitEPSS 27%

    comfast · cf-e4 firmwareFeb 16, 2026

  • CVE-2025-65717
    17Monitor

    An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML p

    MediumCVSS 4.3Proof of conceptEPSS 0%

    ritwickdey · live serverFeb 16, 2026

  • CVE-2026-2002
    17Monitor

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

    MediumCVSS 4.4Proof of conceptEPSS 0%

    wpmudev · forminator forms – contact form, payment form & custom form builderFeb 17, 2026

  • CVE-2026-1657
    21Monitor

    EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

    MediumCVSS 5.3Proof of conceptEPSS 0%

    metagauss · eventprime – events calendar, bookings and ticketsFeb 17, 2026

  • CVE-2026-0829
    23Monitor

    Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending

    MediumCVSS 5.8Proof of conceptEPSS 0%

    unknown · frontend file manager pluginFeb 17, 2026

  • CVE-2026-2615
    33Monitor

    Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection

    HighCVSS 7.3No exploitEPSS 13%

    wavlink · wl-nu516u1 firmwareFeb 17, 2026

  • CVE-2025-70829
    22Monitor

    An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC con

    MediumCVSS 5.7Proof of conceptEPSS 0%

    running-elephant · datartFeb 17, 2026

  • CVE-2025-65753
    30Monitor

    An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.

    HighCVSS 7.5Proof of conceptEPSS 0%

    Feb 17, 2026

  • CVE-2025-70828
    35Monitor

    An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration

    HighCVSS 8.8Proof of conceptEPSS 0%

    running-elephant · datartFeb 17, 2026

  • CVE-2025-70830
    39Monitor

    A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    Feb 17, 2026

  • CVE-2024-55271
    14Monitor

    A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0.

    LowCVSS 3.5Proof of conceptEPSS 0%

    phpgurukul · gym management systemFeb 17, 2026

  • CVE-2024-55270
    35Monitor

    phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter.

    HighCVSS 8.8Proof of conceptEPSS 0%

    phpgurukul · student management systemFeb 17, 2026

  • CVE-2026-24733
    14Monitor

    Apache Tomcat: Security constraint bypass with HTTP/0.9

    LowCVSS 3.7Proof of conceptEPSS 0%

    apache · tomcatFeb 17, 2026

  • CVE-2025-32355
    31Monitor

    Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections.

    HighCVSS 7.9Proof of conceptEPSS 1%

    rocketsoftware · trufusion enterpriseFeb 17, 2026

  • CVE-2026-22769
    74This week

    Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.

    CriticalCVSS 10.0KEVWeaponizedEPSS 13%

    dell · recoverpoint for virtual machinesFeb 17, 2026

  • CVE-2026-26119
    38Monitor

    Windows Admin Center Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 11%

    microsoft · windows admin centerFeb 17, 2026

  • CVE-2026-1277
    18Monitor

    URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter

    MediumCVSS 4.7Proof of conceptEPSS 0%

    kaizencoders · url shortify – simple and easy url shortenerFeb 18, 2026

  • CVE-2026-1296
    24Monitor

    Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wpshuffle · frontend post submission manager lite – frontend posting wordpress pluginFeb 18, 2026

  • CVE-2026-2576
    30Monitor

    Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter

    HighCVSS 7.5Proof of conceptEPSS 0%

    strategy11team · business directory plugin – easy listing directories for wordpressFeb 18, 2026

  • CVE-2026-1368
    30Monitor

    Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

    HighCVSS 7.5Proof of conceptEPSS 1%

    unknown · video conferencing with zoomFeb 18, 2026

  • CVE-2026-1937
    28Monitor

    YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action

    HighCVSS 7.2Proof of conceptEPSS 0%

    yaycommerce · yaymail – woocommerce email customizerFeb 18, 2026

  • CVE-2025-14340
    29Monitor

    Admin Account Takeover via malicious URL payload

    HighCVSS 7.3Proof of conceptEPSS 1%

    payara platform · payara serverFeb 18, 2026

  • CVE-2026-2329
    60This week

    Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow

    CriticalCVSS 9.3WeaponizedEPSS 41%

    grandstream · gxp1610 firmwareFeb 18, 2026

  • CVE-2025-65791
    40Plan

    ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    zoneminder · zoneminderFeb 18, 2026

  • CVE-2025-70149
    39Monitor

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    codeastro · membership management systemFeb 18, 2026

  • CVE-2026-23491
    38Monitor

    InvoicePlane has Unauthenticated Path Traversal in Guest Controller

    CriticalCVSS 9.3Proof of conceptEPSS 4%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-1999
    28Monitor

    Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests

    HighCVSS 7.1Proof of conceptEPSS 0%

    github · enterprise serverFeb 18, 2026

  • CVE-2026-24743
    30Monitor

    InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

    HighCVSS 7.5No exploitEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-27174
    60This week

    MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

    CriticalCVSS 9.3WeaponizedEPSS 6%

    mjdm · majordomoFeb 18, 2026

  • CVE-2026-27175
    60This week

    MajorDoMo Command Injection in rc/index.php via Race Condition

    CriticalCVSS 9.2WeaponizedEPSS 6%

    mjdm · majordomoFeb 18, 2026

  • CVE-2026-27176
    20Monitor

    MajorDoMo Reflected Cross-Site Scripting in command.php

    MediumCVSS 5.1Proof of conceptEPSS 0%

    mjdm · majordomoFeb 18, 2026

  • CVE-2026-27179
    35Monitor

    MajorDoMo Unauthenticated SQL Injection in Commands Module

    HighCVSS 8.8Proof of conceptEPSS 0%

    mjdm · majordomoFeb 18, 2026

  • CVE-2026-27180
    60This week

    MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning

    CriticalCVSS 9.3WeaponizedEPSS 1%

    mjdm · majordomoFeb 18, 2026

  • CVE-2026-2670
    33Monitor

    Advantech WISE-6610-NB Background Management openvpn_apply os command injection

    HighCVSS 7.3Proof of conceptEPSS 13%

    advantech · wise-6610-nbFeb 18, 2026

  • CVE-2026-25548
    36Monitor

    InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-25594
    19Monitor

    InvoicePlane has Stored XSS via Family Name in Product Form

    MediumCVSS 4.8Proof of conceptEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-25595
    19Monitor

    InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard

    MediumCVSS 4.8Proof of conceptEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-25596
    19Monitor

    InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

    MediumCVSS 4.8Proof of conceptEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-24126
    36Monitor

    Weblate has an argument injection in management console

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    weblate · weblateFeb 18, 2026

  • CVE-2025-4960
    31Monitor

    macOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer

    HighCVSS 7.8Proof of conceptEPSS 0%

    epson · epson printer controller installerFeb 19, 2026

  • CVE-2026-0561
    24Monitor

    Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter

    MediumCVSS 6.1Proof of conceptEPSS 0%

    paultgoodchild · shield: blocks bots, protects users, and prevents security breachesFeb 19, 2026

  • CVE-2026-0926
    42Plan

    Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    prodigycommerce · prodigy commerceFeb 19, 2026

  • CVE-2026-1405
    40Plan

    Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    franchidesign · slider futureFeb 19, 2026

  • CVE-2026-25232
    28Monitor

    Gogs has a Protected Branch Deletion Bypass in Web Interface

    HighCVSS 7.1Proof of conceptEPSS 0%

    gogs · gogsFeb 19, 2026

  • CVE-2025-55853
    36Monitor

    SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF).

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    softvision · webpdfFeb 19, 2026

  • CVE-2026-25527
    21Monitor

    changedetection.io vulnerable to unauthenticated static path traversal

    MediumCVSS 5.3Proof of conceptEPSS 1%

    webtechnologies · changedetectionFeb 19, 2026

  • CVE-2026-25755
    35Monitor

    jsPDF has PDF Object Injection via Unsanitized Input in addJS Method

    HighCVSS 8.8Proof of conceptEPSS 0%

    parall · jspdfFeb 19, 2026

  • CVE-2025-71243
    60This week

    SPIP Saisies Plugin < 5.11.1 Remote Code Execution

    CriticalCVSS 9.3WeaponizedEPSS 5%

    spip · saisiesFeb 19, 2026

  • CVE-2026-25940
    32Monitor

    jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

    HighCVSS 8.1Proof of conceptEPSS 0%

    parall · jspdfFeb 19, 2026

  • CVE-2026-1581
    31Monitor

    wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 2%

    tomdever · wpforo forumFeb 19, 2026

  • CVE-2026-25998
    34Monitor

    strongMan vulnerable to private credential recovery due to key and counter reuse

    HighCVSS 8.7No exploitEPSS 0%

    strongswan · strongmanFeb 19, 2026