Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: February 2026

319 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 4

  • CVE-2026-25998
    34Monitor

    strongMan vulnerable to private credential recovery due to key and counter reuse

    HighCVSS 8.7No exploitEPSS 0%

    strongswan · strongmanFeb 19, 2026

  • CVE-2026-26030
    40Plan

    Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

    CriticalCVSS 9.9Proof of conceptEPSS 3%

    microsoft · semantic kernelFeb 19, 2026

  • CVE-2026-26336
    34Monitor

    Hyland Alfresco Improper Authorization Arbitrary File Read

    HighCVSS 8.7Proof of conceptEPSS 0%

    hyland · alfresco content servicesFeb 19, 2026

  • CVE-2026-27472
    21Monitor

    SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites

    MediumCVSS 5.3Proof of conceptEPSS 0%

    spip · spipFeb 19, 2026

  • CVE-2026-27475
    36Monitor

    SPIP < 4.4.9 Insecure Deserialization

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    spip · spipFeb 19, 2026

  • CVE-2026-26189
    32Monitor

    Trivy Action has a script injection via sourced env file in composite action

    HighCVSS 8.1Proof of conceptEPSS 1%

    aquasec · trivy actionFeb 19, 2026

  • CVE-2026-26744
    21Monitor

    A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endp

    MediumCVSS 5.3Proof of conceptEPSS 0%

    formalms · formalmsFeb 19, 2026

  • CVE-2026-26980
    51Plan

    Ghost has a SQL Injection in its Content API

    HighCVSS 7.5Proof of conceptEPSS 71%

    ghost · ghostFeb 19, 2026

  • CVE-2026-26988
    40Plan

    LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream

    CriticalCVSS 9.3Proof of conceptEPSS 8%

    librenms · librenmsFeb 19, 2026

  • CVE-2026-2823
    14Monitor

    Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection

    LowCVSS 2.1No exploitEPSS 18%

    comfast · cf-e7 firmwareFeb 20, 2026

  • CVE-2026-2824
    13Monitor

    Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection

    LowCVSS 2.1No exploitEPSS 17%

    comfast · cf-e7 firmwareFeb 20, 2026

  • CVE-2026-21627
    39Monitor

    Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

    CriticalCVSS 9.5Proof of conceptEPSS 1%

    tassos.gr · novarain/tassos framework (plg_system_nrframework)Feb 20, 2026

  • CVE-2024-50555
    26Monitor

    WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    elementor · elementor website builderFeb 20, 2026

  • CVE-2025-68043
    29Monitor

    WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability

    HighCVSS 7.3Proof of conceptEPSS 0%

    lottiefiles · lottiefilesFeb 20, 2026

  • CVE-2025-69295
    37Monitor

    WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    teconcetheme · coven coreFeb 20, 2026

  • CVE-2026-24946
    26Monitor

    WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    tychesoftwares · print invoice & delivery notes for woocommerceFeb 20, 2026

  • CVE-2026-24953
    26Monitor

    WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    mitchell bennis · simple file listFeb 20, 2026

  • CVE-2026-2846
    32Monitor

    UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection

    HighCVSS 7.3No exploitEPSS 11%

    utt · 520 firmwareFeb 20, 2026

  • CVE-2026-2847
    32Monitor

    UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection

    HighCVSS 7.3No exploitEPSS 10%

    utt · 520 firmwareFeb 20, 2026

  • CVE-2026-26746
    35Monitor

    OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function.

    HighCVSS 8.8Proof of conceptEPSS 0%

    opensourcepos · open source point of saleFeb 20, 2026

  • CVE-2026-2472
    34Monitor

    Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

    HighCVSS 8.6Proof of conceptEPSS 0%

    google cloud · vertex ai sdk for pythonFeb 20, 2026

  • CVE-2026-0777
    31Monitor

    Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    xmind · xmindFeb 20, 2026

  • CVE-2026-2041
    58Plan

    Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 75%

    nagios · nagios xiFeb 20, 2026

  • CVE-2026-2043
    58Plan

    Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 75%

    nagios · nagios xiFeb 20, 2026

  • CVE-2026-26046
    32Monitor

    Moodle: moodle: improper input sanitization in tex filter administration setting

    HighCVSS 7.2No exploitEPSS 13%

    moodle · moodleFeb 21, 2026

  • CVE-2026-27199
    25Monitor

    Werkzeug safe_join() allows Windows special device names

    MediumCVSS 6.3Proof of conceptEPSS 0%

    palletsprojects · werkzeugFeb 21, 2026

  • CVE-2026-27212
    37Monitor

    Swiper has a Prototype Pollution Vulnerability

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    swiperjs · swiperFeb 21, 2026

  • CVE-2026-27470
    35Monitor

    ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

    HighCVSS 8.8Proof of conceptEPSS 0%

    zoneminder · zoneminderFeb 21, 2026

  • CVE-2026-27574
    39Monitor

    OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    hackerbay · oneuptimeFeb 21, 2026

  • CVE-2026-27579
    29Monitor

    CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure

    HighCVSS 7.4Proof of conceptEPSS 0%

    karnop · realtime-collaboration-platformFeb 21, 2026

  • CVE-2026-2898
    8Monitor

    funadmin Backend Endpoint AuthCloudService.php getMember deserialization

    LowCVSS 2.0Proof of conceptEPSS 0%

    funadmin · funadminFeb 21, 2026

  • CVE-2026-2964
    5Monitor

    higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution

    LowCVSS 1.3Proof of conceptEPSS 0%

    higuma · webaudiorecorder.jsFeb 22, 2026

  • CVE-2026-23552
    36Monitor

    Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    apache · camelFeb 23, 2026

  • CVE-2026-25747
    35Monitor

    Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB

    HighCVSS 8.8Proof of conceptEPSS 1%

    apache · camelFeb 23, 2026

  • CVE-2025-63945
    29Monitor

    A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute

    HighCVSS 7.4Proof of conceptEPSS 0%

    tencent · ioaFeb 23, 2026

  • CVE-2025-63946
    29Monitor

    A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to exec

    HighCVSS 7.4Proof of conceptEPSS 0%

    tencent · pcmanagerFeb 23, 2026

  • CVE-2025-67733
    28Monitor

    Valkey Affected by RESP Protocol Injection via Lua error_reply

    HighCVSS 7.1Proof of conceptEPSS 0%

    lfprojects · valkeyFeb 23, 2026

  • CVE-2025-68930
    26Monitor

    Traccar Missing Origin Validation in WebSockets

    MediumCVSS 6.5Proof of conceptEPSS 0%

    traccar · traccarFeb 23, 2026

  • CVE-2026-23693
    37Monitor

    ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    roxnor · elementskit elementor addons – advanced widgets & templates addons for elementorFeb 23, 2026

  • CVE-2026-3040
    11Monitor

    DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection

    LowCVSS 2.0No exploitEPSS 10%

    draytek · vigor300b firmwareFeb 23, 2026

  • CVE-2026-25545
    28Monitor

    Astro has Full-Read SSRF in error rendering via Host: header injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    astro · \@astrojs\/nodeFeb 23, 2026

  • CVE-2026-1459
    28Monitor

    A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware vers

    HighCVSS 7.2Proof of conceptEPSS 0%

    zyxel · vmg3625-t50c firmwareFeb 23, 2026

  • CVE-2026-26198
    30Monitor

    ormar is vulnerable to SQL Injection through aggregate functions min() and max()

    HighCVSS 7.5Proof of conceptEPSS 1%

    collerek · ormarFeb 23, 2026

  • CVE-2026-26331
    36Monitor

    yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

    HighCVSS 8.8Proof of conceptEPSS 1%

    yt-dlp project · yt-dlpFeb 23, 2026

  • CVE-2026-3064
    15Monitor

    HummerRisk Cloud Task Scheduler ResourceCreateService.java command injection

    LowCVSS 2.1No exploitEPSS 21%

    hummerrisk · hummerriskFeb 23, 2026

  • CVE-2026-3065
    18Monitor

    HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection

    LowCVSS 2.1No exploitEPSS 33%

    hummerrisk · hummerriskFeb 23, 2026

  • CVE-2026-3066
    12Monitor

    HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection

    LowCVSS 2.1No exploitEPSS 13%

    hummerrisk · hummerriskFeb 24, 2026

  • CVE-2026-23980
    21Monitor

    Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

    MediumCVSS 5.3Proof of conceptEPSS 0%

    apache · supersetFeb 24, 2026

  • CVE-2026-2763
    39Monitor

    Use-after-free in the JavaScript Engine component

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mozilla · firefoxFeb 24, 2026

  • CVE-2026-2764
    39Monitor

    JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mozilla · firefoxFeb 24, 2026

  • CVE-2026-2766
    39Monitor

    Use-after-free in the JavaScript Engine: JIT component

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mozilla · firefoxFeb 24, 2026

  • CVE-2026-2781
    39Monitor

    Integer overflow in the Libraries component in NSS

    CriticalCVSS 9.8No exploitEPSS 0%

    mozilla · firefoxFeb 24, 2026

  • CVE-2026-2796
    39Monitor

    JIT miscompilation in the JavaScript: WebAssembly component

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mozilla · firefoxFeb 24, 2026

  • CVE-2025-67445
    30Monitor

    TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi.

    HighCVSS 7.5Proof of conceptEPSS 0%

    totolink · x5000r firmwareFeb 24, 2026

  • CVE-2026-27483
    38Monitor

    MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

    HighCVSS 8.8Proof of conceptEPSS 10%

    mindsdb · mindsdbFeb 24, 2026

  • CVE-2026-3102
    9Monitor

    exiftool PNG File MacOS.pm SetMacOSTags os command injection

    LowCVSS 2.1Proof of conceptEPSS 3%

    exiftool project · exiftoolFeb 24, 2026

  • CVE-2025-69985
    41Plan

    FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    frangoteam · fuxaFeb 24, 2026

  • CVE-2026-27507
    37Monitor

    Binardat 10G08-0800GSM Network Switch Hard-coded Credentials

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    binardat · 10g08-0800gsm firmwareFeb 24, 2026

  • CVE-2025-62512
    22Monitor

    Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

    MediumCVSS 5.5Proof of conceptEPSS 0%

    piwigo · piwigoFeb 24, 2026

  • CVE-2026-22765
    35Monitor

    Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability.

    HighCVSS 8.8Proof of conceptEPSS 0%

    dell · wyse management suiteFeb 24, 2026

  • CVE-2026-26341
    38Monitor

    Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    tattile · smart\+ firmwareFeb 24, 2026

  • CVE-2026-22553
    37Monitor

    InSAT MasterSCADA BUK-TS OS Command Injection

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    insat · masterscadaFeb 24, 2026

  • CVE-2026-24849
    27Monitor

    OpenEMR Arbitrary File Read Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 2%

    open-emr · openemrFeb 24, 2026

  • CVE-2025-5781
    20Monitor

    Information Exposure Vulnerability in Hitachi Configuration Manager, Hitachi Ops Center API Configuration Manager

    MediumCVSS 5.2Proof of conceptEPSS 0%

    hitachi · configuration managerFeb 24, 2026

  • CVE-2026-27606
    35Monitor

    Rollup 4 has Arbitrary File Write via Path Traversal

    HighCVSS 8.8Proof of conceptEPSS 1%

    rollupjs · rollupFeb 24, 2026

  • CVE-2026-27607
    36Monitor

    RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    rustfs · rustfsFeb 24, 2026

  • CVE-2026-27621
    27Monitor

    TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

    MediumCVSS 6.8Proof of conceptEPSS 0%

    typicms · typicmsFeb 24, 2026

  • CVE-2026-27626
    39Monitor

    OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    olivetin · olivetinFeb 24, 2026

  • CVE-2026-27597
    40Plan

    @enclave-vm/core is vulnerable to Sandbox Escape

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    agentfront · enclaveFeb 25, 2026

  • CVE-2026-27636
    40Plan

    FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

    HighCVSS 8.8WeaponizedEPSS 2%

    freescout · freescoutFeb 25, 2026

  • CVE-2026-27641
    39Monitor

    Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jugmac00 · flask-reuploadedFeb 25, 2026

  • CVE-2026-27645
    24Monitor

    changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

    MediumCVSS 6.1Proof of conceptEPSS 0%

    webtechnologies · changedetectionFeb 25, 2026

  • CVE-2026-2416
    30Monitor

    Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter

    HighCVSS 7.5Proof of conceptEPSS 1%

    cyberhobo · geo mashupFeb 25, 2026

  • CVE-2026-3171
    8Monitor

    SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting

    LowCVSS 2.0Proof of conceptEPSS 0%

    pamzey · patients waiting area queue management systemFeb 25, 2026

  • CVE-2025-62878
    39Monitor

    Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    suse · rancherFeb 25, 2026

  • CVE-2026-2624
    40Plan

    Authentication Bypass in ePati's Antikor NGFW

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    epati · antikor next generation firewallFeb 25, 2026

  • CVE-2025-1242
    37Monitor

    Administrative Credentials Can Be Extracted Through Gardyn API Responses

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    gardyn · home kitFeb 25, 2026

  • CVE-2026-27701
    35Monitor

    LiveCodes vulnerable to JavaScript Injection via untrusted PR title in i18n-update-pull workflow

    HighCVSS 8.8Proof of conceptEPSS 0%

    live-codes · livecodesFeb 25, 2026

  • CVE-2026-20122
    59Plan

    Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

    MediumCVSS 5.4KEVWeaponizedEPSS 25%

    cisco · catalyst sd-wan managerFeb 25, 2026

  • CVE-2026-20127
    96Now

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 87%

    cisco · catalyst sd-wan managerFeb 25, 2026

  • CVE-2026-20128
    63This week

    Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 8%

    cisco · catalyst sd-wan managerFeb 25, 2026

  • CVE-2026-20133
    71This week

    A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affect

    HighCVSS 7.5KEVWeaponizedEPSS 35%

    cisco · catalyst sd-wan managerFeb 25, 2026

  • CVE-2026-26717
    19Monitor

    An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    Feb 25, 2026

  • CVE-2026-21902
    43Plan

    Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

    CriticalCVSS 9.3Proof of conceptEPSS 18%

    juniper · junos os evolvedFeb 25, 2026

  • CVE-2026-27739
    36Monitor

    Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    angular · angular-cliFeb 25, 2026

  • CVE-2026-25746
    36Monitor

    OpenEMR has SQL Injection Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 3%

    open-emr · openemrFeb 25, 2026

  • CVE-2026-22719
    67This week

    VMware Aria Operations command injection vulnerability

    HighCVSS 8.1KEVWeaponizedEPSS 18%

    vmware · aria operationsFeb 25, 2026

  • CVE-2026-2636
    22Monitor

    Denial of Service in Microsoft OS

    MediumCVSS 5.5Proof of conceptEPSS 0%

    microsoft · windows osFeb 25, 2026

  • CVE-2026-0542
    36Monitor

    Remote Code Execution in ServiceNow AI Platform

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    servicenow · servicenow ai platformFeb 25, 2026

  • CVE-2026-27495
    37Monitor

    n8n has a Sandbox Escape in its JavaScript Task Runner

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    n8n · n8nFeb 25, 2026

  • CVE-2026-27577
    40Plan

    n8n: Expression Sandbox Escape Leads to RCE

    CriticalCVSS 9.4Proof of conceptEPSS 10%

    n8n · n8nFeb 25, 2026

  • CVE-2026-27831
    30Monitor

    rldns Vulnerable to Heap-based Out-of-Bounds Read

    HighCVSS 7.5Proof of conceptEPSS 0%

    bluedragonsecurity · rldnsFeb 25, 2026

  • CVE-2026-27884
    21Monitor

    NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

    MediumCVSS 5.3Proof of conceptEPSS 0%

    pennyw0rth · netexecFeb 25, 2026

  • CVE-2026-1557
    31Monitor

    WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src

    HighCVSS 7.5Proof of conceptEPSS 1%

    stuartbates · wp responsive imagesFeb 25, 2026

  • CVE-2026-27938
    30Monitor

    WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

    HighCVSS 7.7Proof of conceptEPSS 0%

    wp-graphql · wp-graphqlFeb 25, 2026

  • CVE-2026-27941
    39Monitor

    OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    openlit · openlit software development kitFeb 25, 2026

  • CVE-2026-27959
    30Monitor

    Koa has Host Header Injection via `ctx.hostname`

    HighCVSS 7.5Proof of conceptEPSS 0%

    koajs · koaFeb 25, 2026

  • CVE-2026-27966
    60This week

    Langflow has Remote Code Execution in CSV Agent

    CriticalCVSS 9.8WeaponizedEPSS 35%

    langflow · langflowFeb 25, 2026

  • CVE-2026-26077
    26Monitor

    Discourse doesn't ensure webhooks require a token

    MediumCVSS 6.5Proof of conceptEPSS 0%

    discourse · discourseFeb 26, 2026

  • CVE-2025-56605
    21Monitor

    A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Feb 26, 2026