По дате публикации
Эксплуатируемые и новые серьёзные CVE: февраль 2026 г.
305 записей · 20 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 4
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
42В плане | CVE-2026-25253Proof of concept | OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conneopenclaw · openclaw · CWE-669 | Высокая8,8 | — | 24,4 % | 1 февр. 2026 г. |
39Наблюдать | CVE-2025-15030Proof of concept | User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Resetunknown · user profile builder · CWE-269 | Критическая9,8 | — | 0,5 % | 2 февр. 2026 г. |
32Наблюдать | CVE-2025-9974Proof of concept | Insufficient Input Validation on WEBUI in Nokia ONT/Beacon productnokia · nokia ont · CWE-78 | Высокая8,0 | — | 0,4 % | 2 февр. 2026 г. |
26Наблюдать | CVE-2026-20404Proof of concept | In Modem, there is a possible system crash due to improper input validation.mediatek · nr15 · CWE-787 | Средняя6,5 | — | 0,4 % | 2 февр. 2026 г. |
39Наблюдать | CVE-2026-0599Эксплойта нет | Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inferencehuggingface · huggingface/text-generation-inference · CWE-400 | Высокая7,5 | — | 29,8 % | 2 февр. 2026 г. |
27Наблюдать | CVE-2026-1232Proof of concept | Anti-Tamper Bypass in BeyondTrust Privilege Management for Windowsbeyondtrust · privilege management for windows · CWE-693 | Средняя6,8 | — | 0,1 % | 2 февр. 2026 г. |
35Наблюдать | CVE-2026-22226Proof of concept | Command Injection Vulnerability on TP-Link Archer BE230 and AX73tp-link · archer be230 firmware · CWE-78 | Высокая8,5 | — | 2,5 % | 2 февр. 2026 г. |
60На этой неделе | CVE-2026-22778Готовый эксплойт | vLLM leaks a heap address when PIL throws an errorvllm · vllm · CWE-532 | Критическая9,8 | — | 16,6 % | 2 февр. 2026 г. |
39Наблюдать | CVE-2026-25137Эксплойта нет | NixOs Odoo database and filestore publicly accessible with default odoo configurationnixos · nixpkgs · CWE-306 | Критическая9,1 | — | 10,4 % | 2 февр. 2026 г. |
0Наблюдать | CVE-2025-61638Proof of concept | Sanitizer::validateAttributes data-XSSmediawiki · mediawiki · CWE-79 | —0,0 | — | 0,2 % | 2 февр. 2026 г. |
61На этой неделе | CVE-2025-15556Готовый эксплойт | Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verificationnotepad-plus-plus · notepad\+\+ · CWE-494 | Высокая7,7 | KEV | 1,7 % | 2 февр. 2026 г. |
32Наблюдать | CVE-2026-1375Proof of concept | Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletionthemeum · tutor lms – elearning and online course solution · CWE-639 | Высокая8,1 | — | 0,3 % | 3 февр. 2026 г. |
39Наблюдать | CVE-2025-5319Proof of concept | SQLi in Emit Informatics' DIGITA Efficiency Management Systememit informatics and communication technologies industry and trade ltd. co. · digita efficiency management system · CWE-89 | Критическая9,8 | — | 0,4 % | 3 февр. 2026 г. |
25Наблюдать | CVE-2026-1207Proof of concept | Potential SQL injection via raster lookups on PostGISdjangoproject · django · CWE-89 | Средняя5,4 | — | 12,8 % | 3 февр. 2026 г. |
21Наблюдать | CVE-2026-1312Proof of concept | Potential SQL injection via QuerySet.order_by and FilteredRelationdjangoproject · django · CWE-89 | Средняя5,4 | — | 0,9 % | 3 февр. 2026 г. |
27Наблюдать | CVE-2026-1814Proof of concept | Rapid7 Nexpose Insecure Java Keystore Password Generationrapid7 · insightvm/nexpose · CWE-331 | Средняя6,8 | — | 0,1 % | 3 февр. 2026 г. |
21Наблюдать | CVE-2026-24945Эксплойта нет | WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerabilitythemefic · ultimate addons for contact form 7 · CWE-862 | Средняя5,3 | — | 0,2 % | 3 февр. 2026 г. |
39Наблюдать | CVE-2025-57529Proof of concept | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input youdatasum · cpas audit management system · CWE-89 | Критическая9,8 | — | 0,6 % | 3 февр. 2026 г. |
39Наблюдать | CVE-2025-61506Proof of concept | An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /uplmediacrush · mediacrush · CWE-434 | Критическая9,8 | — | 0,6 % | 3 февр. 2026 г. |
21Наблюдать | CVE-2025-69848Proof of concept | NetBox is an open-source infrastructure resource modeling and IP address management platform.netbox · netbox · CWE-79 | Средняя5,4 | — | 0,3 % | 3 февр. 2026 г. |
40В плане | CVE-2025-69971Proof of concept | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.frangoteam · fuxa · CWE-798 | Критическая9,8 | — | 2,2 % | 3 февр. 2026 г. |
26Наблюдать | CVE-2025-70559Proof of concept | pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism.CWE-502 | Средняя6,5 | — | 0,3 % | 3 февр. 2026 г. |
24Наблюдать | CVE-2025-70849Proof of concept | Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /storstefanprodan · podinfo · CWE-79 | Средняя6,1 | — | 0,2 % | 3 февр. 2026 г. |
28Наблюдать | CVE-2025-62501Эксплойта нет | SSH Hostkey Misconfiguration Vulnerability in TP-Link Archer AX53tp-link · archer ax53 firmware · CWE-322 | Высокая7,0 | — | 0,5 % | 3 февр. 2026 г. |
24Наблюдать | CVE-2026-25616Proof of concept | Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.phillipsdata · blesta · CWE-79 | Средняя6,1 | — | 0,4 % | 3 февр. 2026 г. |
26Наблюдать | CVE-2026-1801Proof of concept | Libsoup: libsoup: http request smuggling via malformed chunk headersgnome · libsoup · CWE-444 | Средняя6,5 | — | 0,4 % | 3 февр. 2026 г. |
26Наблюдать | CVE-2026-24514Proof of concept | ingress-nginx Admission Controller denial of servicekubernetes · ingress-nginx · CWE-770 | Средняя6,5 | — | 0,5 % | 3 февр. 2026 г. |
28Наблюдать | CVE-2026-20980Proof of concept | Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.samsung · android · CWE-20 | Высокая7,0 | — | 0,2 % | 4 февр. 2026 г. |
26Наблюдать | CVE-2025-15260Proof of concept | MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modificationlwsdevelopers · myrewards · CWE-862 | Средняя6,5 | — | 0,3 % | 4 февр. 2026 г. |
17Наблюдать | CVE-2026-0743Proof of concept | WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameterorenhav · wp content permission · CWE-79 | Средняя4,4 | — | 0,6 % | 4 февр. 2026 г. |
39Наблюдать | CVE-2025-5329Proof of concept | SQLi in Martcode Software's Delta Course Automationmartcode software inc. · delta course automation · CWE-89 | Критическая9,8 | — | 0,5 % | 4 февр. 2026 г. |
24Наблюдать | CVE-2025-70545Proof of concept | A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmwabelden · ppc 2k05x firmware · CWE-79 | Средняя6,1 | — | 0,3 % | 4 февр. 2026 г. |
37Наблюдать | CVE-2026-25049Proof of concept | n8n Has an Expression Escape Vulnerability Leading to RCEn8n · n8n · CWE-913 | Критическая9,4 | — | 1,5 % | 4 февр. 2026 г. |
37Наблюдать | CVE-2026-25053Proof of concept | n8n is Vulnerable to OS Command Injection in Git Noden8n · n8n · CWE-78 | Критическая9,4 | — | 0,6 % | 4 февр. 2026 г. |
34Наблюдать | CVE-2025-69213Proof of concept | OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)devcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,4 % | 4 февр. 2026 г. |
34Наблюдать | CVE-2025-69215Proof of concept | OpenSTAManager has an SQL Injection in the Stampe Moduledevcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,4 % | 4 февр. 2026 г. |
33Наблюдать | CVE-2026-25513Proof of concept | FacturaScripts has SQL Injection vulnerability in API ORDER BY Clausefacturascripts · facturascripts · CWE-20 | Высокая8,3 | — | 0,5 % | 4 февр. 2026 г. |
34Наблюдать | CVE-2026-25514Proof of concept | FacturaScripts has SQL Injection vulnerability in Autocomplete Actionsfacturascripts · facturascripts · CWE-20 | Высокая8,7 | — | 0,5 % | 4 февр. 2026 г. |
38Наблюдать | CVE-2026-25512Proof of concept | Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handlergroup-office · group office · CWE-78 | Критическая9,4 | — | 3,8 % | 4 февр. 2026 г. |
39Наблюдать | CVE-2026-25526Proof of concept | JinJava Bypass through ForTag leads to Arbitrary Java Executionhubspot · jinjava · CWE-1336 | Критическая9,8 | — | 1,0 % | 4 февр. 2026 г. |
22Наблюдать | CVE-2026-25541Proof of concept | Bytes is vulnerable to integer overflow in BytesMut::reservetokio-rs · bytes · CWE-680 | Средняя5,5 | — | 0,6 % | 4 февр. 2026 г. |
31Наблюдать | CVE-2026-25546Proof of concept | Godot MCP is vulnerable to Command Injection via unsanitized projectPathcoding-solo · godot mcp · CWE-78 | Высокая7,8 | — | 1,0 % | 4 февр. 2026 г. |
36Наблюдать | CVE-2026-25547Эксплойта нет | Uncontrolled Resource Consumption in @isaacs/brace-expansionisaacs · brace-expansion · CWE-1333 | Критическая9,2 | — | 0,4 % | 4 февр. 2026 г. |
32Наблюдать | CVE-2026-22038Proof of concept | AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocksagpt · autogpt platform · CWE-532 | Высокая8,1 | — | 0,4 % | 4 февр. 2026 г. |
32Наблюдать | CVE-2026-1953Proof of concept | Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2nukegraphic cms · nukegraphic cms · CWE-79 | Высокая8,2 | — | 0,4 % | 5 февр. 2026 г. |
32Наблюдать | CVE-2025-68721Proof of concept | Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface.axigen · axigen mail server · CWE-284 | Высокая8,1 | — | 0,3 % | 5 февр. 2026 г. |
35Наблюдать | CVE-2025-68722Proof of concept | Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interaxigen · axigen mail server · CWE-352 | Высокая8,8 | — | 0,2 % | 5 февр. 2026 г. |
38Наблюдать | CVE-2020-37123Proof of concept | Pinger 1.0 - Remote Code Executionwcchandler · pinger · CWE-78 | Критическая9,3 | — | 3,3 % | 5 февр. 2026 г. |
36Наблюдать | CVE-2025-68723Proof of concept | Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface.axigen · axigen mail server · CWE-79 | Критическая9,0 | — | 0,2 % | 5 февр. 2026 г. |
35Наблюдать | CVE-2025-69906Proof of concept | Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.monstra · monstra cms · CWE-434 | Высокая8,8 | — | 0,7 % | 5 февр. 2026 г. |
14Наблюдать | CVE-2026-2000Эксплойта нет | DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injectiondcnetworks · dcme-320 firmware · CWE-74 | Низкая2,0 | — | 19,7 % | 6 февр. 2026 г. |
97Срочно | CVE-2026-21643Готовый эксплойт | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may afortinet · forticlientems · CWE-89 | Критическая9,8 | KEV | 93,8 % | 6 февр. 2026 г. |
4Наблюдать | CVE-2026-1337Proof of concept | Insufficient escaping of unicode characters in query logneo4j · neo4j · CWE-117 | Низкая1,1 | — | 0,2 % | 6 февр. 2026 г. |
22Наблюдать | CVE-2026-2058Proof of concept | mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injectionvishalmathur · cloudclassroom-php-project · CWE-74 | Средняя5,5 | — | 0,5 % | 6 февр. 2026 г. |
21Наблюдать | CVE-2026-1769Proof of concept | Stored XSS on Xerox CentreWare Web 7.0.6xerox · centreware web · CWE-79 | Средняя5,4 | — | 0,1 % | 6 февр. 2026 г. |
28Наблюдать | CVE-2026-24135Proof of concept | Gogs vulnerable to arbitrary file deletion via path traversal in wiki page updategogs · gogs · CWE-22 | Высокая7,2 | — | 0,9 % | 6 февр. 2026 г. |
34Наблюдать | CVE-2026-24419Proof of concept | OpenSTAManager has an SQL Injection in the Prima Nota moduledevcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,3 % | 6 февр. 2026 г. |
30Наблюдать | CVE-2026-25725Эксплойта нет | Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.jsonanthropic · claude code · CWE-501 | Высокая7,7 | — | 0,7 % | 6 февр. 2026 г. |
38Наблюдать | CVE-2025-69212Proof of concept | OpenSTAManager has an OS Command Injection in P7M File Processingdevcode · openstamanager · CWE-78 | Критическая9,4 | — | 1,9 % | 6 февр. 2026 г. |
34Наблюдать | CVE-2025-69214Proof of concept | OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)devcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,4 % | 6 февр. 2026 г. |
34Наблюдать | CVE-2025-69216Proof of concept | OpenSTAManager has an SQL Injection in Scadenzario Print Templatedevcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,3 % | 6 февр. 2026 г. |
32Наблюдать | CVE-2026-23989Proof of concept | REVA Public Link Exploitheinlein · opencloud reva · CWE-863 | Высокая8,1 | — | 0,3 % | 6 февр. 2026 г. |
34Наблюдать | CVE-2026-24416Proof of concept | OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Moduledevcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,4 % | 6 февр. 2026 г. |
34Наблюдать | CVE-2026-24417Proof of concept | OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Servicedevcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,4 % | 6 февр. 2026 г. |
34Наблюдать | CVE-2026-24418Proof of concept | OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations moduledevcode · openstamanager · CWE-89 | Высокая8,7 | — | 0,4 % | 6 февр. 2026 г. |
37Наблюдать | CVE-2026-25643Proof of concept | Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escapefrigate · frigate · CWE-78 | Критическая9,1 | — | 4,1 % | 6 февр. 2026 г. |
40В плане | CVE-2026-25632Proof of concept | EPyT-Flow has unsafe JSON deserialization (__type__)waterfutures · epyt-flow · CWE-502 | Критическая10,0 | — | 1,4 % | 6 февр. 2026 г. |
31Наблюдать | CVE-2026-25731Proof of concept | Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Exportcalibre-ebook · calibre · CWE-1336 | Высокая7,8 | — | 0,2 % | 6 февр. 2026 г. |
29Наблюдать | CVE-2025-68621Proof of concept | Trilium Notes has a Timing Attack Vulnerability in /api/login/synctriliumnotes · trilium · CWE-208 | Высокая7,4 | — | 0,5 % | 6 февр. 2026 г. |
97Срочно | CVE-2026-1731Готовый эксплойт | Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)beyondtrust · privileged remote access · CWE-78 | Критическая9,9 | KEV | 92,4 % | 6 февр. 2026 г. |
39Наблюдать | CVE-2026-25544Proof of concept | Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapterspayloadcms · payload · CWE-89 | Критическая9,8 | — | 0,9 % | 6 февр. 2026 г. |
31Наблюдать | CVE-2026-25732Proof of concept | NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Writezauberzeug · nicegui · CWE-22 | Высокая7,5 | — | 3,2 % | 6 февр. 2026 г. |
32Наблюдать | CVE-2026-2080Эксплойта нет | UTT HiPER 810 formUser setSysAdm command injectionutt · 810 firmware · CWE-74 | Высокая7,3 | — | 10,8 % | 7 февр. 2026 г. |
23Наблюдать | CVE-2026-2113Proof of concept | yuan1994 tpadmin WebUploader preview.php deserializationtpadmin project · tpadmin · CWE-20 | Средняя5,5 | — | 2,4 % | 7 февр. 2026 г. |
35Наблюдать | CVE-2026-25857Proof of concept | Tenda G300-F Command Injection via formSetWanDiagtenda · g300-f firmware · CWE-78 | Высокая8,6 | — | 3,1 % | 7 февр. 2026 г. |
35Наблюдать | CVE-2025-15100Proof of concept | JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profilejayarsiech · jay login & register · CWE-269 | Высокая8,8 | — | 0,3 % | 7 февр. 2026 г. |
13Наблюдать | CVE-2026-2131Эксплойта нет | XixianLiang HarmonyOS-mcp-server input_text os command injectionxixianliang · harmonyos mcp server · CWE-77 | Низкая2,1 | — | 17,4 % | 7 февр. 2026 г. |
31Наблюдать | CVE-2026-2143Эксплойта нет | D-Link DIR-823X DDNS Service set_ddns os command injectiondlink · dir-823x firmware · CWE-77 | Высокая7,3 | — | 5,0 % | 8 февр. 2026 г. |
30Наблюдать | CVE-2026-2184Эксплойта нет | Great Developers Certificate Generation System csv.php os command injectiongreatdevelopers · certificate · CWE-77 | Средняя6,9 | — | 10,6 % | 8 февр. 2026 г. |
30Наблюдать | CVE-2026-2210Эксплойта нет | D-Link DIR-823X set_filtering sub_4211C8 os command injectiondlink · dir-823x firmware · CWE-77 | Высокая7,3 | — | 4,5 % | 8 февр. 2026 г. |
7Наблюдать | CVE-2026-2222Proof of concept | code-projects Online Reviewer System btn_functions.php cross site scriptingfabian · online reviewer system · CWE-79 | Низкая1,9 | — | 0,2 % | 9 февр. 2026 г. |
17Наблюдать | CVE-2026-25916Proof of concept | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.roundcube · webmail · CWE-420 | Средняя4,3 | — | 0,5 % | 9 февр. 2026 г. |
32Наблюдать | CVE-2026-1529Proof of concept | Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationred hat · red hat build of keycloak 26.2 · CWE-347 | Высокая8,1 | — | 0,4 % | 9 февр. 2026 г. |
36Наблюдать | CVE-2026-25057Proof of concept | Zip Slip in MarkUs config upload allowing RCEmarkusproject · markus · CWE-23 | Критическая9,1 | — | 0,5 % | 9 февр. 2026 г. |
31Наблюдать | CVE-2026-25231Proof of concept | FileRise affected by an Unauthenticated File Read Due to Insufficient Access Controlfilerise · filerise · CWE-284 | Высокая7,5 | — | 1,7 % | 9 февр. 2026 г. |
34Наблюдать | CVE-2026-25498Эксплойта нет | Craft has a potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms · craft cms · CWE-470 | Высокая8,6 | — | 1,3 % | 9 февр. 2026 г. |
32Наблюдать | CVE-2026-25890Proof of concept | File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLfilebrowser · filebrowser · CWE-706 | Высокая8,1 | — | 0,6 % | 9 февр. 2026 г. |
31Наблюдать | CVE-2026-25892Proof of concept | Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpointadminer · adminer · CWE-20 | Высокая7,5 | — | 2,0 % | 9 февр. 2026 г. |
30Наблюдать | CVE-2026-25961Proof of concept | SumatraPDF Update MITM -> Arbitrary Code Executionsumatrapdfreader · sumatrapdf · CWE-295 | Высокая7,5 | — | 0,4 % | 9 февр. 2026 г. |
40В плане | CVE-2026-25895Proof of concept | FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIfrangoteam · fuxa · CWE-22 | Критическая9,5 | — | 6,9 % | 9 февр. 2026 г. |
38Наблюдать | CVE-2026-25938Proof of concept | FUXA Unauthenticated Remote Code Execution in Node-RED Integrationfrangoteam · fuxa · CWE-290 | Критическая9,5 | — | 1,4 % | 9 февр. 2026 г. |
37Наблюдать | CVE-2026-25939Proof of concept | FUXA Unauthenticated Remote Arbitrary Scheduler Writefrangoteam · fuxa · CWE-862 | Критическая9,3 | — | 0,9 % | 9 февр. 2026 г. |
35Наблюдать | CVE-2025-11142Proof of concept | The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.axis · axis os · CWE-78 | Высокая8,8 | — | 0,5 % | 10 февр. 2026 г. |
28Наблюдать | CVE-2025-62676Proof of concept | An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 fortinet · forticlient · CWE-59 | Высокая7,1 | — | 0,2 % | 10 февр. 2026 г. |
62На этой неделе | CVE-2025-68686Готовый эксплойт | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,fortinet · fortios · CWE-200 | Средняя5,9 | KEV | 29,4 % | 10 февр. 2026 г. |
87Срочно | CVE-2026-1603Готовый эксплойт | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific storedivanti · endpoint manager · CWE-288 | Высокая7,5 | KEV | 88,3 % | 10 февр. 2026 г. |
27Наблюдать | CVE-2026-0651Proof of concept | Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local httpstp-link · tapo c260 firmware · CWE-22 | Средняя6,9 | — | 0,3 % | 10 февр. 2026 г. |
41В плане | CVE-2026-0652Эксплойта нет | Remote Code Execution on TP-Link Tapo C260 by Guest Usertp-link · tapo c260 firmware · CWE-78 | Высокая8,7 | — | 23,3 % | 10 февр. 2026 г. |
34Наблюдать | CVE-2026-20841Proof of concept | Windows Notepad App Remote Code Execution Vulnerabilitymicrosoft · windows notepad · CWE-77 | Высокая7,8 | — | 9,0 % | 10 февр. 2026 г. |
29Наблюдать | CVE-2026-21244Proof of concept | Windows Hyper-V Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 | Высокая7,3 | — | 1,3 % | 10 февр. 2026 г. |
- CVE-2026-2525342В плане
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conne
ВысокаяCVSS 8,8Proof of conceptEPSS 24 %openclaw · openclaw1 февр. 2026 г.
- CVE-2025-1503039Наблюдать
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
КритическаяCVSS 9,8Proof of conceptEPSS 0 %unknown · user profile builder2 февр. 2026 г.
- CVE-2025-997432Наблюдать
Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product
ВысокаяCVSS 8,0Proof of conceptEPSS 0 %nokia · nokia ont2 февр. 2026 г.
- CVE-2026-2040426Наблюдать
In Modem, there is a possible system crash due to improper input validation.
СредняяCVSS 6,5Proof of conceptEPSS 0 %mediatek · nr152 февр. 2026 г.
- CVE-2026-059939Наблюдать
Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference
ВысокаяCVSS 7,5Эксплойта нетEPSS 29 %huggingface · huggingface/text-generation-inference2 февр. 2026 г.
- CVE-2026-123227Наблюдать
Anti-Tamper Bypass in BeyondTrust Privilege Management for Windows
СредняяCVSS 6,8Proof of conceptEPSS 0 %beyondtrust · privilege management for windows2 февр. 2026 г.
- CVE-2026-2222635Наблюдать
Command Injection Vulnerability on TP-Link Archer BE230 and AX73
ВысокаяCVSS 8,5Proof of conceptEPSS 2 %tp-link · archer be230 firmware2 февр. 2026 г.
- CVE-2026-2277860На этой неделе
vLLM leaks a heap address when PIL throws an error
КритическаяCVSS 9,8Готовый эксплойтEPSS 16 %vllm · vllm2 февр. 2026 г.
- CVE-2026-2513739Наблюдать
NixOs Odoo database and filestore publicly accessible with default odoo configuration
КритическаяCVSS 9,1Эксплойта нетEPSS 10 %nixos · nixpkgs2 февр. 2026 г.
- CVE-2025-616380Наблюдать
Sanitizer::validateAttributes data-XSS
CVSS 0,0Proof of conceptEPSS 0 %mediawiki · mediawiki2 февр. 2026 г.
- CVE-2025-1555661На этой неделе
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
ВысокаяCVSS 7,7KEVГотовый эксплойтEPSS 1 %notepad-plus-plus · notepad\+\+2 февр. 2026 г.
- CVE-2026-137532Наблюдать
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %themeum · tutor lms – elearning and online course solution3 февр. 2026 г.
- CVE-2025-531939Наблюдать
SQLi in Emit Informatics' DIGITA Efficiency Management System
КритическаяCVSS 9,8Proof of conceptEPSS 0 %emit informatics and communication technologies industry and trade ltd. co. · digita efficiency management system3 февр. 2026 г.
- CVE-2026-120725Наблюдать
Potential SQL injection via raster lookups on PostGIS
СредняяCVSS 5,4Proof of conceptEPSS 12 %djangoproject · django3 февр. 2026 г.
- CVE-2026-131221Наблюдать
Potential SQL injection via QuerySet.order_by and FilteredRelation
СредняяCVSS 5,4Proof of conceptEPSS 0 %djangoproject · django3 февр. 2026 г.
- CVE-2026-181427Наблюдать
Rapid7 Nexpose Insecure Java Keystore Password Generation
СредняяCVSS 6,8Proof of conceptEPSS 0 %rapid7 · insightvm/nexpose3 февр. 2026 г.
- CVE-2026-2494521Наблюдать
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability
СредняяCVSS 5,3Эксплойта нетEPSS 0 %themefic · ultimate addons for contact form 73 февр. 2026 г.
- CVE-2025-5752939Наблюдать
YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input
КритическаяCVSS 9,8Proof of conceptEPSS 0 %youdatasum · cpas audit management system3 февр. 2026 г.
- CVE-2025-6150639Наблюдать
An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upl
КритическаяCVSS 9,8Proof of conceptEPSS 0 %mediacrush · mediacrush3 февр. 2026 г.
- CVE-2025-6984821Наблюдать
NetBox is an open-source infrastructure resource modeling and IP address management platform.
СредняяCVSS 5,4Proof of conceptEPSS 0 %netbox · netbox3 февр. 2026 г.
- CVE-2025-6997140В плане
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.
КритическаяCVSS 9,8Proof of conceptEPSS 2 %frangoteam · fuxa3 февр. 2026 г.
- CVE-2025-7055926Наблюдать
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism.
СредняяCVSS 6,5Proof of conceptEPSS 0 %3 февр. 2026 г.
- CVE-2025-7084924Наблюдать
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /stor
СредняяCVSS 6,1Proof of conceptEPSS 0 %stefanprodan · podinfo3 февр. 2026 г.
- CVE-2025-6250128Наблюдать
SSH Hostkey Misconfiguration Vulnerability in TP-Link Archer AX53
ВысокаяCVSS 7,0Эксплойта нетEPSS 0 %tp-link · archer ax53 firmware3 февр. 2026 г.
- CVE-2026-2561624Наблюдать
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.
СредняяCVSS 6,1Proof of conceptEPSS 0 %phillipsdata · blesta3 февр. 2026 г.
- CVE-2026-180126Наблюдать
Libsoup: libsoup: http request smuggling via malformed chunk headers
СредняяCVSS 6,5Proof of conceptEPSS 0 %gnome · libsoup3 февр. 2026 г.
- CVE-2026-2451426Наблюдать
ingress-nginx Admission Controller denial of service
СредняяCVSS 6,5Proof of conceptEPSS 0 %kubernetes · ingress-nginx3 февр. 2026 г.
- CVE-2026-2098028Наблюдать
Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %samsung · android4 февр. 2026 г.
- CVE-2025-1526026Наблюдать
MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
СредняяCVSS 6,5Proof of conceptEPSS 0 %lwsdevelopers · myrewards4 февр. 2026 г.
- CVE-2026-074317Наблюдать
WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter
СредняяCVSS 4,4Proof of conceptEPSS 0 %orenhav · wp content permission4 февр. 2026 г.
- CVE-2025-532939Наблюдать
SQLi in Martcode Software's Delta Course Automation
КритическаяCVSS 9,8Proof of conceptEPSS 0 %martcode software inc. · delta course automation4 февр. 2026 г.
- CVE-2025-7054524Наблюдать
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmwa
СредняяCVSS 6,1Proof of conceptEPSS 0 %belden · ppc 2k05x firmware4 февр. 2026 г.
- CVE-2026-2504937Наблюдать
n8n Has an Expression Escape Vulnerability Leading to RCE
КритическаяCVSS 9,4Proof of conceptEPSS 1 %n8n · n8n4 февр. 2026 г.
- CVE-2026-2505337Наблюдать
n8n is Vulnerable to OS Command Injection in Git Node
КритическаяCVSS 9,4Proof of conceptEPSS 0 %n8n · n8n4 февр. 2026 г.
- CVE-2025-6921334Наблюдать
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager4 февр. 2026 г.
- CVE-2025-6921534Наблюдать
OpenSTAManager has an SQL Injection in the Stampe Module
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager4 февр. 2026 г.
- CVE-2026-2551333Наблюдать
FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
ВысокаяCVSS 8,3Proof of conceptEPSS 0 %facturascripts · facturascripts4 февр. 2026 г.
- CVE-2026-2551434Наблюдать
FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %facturascripts · facturascripts4 февр. 2026 г.
- CVE-2026-2551238Наблюдать
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
КритическаяCVSS 9,4Proof of conceptEPSS 3 %group-office · group office4 февр. 2026 г.
- CVE-2026-2552639Наблюдать
JinJava Bypass through ForTag leads to Arbitrary Java Execution
КритическаяCVSS 9,8Proof of conceptEPSS 1 %hubspot · jinjava4 февр. 2026 г.
- CVE-2026-2554122Наблюдать
Bytes is vulnerable to integer overflow in BytesMut::reserve
СредняяCVSS 5,5Proof of conceptEPSS 0 %tokio-rs · bytes4 февр. 2026 г.
- CVE-2026-2554631Наблюдать
Godot MCP is vulnerable to Command Injection via unsanitized projectPath
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %coding-solo · godot mcp4 февр. 2026 г.
- CVE-2026-2554736Наблюдать
Uncontrolled Resource Consumption in @isaacs/brace-expansion
КритическаяCVSS 9,2Эксплойта нетEPSS 0 %isaacs · brace-expansion4 февр. 2026 г.
- CVE-2026-2203832Наблюдать
AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %agpt · autogpt platform4 февр. 2026 г.
- CVE-2026-195332Наблюдать
Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %nukegraphic cms · nukegraphic cms5 февр. 2026 г.
- CVE-2025-6872132Наблюдать
Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface.
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %axigen · axigen mail server5 февр. 2026 г.
- CVE-2025-6872235Наблюдать
Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin inter
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %axigen · axigen mail server5 февр. 2026 г.
- CVE-2020-3712338Наблюдать
Pinger 1.0 - Remote Code Execution
КритическаяCVSS 9,3Proof of conceptEPSS 3 %wcchandler · pinger5 февр. 2026 г.
- CVE-2025-6872336Наблюдать
Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface.
КритическаяCVSS 9,0Proof of conceptEPSS 0 %axigen · axigen mail server5 февр. 2026 г.
- CVE-2025-6990635Наблюдать
Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %monstra · monstra cms5 февр. 2026 г.
- CVE-2026-200014Наблюдать
DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 19 %dcnetworks · dcme-320 firmware6 февр. 2026 г.
- CVE-2026-2164397Срочно
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may a
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 93 %fortinet · forticlientems6 февр. 2026 г.
- CVE-2026-13374Наблюдать
Insufficient escaping of unicode characters in query log
НизкаяCVSS 1,1Proof of conceptEPSS 0 %neo4j · neo4j6 февр. 2026 г.
- CVE-2026-205822Наблюдать
mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %vishalmathur · cloudclassroom-php-project6 февр. 2026 г.
- CVE-2026-176921Наблюдать
Stored XSS on Xerox CentreWare Web 7.0.6
СредняяCVSS 5,4Proof of conceptEPSS 0 %xerox · centreware web6 февр. 2026 г.
- CVE-2026-2413528Наблюдать
Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %gogs · gogs6 февр. 2026 г.
- CVE-2026-2441934Наблюдать
OpenSTAManager has an SQL Injection in the Prima Nota module
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager6 февр. 2026 г.
- CVE-2026-2572530Наблюдать
Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json
ВысокаяCVSS 7,7Эксплойта нетEPSS 0 %anthropic · claude code6 февр. 2026 г.
- CVE-2025-6921238Наблюдать
OpenSTAManager has an OS Command Injection in P7M File Processing
КритическаяCVSS 9,4Proof of conceptEPSS 1 %devcode · openstamanager6 февр. 2026 г.
- CVE-2025-6921434Наблюдать
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager6 февр. 2026 г.
- CVE-2025-6921634Наблюдать
OpenSTAManager has an SQL Injection in Scadenzario Print Template
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager6 февр. 2026 г.
- CVE-2026-2398932Наблюдать
REVA Public Link Exploit
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %heinlein · opencloud reva6 февр. 2026 г.
- CVE-2026-2441634Наблюдать
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager6 февр. 2026 г.
- CVE-2026-2441734Наблюдать
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager6 февр. 2026 г.
- CVE-2026-2441834Наблюдать
OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %devcode · openstamanager6 февр. 2026 г.
- CVE-2026-2564337Наблюдать
Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
КритическаяCVSS 9,1Proof of conceptEPSS 4 %frigate · frigate6 февр. 2026 г.
- CVE-2026-2563240В плане
EPyT-Flow has unsafe JSON deserialization (__type__)
КритическаяCVSS 10,0Proof of conceptEPSS 1 %waterfutures · epyt-flow6 февр. 2026 г.
- CVE-2026-2573131Наблюдать
Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %calibre-ebook · calibre6 февр. 2026 г.
- CVE-2025-6862129Наблюдать
Trilium Notes has a Timing Attack Vulnerability in /api/login/sync
ВысокаяCVSS 7,4Proof of conceptEPSS 0 %triliumnotes · trilium6 февр. 2026 г.
- CVE-2026-173197Срочно
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
КритическаяCVSS 9,9KEVГотовый эксплойтEPSS 92 %beyondtrust · privileged remote access6 февр. 2026 г.
- CVE-2026-2554439Наблюдать
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
КритическаяCVSS 9,8Proof of conceptEPSS 0 %payloadcms · payload6 февр. 2026 г.
- CVE-2026-2573231Наблюдать
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %zauberzeug · nicegui6 февр. 2026 г.
- CVE-2026-208032Наблюдать
UTT HiPER 810 formUser setSysAdm command injection
ВысокаяCVSS 7,3Эксплойта нетEPSS 10 %utt · 810 firmware7 февр. 2026 г.
- CVE-2026-211323Наблюдать
yuan1994 tpadmin WebUploader preview.php deserialization
СредняяCVSS 5,5Proof of conceptEPSS 2 %tpadmin project · tpadmin7 февр. 2026 г.
- CVE-2026-2585735Наблюдать
Tenda G300-F Command Injection via formSetWanDiag
ВысокаяCVSS 8,6Proof of conceptEPSS 3 %tenda · g300-f firmware7 февр. 2026 г.
- CVE-2025-1510035Наблюдать
JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %jayarsiech · jay login & register7 февр. 2026 г.
- CVE-2026-213113Наблюдать
XixianLiang HarmonyOS-mcp-server input_text os command injection
НизкаяCVSS 2,1Эксплойта нетEPSS 17 %xixianliang · harmonyos mcp server7 февр. 2026 г.
- CVE-2026-214331Наблюдать
D-Link DIR-823X DDNS Service set_ddns os command injection
ВысокаяCVSS 7,3Эксплойта нетEPSS 5 %dlink · dir-823x firmware8 февр. 2026 г.
- CVE-2026-218430Наблюдать
Great Developers Certificate Generation System csv.php os command injection
СредняяCVSS 6,9Эксплойта нетEPSS 10 %greatdevelopers · certificate8 февр. 2026 г.
- CVE-2026-221030Наблюдать
D-Link DIR-823X set_filtering sub_4211C8 os command injection
ВысокаяCVSS 7,3Эксплойта нетEPSS 4 %dlink · dir-823x firmware8 февр. 2026 г.
- CVE-2026-22227Наблюдать
code-projects Online Reviewer System btn_functions.php cross site scripting
НизкаяCVSS 1,9Proof of conceptEPSS 0 %fabian · online reviewer system9 февр. 2026 г.
- CVE-2026-2591617Наблюдать
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
СредняяCVSS 4,3Proof of conceptEPSS 0 %roundcube · webmail9 февр. 2026 г.
- CVE-2026-152932Наблюдать
Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %red hat · red hat build of keycloak 26.29 февр. 2026 г.
- CVE-2026-2505736Наблюдать
Zip Slip in MarkUs config upload allowing RCE
КритическаяCVSS 9,1Proof of conceptEPSS 0 %markusproject · markus9 февр. 2026 г.
- CVE-2026-2523131Наблюдать
FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %filerise · filerise9 февр. 2026 г.
- CVE-2026-2549834Наблюдать
Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
ВысокаяCVSS 8,6Эксплойта нетEPSS 1 %craftcms · craft cms9 февр. 2026 г.
- CVE-2026-2589032Наблюдать
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %filebrowser · filebrowser9 февр. 2026 г.
- CVE-2026-2589231Наблюдать
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %adminer · adminer9 февр. 2026 г.
- CVE-2026-2596130Наблюдать
SumatraPDF Update MITM -> Arbitrary Code Execution
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %sumatrapdfreader · sumatrapdf9 февр. 2026 г.
- CVE-2026-2589540В плане
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
КритическаяCVSS 9,5Proof of conceptEPSS 6 %frangoteam · fuxa9 февр. 2026 г.
- CVE-2026-2593838Наблюдать
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
КритическаяCVSS 9,5Proof of conceptEPSS 1 %frangoteam · fuxa9 февр. 2026 г.
- CVE-2026-2593937Наблюдать
FUXA Unauthenticated Remote Arbitrary Scheduler Write
КритическаяCVSS 9,3Proof of conceptEPSS 0 %frangoteam · fuxa9 февр. 2026 г.
- CVE-2025-1114235Наблюдать
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %axis · axis os10 февр. 2026 г.
- CVE-2025-6267628Наблюдать
An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %fortinet · forticlient10 февр. 2026 г.
- CVE-2025-6868662На этой неделе
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,
СредняяCVSS 5,9KEVГотовый эксплойтEPSS 29 %fortinet · fortios10 февр. 2026 г.
- CVE-2026-160387Срочно
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 88 %ivanti · endpoint manager10 февр. 2026 г.
- CVE-2026-065127Наблюдать
Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https
СредняяCVSS 6,9Proof of conceptEPSS 0 %tp-link · tapo c260 firmware10 февр. 2026 г.
- CVE-2026-065241В плане
Remote Code Execution on TP-Link Tapo C260 by Guest User
ВысокаяCVSS 8,7Эксплойта нетEPSS 23 %tp-link · tapo c260 firmware10 февр. 2026 г.
- CVE-2026-2084134Наблюдать
Windows Notepad App Remote Code Execution Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 9 %microsoft · windows notepad10 февр. 2026 г.
- CVE-2026-2124429Наблюдать
Windows Hyper-V Remote Code Execution Vulnerability
ВысокаяCVSS 7,3Proof of conceptEPSS 1 %microsoft · windows 10 160710 февр. 2026 г.