CVE-2026-2889 - CCExtractor mp4.c processmp4 use after free
Published: Sat, 21 Feb 2026 22:15:59 +0000
CVE ID : CVE-2026-2889
Published : Feb. 21, 2026, 10:15 p.m. | 36 minutes ago
Description : A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2887 - aardappel lobster idents.h TypeName recursion
Published: Sat, 21 Feb 2026 21:16:11 +0000
CVE ID : CVE-2026-2887
Published : Feb. 21, 2026, 9:16 p.m. | 1 hour, 35 minutes ago
Description : A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents.h. Such manipulation leads to uncontrolled recursion. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.1 will fix this issue. The name of the patch is 8ba49f98ccfc9734ef352146806433a41d9f9aa6. It is advisable to upgrade the affected component.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2886 - Tenda A21 SetOnlineDevName set_device_name stack-based overflow
Published: Sat, 21 Feb 2026 21:16:11 +0000
CVE ID : CVE-2026-2886
Published : Feb. 21, 2026, 9:16 p.m. | 1 hour, 35 minutes ago
Description : A weakness has been identified in Tenda A21 1.0.0.0. This affects the function set_device_name of the file /goform/SetOnlineDevName. This manipulation of the argument devName causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2885 - D-Link DWR-M960 formIpv6Setup sub_469104 stack-based overflow
Published: Sat, 21 Feb 2026 21:16:10 +0000
CVE ID : CVE-2026-2885
Published : Feb. 21, 2026, 9:16 p.m. | 1 hour, 35 minutes ago
Description : A security flaw has been discovered in D-Link DWR-M960 1.01.07. The impacted element is the function sub_469104 of the file /boafrm/formIpv6Setup. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2884 - D-Link DWR-M960 WAN Interface Setting formWanConfigSetup sub_41914C stack-based overflow
Published: Sat, 21 Feb 2026 21:16:10 +0000
CVE ID : CVE-2026-2884
Published : Feb. 21, 2026, 9:16 p.m. | 1 hour, 35 minutes ago
Description : A vulnerability was identified in D-Link DWR-M960 1.01.07. The affected element is the function sub_41914C of the file /boafrm/formWanConfigSetup of the component WAN Interface Setting Handler. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2883 - D-Link DWR-M960 formIpQoS sub_427D74 stack-based overflow
Published: Sat, 21 Feb 2026 20:16:40 +0000
CVE ID : CVE-2026-2883
Published : Feb. 21, 2026, 8:16 p.m. | 2 hours, 35 minutes ago
Description : A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2882 - D-Link DWR-M960 formDosCfg sub_46385C stack-based overflow
Published: Sat, 21 Feb 2026 20:16:40 +0000
CVE ID : CVE-2026-2882
Published : Feb. 21, 2026, 8:16 p.m. | 2 hours, 35 minutes ago
Description : A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_46385C of the file /boafrm/formDosCfg. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2881 - D-Link DWR-M960 Advanced Firewall Configuration Endpoint formFirewallAdv sub_425FF8 stack-based overflow
Published: Sat, 21 Feb 2026 20:16:39 +0000
CVE ID : CVE-2026-2881
Published : Feb. 21, 2026, 8:16 p.m. | 2 hours, 35 minutes ago
Description : A vulnerability has been found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_425FF8 of the file /boafrm/formFirewallAdv of the component Advanced Firewall Configuration Endpoint. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2877 - Tenda A18 Httpd Service WifiExtraSet strcpy stack-based overflow
Published: Sat, 21 Feb 2026 19:15:58 +0000
CVE ID : CVE-2026-2877
Published : Feb. 21, 2026, 7:15 p.m. | 3 hours, 36 minutes ago
Description : A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2876 - Tenda A18 setBlackRule parse_macfilter_rule stack-based overflow
Published: Sat, 21 Feb 2026 18:16:00 +0000
CVE ID : CVE-2026-2876
Published : Feb. 21, 2026, 6:16 p.m. | 4 hours, 36 minutes ago
Description : A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2874 - Tenda A21 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow
Published: Sat, 21 Feb 2026 18:15:59 +0000
CVE ID : CVE-2026-2874
Published : Feb. 21, 2026, 6:15 p.m. | 4 hours, 36 minutes ago
Description : A flaw has been found in Tenda A21 1.0.0.0. Impacted is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. Executing a manipulation of the argument ssid can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2873 - Tenda A21 openSchedWifi setSchedWifi stack-based overflow
Published: Sat, 21 Feb 2026 17:15:58 +0000
CVE ID : CVE-2026-2873
Published : Feb. 21, 2026, 5:15 p.m. | 5 hours, 36 minutes ago
Description : A vulnerability was detected in Tenda A21 1.0.0.0. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2872 - Tenda A21 MAC Filtering Configuration Endpoint setBlackRule set_device_name stack-based overflow
Published: Sat, 21 Feb 2026 16:16:05 +0000
CVE ID : CVE-2026-2872
Published : Feb. 21, 2026, 4:16 p.m. | 6 hours, 35 minutes ago
Description : A security vulnerability has been detected in Tenda A21 1.0.0.0. This vulnerability affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuration Endpoint. Such manipulation of the argument devName/mac leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2871 - Tenda A21 SetIpMacBind fromSetIpMacBind stack-based overflow
Published: Sat, 21 Feb 2026 16:16:05 +0000
CVE ID : CVE-2026-2871
Published : Feb. 21, 2026, 4:16 p.m. | 6 hours, 35 minutes ago
Description : A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manipulation of the argument list causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2870 - Tenda A21 formSetQosBand set_qosMib_list stack-based overflow
Published: Sat, 21 Feb 2026 15:15:59 +0000
CVE ID : CVE-2026-2870
Published : Feb. 21, 2026, 3:15 p.m. | 7 hours, 36 minutes ago
Description : A security flaw has been discovered in Tenda A21 1.0.0.0. Affected by this issue is the function set_qosMib_list of the file /goform/formSetQosBand. The manipulation of the argument list results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Severity: 9.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2869 - janet-lang janet handleattr specials.c janetc_varset out-of-bounds
Published: Sat, 21 Feb 2026 15:15:58 +0000
CVE ID : CVE-2026-2869
Published : Feb. 21, 2026, 3:15 p.m. | 7 hours, 36 minutes ago
Description : A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetc_varset of the file src/core/specials.c of the component handleattr Handler. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 1.41.0 addresses this issue. The identifier of the patch is 2fabc80151a2b8834ee59cda8a70453f848b40e5. The affected component should be upgraded.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-2867 - itsourcecode Vehicle Management System billaction.php sql injection
Published: Sat, 21 Feb 2026 14:15:57 +0000
CVE ID : CVE-2026-2867
Published : Feb. 21, 2026, 2:15 p.m. | 8 hours, 36 minutes ago
Description : A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27579 - CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure
Published: Sat, 21 Feb 2026 11:15:57 +0000
CVE ID : CVE-2026-27579
Published : Feb. 21, 2026, 11:15 a.m. | 11 hours, 36 minutes ago
Description : CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue authenticated cross-origin requests and read sensitive user account information, including email address, account identifiers, and MFA status. The issue did not have a fix at the time of publication.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27574 - OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE
Published: Sat, 21 Feb 2026 11:15:57 +0000
CVE ID : CVE-2026-27574
Published : Feb. 21, 2026, 11:15 a.m. | 11 hours, 36 minutes ago
Description : OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27492 - Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused
Published: Sat, 21 Feb 2026 11:15:57 +0000
CVE ID : CVE-2026-27492
Published : Feb. 21, 2026, 11:15 a.m. | 11 hours, 36 minutes ago
Description : Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected. This issue has been fixed in version 1.5.1.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-1787 - LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion
Published: Sat, 21 Feb 2026 11:15:55 +0000
CVE ID : CVE-2026-1787
Published : Feb. 21, 2026, 11:15 a.m. | 11 hours, 36 minutes ago
Description : The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27576 - OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs
Published: Sat, 21 Feb 2026 10:16:13 +0000
CVE ID : CVE-2026-27576
Published : Feb. 21, 2026, 10:16 a.m. | 12 hours, 35 minutes ago
Description : OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unusually large inputs. This issue has been fixed in version 2026.2.19.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27488 - OpenClaw hardened cron webhook delivery against SSRF
Published: Sat, 21 Feb 2026 10:16:13 +0000
CVE ID : CVE-2026-27488
Published : Feb. 21, 2026, 10:16 a.m. | 12 hours, 35 minutes ago
Description : OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27487 - OpenClaw: Prevent shell injection in macOS keychain credential write
Published: Sat, 21 Feb 2026 10:16:13 +0000
CVE ID : CVE-2026-27487
Published : Feb. 21, 2026, 10:16 a.m. | 12 hours, 35 minutes ago
Description : OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk. This issue has been fixed in version 2026.2.14.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-27486 - OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup
Published: Sat, 21 Feb 2026 10:16:12 +0000
CVE ID : CVE-2026-27486
Published : Feb. 21, 2026, 10:16 a.m. | 12 hours, 35 minutes ago
Description : OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process. On shared hosts, unrelated processes can be terminated if they match the pattern. The CLI runner cleanup helpers can kill processes matched by command-line patterns without validating process ownership. This issue has been fixed in version 2026.2.14.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
