2026-02-20

CVE-2019-25441 Feb 20, 23:16 CRITICAL POC Act Now

Unauthenticated command injection in thesystem 1.0. EPSS 3.4%. PoC available.

CVE-2026-26725 Feb 20, 17:25 CRITICAL POC Act Now

Privilege escalation in Print Shop Pro WebDesk v.18.34 via AccessID parameter. PoC available.

CVE-2026-26722 Feb 20, 17:25 CRITICAL POC Act Now

Privilege escalation in Key Systems Global Facilities Management Software via PIN component. PoC available.

CVE-2026-26980 Feb 20, 02:16 CRITICAL POC PATCH GHSA Act Now

SQL injection in Ghost CMS versions 3.24.0 through 6.19.0 allows unauthenticated attackers to read arbitrary database data. Patch available.

CVE-2026-25896 Feb 20, 21:19 CRITICAL POC PATCH Act Now

ReDoS in fast-xml-parser before fix via crafted XML. PoC and patch available.

CVE-2019-25444 Feb 20, 19:23 CRITICAL POC Act Now

SQL injection in Fiverr Clone Script 1.2.2. PoC available.

CVE-2026-26747 Feb 20, 17:25 CRITICAL POC Act Now

Host Header Poisoning in Monica 4.1.2 CRM. PoC available.

CVE-2026-26988 Feb 20, 02:16 CRITICAL POC PATCH Act Now

SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.

Unauthenticated OS command injection in PROLiNK PRC2402M router via ip parameter. EPSS 0.39%.

CVE-2025-30412 Feb 20, 01:15 CRITICAL Act Now

Second improper authentication in Acronis Cyber Protect 16. CVSS 10.0.

CVE-2025-30411 Feb 20, 01:15 CRITICAL Act Now

Improper authentication in Acronis Cyber Protect 16. CVSS 10.0.

CVE-2025-30416 Feb 20, 01:15 CRITICAL Act Now

Missing authorization in Acronis Cyber Protect 16 allows sensitive data access. CVSS 10.0.

CVE-2026-27112 Feb 20, 22:16 CRITICAL PATCH Act Now

Authorization bypass in Kargo Kubernetes promotion tool from 1.7.0 before 1.7.8/1.8.11/1.9.3. Batch resource creation bypasses authorization checks. Patch available.

CVE-2026-2039 Feb 20, 23:16 CRITICAL Act Now

Auth bypass in GFI Archiver via MArc.Store missing authorization. EPSS 0.59%.

CVE-2026-2038 Feb 20, 23:16 CRITICAL Act Now

Auth bypass in GFI Archiver via MArc.Core missing authorization. EPSS 0.59%.

CVE-2025-67979 Feb 20, 16:22 CRITICAL Act Now

Code injection in WPForms Google Sheet Connector (gsheetconnector-wpforms) WordPress plugin allows arbitrary code execution.

CVE-2025-69403 Feb 20, 16:22 CRITICAL Act Now

Unrestricted file upload in Bravis Addons (bravis-addons) WordPress theme allows uploading web shells for remote code execution.

CVE-2025-68549 Feb 20, 16:22 CRITICAL Act Now

Unrestricted file upload in Wiguard (wiguard) WordPress theme allows uploading web shells for remote code execution.

CVE-2025-70831 Feb 20, 16:22 CRITICAL Act Now

RCE in Smanga 3.2.7 via command injection in /php/path/rescan.php. EPSS 0.29%.

CVE-2026-26093 Feb 20, 17:25 CRITICAL Act Now

Command injection in Owl OPDS 2.2.0.4. EPSS 0.29%.

CVE-2026-2333 Feb 20, 17:25 CRITICAL Act Now

Command injection in Owl OPDS 2.2.0.4 — duplicate of CVE-2026-26093.

CVE-2026-26974 Feb 20, 01:16 CRITICAL PATCH Act Now

Code inclusion from untrusted source in Slyde presentation tool 0.0.4 and below. Automatically imports plugin files. Patch available.

Blank admin credentials allowed in device web management. Admin can set empty password, making device fully accessible.

CVE-2026-27002 Feb 20, 00:16 CRITICAL PATCH Act Now

Configuration injection in OpenClaw Docker sandbox before 2026.2.15 allows escaping sandbox restrictions. Patch available.

CVE-2026-22384 Feb 20, 16:22 CRITICAL Act Now

leafcolor Applay - Shortcodes applay-shortcodes is affected by deserialization of untrusted data (CVSS 8.8).

CVE-2025-69405 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Lorem Ipsum Books & Media (lorem-ipsum-books-media-store) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69404 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Extreme Store (extremestore) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69382 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Themesflat Elementor (themesflat-elementor) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69372 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in SevenHills (sevenhills) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69371 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in KindlyCare (kindlycare) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69370 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Capella (capella) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69329 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Prestige (prestige) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-69301 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in PhotoMe (photome) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-68541 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Ippsum (ippsum) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-67997 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Travelicious (travelicious) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-67996 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in Nestin (nestin) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

CVE-2025-67995 Feb 20, 16:22 CRITICAL Act Now

Deserialization of untrusted data in PatioTime (patiotime) WordPress theme allows PHP Object Injection, potentially enabling remote code execution through POP chains.

SQL injection in Kolay Software Talentics.

CVE-2025-30410 Feb 20, 01:15 CRITICAL Act Now

Missing authentication in Acronis Cyber Protect Cloud Agent (Linux, Windows, macOS).

CVE-2025-70833 Feb 20, 17:25 CRITICAL Act Now

Auth bypass in Smanga 3.2.7 allows unauthenticated password reset for any user including admin.

CVE-2026-24956 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Download Manager Addons for Elementor (download-manager-addons-for-elementor) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69366 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Emerce Core (emerce-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69365 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Uroan Core (uroan-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69337 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Wolmart Core (wolmart-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69310 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Woodly Core (woodly-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69309 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Saasplate Core (saasplate-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69308 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Nestbyte Core (nestbyte-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69307 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Medinik Core (medinik-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69306 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Electio Core (electio-core) WordPress theme/plugin core allows data extraction from the database.

CVE-2025-69305 Feb 20, 16:22 CRITICAL Act Now

Blind SQL injection in Crete Core (crete-core) WordPress theme/plugin core allows data extraction from the database.