| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-70954 | Hig | 0.42 | 7.5 | 0.01 | Feb 13, 2026 | A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before… | ||
| CVE-2025-70866 | Hig | 0.57 | 8.8 | 0.00 | Feb 13, 2026 | LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share… | ||
| CVE-2025-69633 | Cri | 0.64 | 9.8 | 0.00 | Feb 13, 2026 | A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup… | ||
| CVE-2025-15157 | Hig | 0.57 | 8.8 | 0.00 | Feb 13, 2026 | The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all versions up to, and… | ||
| CVE-2026-26335 | Cri | 0.67 | 9.8 | 0.03 | Feb 13, 2026 | Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET… | ||
| CVE-2026-26334 | Hig | 0.51 | 7.8 | 0.00 | Feb 13, 2026 | Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with… | ||
| CVE-2026-26333 | Cri | 0.64 | 9.8 | 0.01 | Feb 13, 2026 | Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with… | ||
| CVE-2025-68128 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: reserved but not needed | ||
| CVE-2025-68127 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: reserved but not needed | ||
| CVE-2026-26269 | Med | 0.35 | 5.4 | 0.00 | Feb 13, 2026 | Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists… | ||
| CVE-2026-2441 | Hig | 0.74 | 8.8 | 0.55 | KEV | Feb 13, 2026 | Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2026-26264 | Hig | 0.53 | 8.1 | 0.00 | Feb 13, 2026 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c… | ||
| CVE-2026-26208 | Hig | 0.51 | 7.8 | 0.00 | Feb 13, 2026 | ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to… | ||
| CVE-2026-26190 | Cri | 0.60 | 9.8 | 0.39 | Feb 13, 2026 | Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from… | ||
| CVE-2026-26187 | Hig | 0.46 | 8.1 | 0.00 | Feb 13, 2026 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath… | ||
| CVE-2026-25991 | Hig | 0.00 | 7.7 | 0.00 | Feb 13, 2026 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the… | ||
| CVE-2026-25964 | Med | 0.00 | 4.9 | 0.00 | Feb 13, 2026 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the… | ||
| CVE-2026-21878 | Hig | 0.49 | 7.5 | 0.00 | Feb 13, 2026 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to… | ||
| CVE-2025-36552 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36545 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36542 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36538 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36534 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36532 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36526 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36524 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36523 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-36517 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-35997 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-35993 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-35976 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-35962 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-35961 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-35960 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-32734 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-32733 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-32090 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-32085 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-32082 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-32009 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-31942 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-31364 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-31358 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-31145 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-30517 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-29869 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-27941 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-27928 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-27573 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused | ||
| CVE-2025-27569 | — | 0.00 | — | — | Feb 13, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused |
- risk 0.42cvss 7.5epss 0.01
A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before…
- risk 0.57cvss 8.8epss 0.00
LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share…
- risk 0.64cvss 9.8epss 0.00
A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup…
- risk 0.57cvss 8.8epss 0.00
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all versions up to, and…
- risk 0.67cvss 9.8epss 0.03
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET…
- risk 0.51cvss 7.8epss 0.00
Calero VeraSMART versions prior to 2026 R1 contain hardcoded static AES encryption keys within Veramark.Framework.dll (Veramark.Core.Config class). These keys are used to encrypt the password of the service account stored in C:\\VeraSMART Data\\app.settings. An attacker with…
- risk 0.64cvss 9.8epss 0.01
Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with…
- CVE-2025-68128Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: reserved but not needed
- CVE-2025-68127Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: reserved but not needed
- risk 0.35cvss 5.4epss 0.00
Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists…
- risk 0.74cvss 8.8epss 0.55
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- risk 0.53cvss 8.1epss 0.00
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c…
- risk 0.51cvss 7.8epss 0.00
ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to…
- risk 0.60cvss 9.8epss 0.39
Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from…
- risk 0.46cvss 8.1epss 0.00
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath…
- risk 0.00cvss 7.7epss 0.00
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the…
- risk 0.00cvss 4.9epss 0.00
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the…
- risk 0.49cvss 7.5epss 0.00
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to…
- CVE-2025-36552Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36545Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36542Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36538Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36534Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36532Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36526Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36524Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36523Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-36517Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-35997Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-35993Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-35976Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-35962Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-35961Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-35960Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-32734Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-32733Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-32090Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-32085Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-32082Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-32009Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-31942Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-31364Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-31358Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-31145Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-30517Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-29869Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-27941Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-27928Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-27573Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
- CVE-2025-27569Feb 13, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused