CVE Vulnerabilities - 27 February 2026

217 vulnerabilities published on 27 February 2026

Severity:

Libvips Integer Overflow in Local File Exports

A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulati...

Seerr: Unauthorized Users Can Access Other Users' Data

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in...

ClipBucket Video Sharing Platform: Administrator Can Execute Malicious Code

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload...

PluXml CMS: Malicious Code Can Be Injected into Static Pages

PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into w...

PluXml CMS allows malicious SVG files to be uploaded and executed

PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payloa...

WordPress Featured Image Plugin Allows Author-Level Users to Access Sensitive Internal Data

Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery ...

Dify API Leaks Email Addresses Before Version 1.9.0

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowin...

calibre Content Server's Brute-Force Protection Can Be Bypassed

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Serve...

Japanized for WooCommerce Plugin Allows Unpaid Orders to be Marked as Paid

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a ...

WP Recipe Maker plugin for WordPress exposes sensitive recipe data

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is...

Public Access to Charging Station Authentication Identifiers

Charging station authentication identifiers are publicly accessible via web-based mapping platforms....

Electric Vehicle Charging Station Credentials Exposed Online

Charging station authentication identifiers are publicly accessible via web-based mapping platforms....

Electric Vehicle Charging Station Login Info Exposed Through Online Maps

Charging station authentication identifiers are publicly accessible via web-based mapping platforms....

Electric Vehicle Charging Station Credentials Exposed Online

Charging station authentication identifiers are publicly accessible via web-based mapping platforms....

Charging Station Credentials Exposed on Public Maps

Charging station authentication identifiers are publicly accessible via web-based mapping platforms....

VMware Workstation: Unprivileged Guest User Can Crash Host Processes

Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM...

Foreman GraphQL API Allows Low-Privileged Users to Access Sensitive Metadata

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, w...

MailArchiver Plugin for WordPress Allows Sensitive Data Theft

The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insu...

Keycloak Server: Admins Can Modify Sensitive User Data

CVE-2026-0871 GHSA-v4jw-m6rm-399h

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attr...

Kiteworks Email Protection Gateway: Admins can inject malicious scripts

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administ...

Dato CMS Web Previews plugin allows malicious users to load unauthorized content

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restrictio...

Vim Terminal Emulator Can Crash or Allow Unauthorized Access

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim'...

ZITADEL Opaque Tokens Can Be Truncated Without Losing Validity

CVE-2026-27840 GHSA-6mq3-xmgp-pjm5

### Summary Opaque OIDC access tokens in v2 format, truncated to 80 characters are still considered valid. ZITADEL uses a symmetric AES encryption ...

WordPress SmartRemote Module Allows Unauthorized URL Loading

The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage....

Itwanger Paicoding 1.0.0-1.0.3: Save Function Allows Remote Attack

A vulnerability was identified in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3. The impacted element is the function Save of the file paicoding-web/src/...

26 Feb 2026 All days 28 Feb 2026