Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12997 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-26063 1 Xpertforextradeinc 1 Cedipay 2026-02-20 N/A
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
CVE-2026-25631 1 N8n 1 N8n 2026-02-19 6.5 Medium
n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This only might affect user who have credentials that use wildcard domain patterns (e.g., *.example.com) in the "Allowed domains" setting. This issue is fixed in version 1.121.0 and later.
CVE-2025-13587 2 Ss88 Uk, Wordpress 2 Two Factor (2fa) Authentication Via Email, Wordpress 2026-02-19 6.5 Medium
The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.
CVE-2026-24936 1 Asustor 2 Adm, Data Master 2026-02-19 9.8 Critical
When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
CVE-2026-24811 2 Riot Project, Root 2 Riot, Root 2026-02-19 9.8 Critical
Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inffast.C. This issue affects root.
CVE-2026-23836 1 Hotcrp 1 Hotcrp 2026-02-18 10 Critical
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.
CVE-2025-70123 1 Free5gc 1 Free5gc 2026-02-18 7.5 High
An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly accepts a malformed PFCP Association Setup Request, violating 3GPP TS 29.244. This places the UPF in an inconsistent state where a subsequent valid PFCP Session Establishment Request triggers a cascading failure, disrupting the SMF connection and causing service degradation.
CVE-2026-23887 2 Group-office, Intermesh 2 Group Office, Group-office 2026-02-18 5.4 Medium
Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.
CVE-2025-59886 1 Eaton 1 Xcomfort Ethernet Communication Interface 2026-02-18 8.8 High
Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.
CVE-2021-37914 1 Argoproj 1 Argo Workflows 2026-02-14 6.5 Medium
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
CVE-2025-26647 1 Microsoft 11 Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 Sp2 and 8 more 2026-02-13 8.8 High
Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
CVE-2026-20627 1 Apple 6 Ios And Ipados, Ipados, Iphone Os and 3 more 2026-02-13 5.5 Medium
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in watchOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.
CVE-2025-21370 1 Microsoft 6 Windows 11 22h2, Windows 11 22h2, Windows 11 23h2 and 3 more 2026-02-13 7.8 High
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2025-21230 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-13 7.5 High
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21284 1 Microsoft 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more 2026-02-13 5.5 Medium
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21280 1 Microsoft 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more 2026-02-13 5.5 Medium
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21350 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-13 5.9 Medium
Windows Kerberos Denial of Service Vulnerability
CVE-2025-21194 1 Microsoft 63 Surface Go 2, Surface Go 2 1901, Surface Go 2 1901 Firmware and 60 more 2026-02-13 7.1 High
Microsoft Surface Security Feature Bypass Vulnerability
CVE-2025-21375 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-13 7.8 High
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2025-24062 1 Microsoft 14 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 11 more 2026-02-13 7.8 High
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.