February 2026
4,931 CVEs published, −6% on January 2026 and +25% on February 2025. CISA added 28 to KEV.
2026 month by month
- Critical
- 49512% of the 4,283 with a CVSS score
- Added to CISA KEV
- 2819 of this month's CVEs are in KEV, listed a median 4 days after publication
- Vendors
- 2,0524,905 products
- Top weakness
- XSSCWE-79 · 678 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1npmOpenclaw, N8N, Fuxa-server22748nonenew
- 2LinuxLinux, Linux Kernel2201nonenew
- 3GoGogs.io/gogs, Github.com/mattermost/mattermost-server, Code.vikunja.io/api14320nonenew
- 4PyPIRucio-webui, Pypdf, Django12620nonenew
- 5PackagistCraftcms/cms, Moodle/moodle, Craftcms/commerce964nonenew
- 6MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 2022 23h27967new
- 7ApplemacOS, iOS and iPadOS, iPadOS7511new
- 8IBMConcert, DB2 Recovery Expert, DB2 Recovery Expert For Luw571nonenew
- 9MozillaFirefox, Thunderbird, Firefox For IOS5444nonenew
- 10TendaF453 Firmware, F453, A21 Firmware540nonenew
- 11Сообщество Свободного Программного ОбеспеченияN8N, Debian Gnu/linux, Vim528nonenew
- 12QnapQsync Central, File Station 5, File Station491nonenew
- 13D-LinkDwr-m960, Dir-823x, Dir-619l480nonenew
- 14DlinkDwr-m960 Firmware, Dir-823x Firmware, Dir-823x480nonenew
- 15Ооо «ред Софт»Ред Ос481nonenew
- 16Wikimedia FoundationMediawiki, Checkuser, Visualeditor471nonenew
- 17NugetMagick.net-q8-openmp-arm64, Magick.net-q8-anycpu, Magick.net-q16-openmp-x64461nonenew
- 18Red HatRed Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9461nonenew
- 19AdobeAfter Effects, Adobe After Effects, Substance3d - Designer440nonenew
- 20AmdAmd Epyc™ 9005 Series Processors, Amd Epyc™ Embedded 9005 Series Processors, Amd Ryzen™ Embedded 8000 Series Processors420nonenew
- 21Crates.ioRustfs, Wasmtime, Pgp401nonenew
- 22TaniumThreat Response, Tanos, Tanium Appliance400nonenew
- 23MavenOrg.keycloak:keycloak-services, Org.apache.tomcat:tomcat, Org.apache.tomcat.embed:tomcat-embed-core395nonenew
- 24ItsourcecodeSchool Management System, Event Management System, Student Management System370nonenew
- 25GoogleChrome, Google Chrome, Android3541new
Severity
How this month's CVEs score on CVSS; 648 have no score yet. Severity is not exploitation.
- Critical495
- High1,621
- Medium1,972
- Low195
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS678
- CWE-862Missing Authorization320
- CWE-89SQL Injection278
- CWE-22Path Traversal182
- CWE-78OS Command Injection158
- CWE-119Memory Buffer Bounds143
- CWE-74Injection134
- CWE-121130
- CWE-94Code Injection122
- CWE-787Out-of-bounds Write119
- CWE-284Improper Access Control110
- CWE-125Out-of-bounds Read99
- CWE-200Information Exposure99
- CWE-120Buffer Overflow98
- CWE-918SSRF96
- CWE-77Command Injection92
- CWE-502Deserialization82
- CWE-352CSRF81
- CWE-770Allocation Without Limits80
- CWE-416Use After Free79
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,10719% of sector-tagged CVEs
- OSS Libraries1,01518% of sector-tagged CVEs
- Enterprise Software65811% of sector-tagged CVEs
- Operating Systems5039% of sector-tagged CVEs
- Networking Infrastructure3927% of sector-tagged CVEs
- Security Products2835% of sector-tagged CVEs
- Hardware Firmware2554% of sector-tagged CVEs
- Consumer Software2204% of sector-tagged CVEs
- 7 smaller sectors860
- Not yet classified432
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 22Path Traversal | 78OS Command Injection | 119Memory Buffer Bounds | 74Injection | 121 | 787Out-of-bounds Write | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| npm | 23 | 5 | 4 | 14 | 16 | 9 | 17 | |||
| Linux | 5 | |||||||||
| Go | 9 | 10 | 1 | 20 | 6 | 1 | ||||
| PyPI | 14 | 2 | 6 | 10 | 1 | 2 | 1 | 1 | 7 | |
| Ооо «ред Софт» | 9 | 1 | 4 | 5 | 2 | 1 | 1 | 2 | 7 | 2 |
| Packagist | 37 | 3 | 15 | 2 | 1 | 4 | ||||
| Сообщество Свободного Программного Обеспечения | 11 | 2 | 2 | 10 | 4 | 1 | 1 | 3 | 8 | 1 |
| Apple | 1 | 8 | 12 | 2 | ||||||
| Microsoft Corp | 2 | 9 | 3 | |||||||
| Microsoft | 1 | 1 | 7 | 3 | ||||||
| Ооо «русбитех-астра» | 1 | 1 | 8 | |||||||
| IBM | 4 | 1 | 1 |
In the news
The CVEs security news mentioned most in February 2026.
- CVE-2025-20333A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remot...29.9
- CVE-2025-20362Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 a...26.5
- CVE-2026-21509Microsoft Office Security Feature Bypass Vulnerability27.8
- CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability19.1
- CVE-2023-22527A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected vers...19.8
- CVE-2023-28771Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, ...19.8
- CVE-2023-41772Win32k Elevation of Privilege Vulnerability17.8
- CVE-2024-11182Stored XSS vulnerability in MDaemon Email Server16.1
- CVE-2024-27443An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, bec...16.1
- CVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability19.8
- CVE-2024-28988SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability19.8
- CVE-2024-30085Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability17.8
CVEs published in February 2026
42 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2026-20127Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityKEV10.0
- CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge...KEV10.0
- CVE-2026-1731Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)KEV9.8
- CVE-2026-21643An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized ...KEV9.8
- CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityKEV8.8
- CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityKEV8.8
- CVE-2026-2441Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2026-25108FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.KEV8.8
- CVE-2026-1603An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.KEV8.6
- CVE-2026-22719VMware Aria Operations command injection vulnerabilityKEV8.1
- CVE-2026-20700A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with m...KEV7.8
- CVE-2026-21514Microsoft Word Security Feature Bypass VulnerabilityKEV7.8
- CVE-2026-21519Desktop Window Manager Elevation of Privilege VulnerabilityKEV7.8
- CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-15556Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity VerificationKEV7.5
- CVE-2026-20128Cisco Catalyst SD-WAN Manager Information Disclosure VulnerabilityKEV7.5
- CVE-2026-20133A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient f...KEV6.5
- CVE-2026-21525Windows Remote Access Connection Manager Denial of Service VulnerabilityKEV6.2
- CVE-2025-68686An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, F...KEV5.9
- CVE-2026-20122Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite VulnerabilityKEV5.4
- CVE-2026-1868Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway9.9
- CVE-2026-22778vLLM leaks a heap address when PIL throws an error9.8
- CVE-2026-25895FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API9.8
- CVE-2026-27174MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval9.8
- CVE-2026-25137NixOs Odoo database and filestore publicly accessible with default odoo configuration9.1
- CVE-2025-6597MediaWiki should not consider autocreation as login for the purposes of security reauthentication8.8
- CVE-2026-25059OpenList affected by Path Traversal in file copy and remove handlers8.8
- CVE-2026-24708An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user ...8.2
- CVE-2026-26268Cursor sandbox escape via Git hooks8.0
- CVE-2026-20841Windows Notepad App Remote Code Execution Vulnerability7.8
- CVE-2026-23111netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()7.8
- CVE-2026-1581wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection7.5
- CVE-2026-28414Gradio has Absolute Path Traversal on Windows with Python 3.13+7.5
- CVE-2026-2080UTT HiPER 810 formUser setSysAdm command injection7.2
- CVE-2026-2846UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection7.2
- CVE-2026-2819Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization6.3
- CVE-2026-3066HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection6.3
- CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`6.1
- CVE-2026-28208Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix5.9
- CVE-2026-25797ImageMagick vulnerable to Code injection via PostScript header in ps coders5.7
- CVE-2026-25321WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability5.3
- CVE-2026-2023WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation4.3