Week 7, 2026
9 February to 15 February 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,151
- Critical
- 83
- High
- 404
- Added to KEV
- 11
Critical 83High 404Medium 578Low 78Not scored 8All 1,151 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-1731
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)
ExploitedCritical9.9 - CVE-2024-43468
Microsoft Configuration Manager Remote Code Execution Vulnerability
Microsoft · Microsoft Configuration Manager
ExploitedCritical9.8 - CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds · Web Help Desk
ExploitedHigh8.1 - CVE-2026-20700
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS…
Apple · iOS and iPadOS
ExploitedHigh7.8 - CVE-2025-15556
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
notepad-plus-plus · notepad-plus-plus
ExploitedHigh7.7 - CVE-2026-21510
Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh8.8 - CVE-2026-21513
MSHTML Framework Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh8.8 - CVE-2026-21514
Microsoft Word Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
ExploitedHigh7.8 - CVE-2026-21533
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8 - CVE-2026-21519
Desktop Window Manager Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8 - CVE-2026-21525
Windows Remote Access Connection Manager Denial of Service Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedMedium6.2
Most severe new CVEsBy CVSS score
- CVE-2026-26216
Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
unclecode · Crawl4AI
Critical10.0 - CVE-2026-26333
Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE
Calero · VeraSMART
Critical10.0 - CVE-2025-64075
A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass…
Product not named
Critical10.0 - CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
frangoteam · FUXA
Critical10.0 - CVE-2025-69770
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a…
Product not named
Critical10.0 - CVE-2026-26009
Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution
karutoil · catalyst
Critical10.0 - CVE-2026-25885
PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats
polarnl · PolarLearn
Critical10.0 - CVE-2026-1868
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
GitLab · GitLab AI Gateway
Critical9.9 - CVE-2026-0488
Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
SAP_SE · SAP CRM and SAP S/4HANA (Scripting Editor)
Critical9.9 - CVE-2026-26190
Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
milvus-io · milvus
Critical9.8