Week 9, 2026
23 February to 1 March 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 947
- Critical
- 129
- High
- 322
- Added to KEV
- 3
Critical 129High 322Medium 446Low 47Not scored 3All 947 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-20127
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedCritical10.0 - CVE-2022-20775
Cisco SD-WAN Software Privilege Escalation Vulnerability
Cisco · Cisco Catalyst SD-WAN
ExploitedHigh7.8 - CVE-2026-25108
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP…
Soliton Systems K.K. · FileZen
ExploitedHigh8.7
Most severe new CVEsBy CVSS score
- CVE-2026-20127
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedCritical10.0 - CVE-2026-28409
WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2026-24849
OpenEMR Arbitrary File Read Vulnerability
openemr · openemr
Critical10.0 - CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
OneUptime · oneuptime
Critical10.0 - CVE-2026-27597
@enclave-vm/core is vulnerable to Sandbox Escape
agentfront · enclave
Critical10.0 - CVE-2026-27613
CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)
maximmasiutin · TinyWeb
Critical10.0 - CVE-2026-26222
DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE
Beyond Limits Inc. · Altec DocLink
Critical10.0 - CVE-2026-21718
Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm
Copeland · Copeland XWEB 300D PRO
Critical10.0 - CVE-2026-27626
OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks
OliveTin · OliveTin
Critical10.0 - CVE-2026-2778
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
Mozilla · Firefox
Critical10.0