Week 7, 2026

9–15 February 2026

New CVEs: 1,163
Critical: 93
High: 434
Newly exploited: 11
Advisories: 530
Malicious pkgs: 105

Newly exploited 11

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.9
CVE-2026-1731 KEV Feb 13, 2026 · ransomware Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)

EPSS 94%
Critical 9.8
CVE-2024-43468 KEV Feb 12, 2026 Microsoft Configuration Manager Remote Code Execution Vulnerability
Microsoft · Microsoft Configuration Manager

EPSS 81%
High 8.1
CVE-2025-40536 KEV Feb 12, 2026 SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds · Web Help Desk

EPSS 74%
High 7.8
CVE-2026-20700 KEV Feb 12, 2026 A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS …
Apple · macOS · iOS and iPadOS · watchOS

EPSS 1.7%
High 7.7
CVE-2025-15556 KEV Feb 12, 2026 Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
notepad-plus-plus · notepad-plus-plus

EPSS 1.7%
High 8.8
CVE-2026-21510 KEV Feb 10, 2026 Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 61%
High 8.8
CVE-2026-21513 KEV Feb 10, 2026 MSHTML Framework Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 16%
High 7.8
CVE-2026-21514 KEV Feb 10, 2026 Microsoft Word Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

EPSS 1.6%
High 7.8
CVE-2026-21519 KEV Feb 10, 2026 Desktop Window Manager Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 2.6%
High 7.8
CVE-2026-21533 KEV Feb 10, 2026 Windows Remote Desktop Services Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 4.3%
Medium 6.2
CVE-2026-21525 KEV Feb 10, 2026 Windows Remote Access Connection Manager Denial of Service Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 5%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
milvus-io · milvus

EPSS 39%
Critical 9.8
CVE-2026-1357 Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
wpvividplugins · WPvivid — Backup, Migration & Staging

EPSS 39%
Critical 9.5
CVE-2026-25895 FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
frangoteam · FUXA

EPSS 13%
Critical 9.3
CVE-2026-25939 FUXA Unauthenticated Remote Arbitrary Scheduler Write
frangoteam · FUXA

EPSS 13%
Critical 10.0
CVE-2026-26216 Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
unclecode · Crawl4AI

EPSS 6.3%
Critical 9.8
CVE-2020-37153 ASTPP VoIP 4.0.1 - Remote Code Execution
ASTPP · ASTPP

EPSS 4.9%
Critical 9.8
CVE-2026-1306 midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
adminkov · midi-Synth

EPSS 4.8%
Critical 9.3
CVE-2026-26068 emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)
jm33-m0 · emp3r0r

EPSS 3.7%
Critical 9.3
CVE-2026-26335 Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE
Calero · VeraSMART

EPSS 3%
Critical 9.8
CVE-2026-21531 Azure SDK for Python Remote Code Execution Vulnerability
Microsoft · Azure AI Language Authoring

EPSS 2.5%
Critical 9.8
CVE-2026-26221 Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE
Hyland · OnBase Workflow Timer Service

EPSS 1.3%
Critical 9.8
CVE-2026-1490 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Inst…
cleantalk · Spam protection, Honeypot, Anti-Spam by CleanTalk

EPSS 1.3%
Critical 9.8
CVE-2026-1358 Airleader Master Unrestricted Upload of File with Dangerous Type
Airleader · Airleader Master

EPSS 1.2%
Critical 9.8
CVE-2026-1615 jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
EPSS 1.1%
Critical 9.8
CVE-2020-37186 Chevereto 3.13.4 Core - Remote Code Execution
Chevere SpA · Chevereto

EPSS 1.1%

All 93 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.6
CVE-2026-1603 An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
ivanti · Endpoint Manager

EPSS 88%
High 8.8
CVE-2026-21510 Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 61%
High 8.8
CVE-2026-2441 Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch…
Google · Chrome

EPSS 55%
Medium 5.3
CVE-2025-68686 An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 thro…
Fortinet · FortiOS

EPSS 29%
High 8.7
CVE-2026-0652 Remote Code Execution on TP-Link Tapo C260 by Guest User
TP-Link Systems · Tapo C260 v1

EPSS 23%
High 8.8
CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 16%
Low 3.3
CVE-2026-21249 Windows NTLM Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 11%
High 8.8
CVE-2026-1560 Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
nko · Custom Block Builder – Lazy Blocks

EPSS 10%

Advisories

USN-8028-2 linux-realtime-6.8 vulnerabilities 753 CVEs
USN-8028-1 linux, linux-raspi vulnerabilities 753 CVEs
USN-8031-1 linux-gcp-6.8 vulnerabilities 752 CVEs
USN-8029-1 linux, linux-raspi, linux-realtime vulnerabilities 367 CVEs
USN-8030-1 linux-gcp vulnerabilities 366 CVEs
SUSE-SU-2026:0411-1 Security update for the Linux Kernel 348 CVEs
DLA-4476-1 linux-6.1 - security update 252 CVEs
DSA-6127-1 linux - security update 252 CVEs
DSA-6126-1 linux - security update 251 CVEs
SUSE-SU-2026:0472-1 Security update for the Linux Kernel 172 CVEs