Weekly digest
Week 6, 2026 (2–8 Feb)
A quiet week: only 108 new CVEs against a recent average of about 466. Of those, 10 critical and 39 high. 16 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. Linux was the most-affected vendor with 27.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-24423Critical· 9.8CISA KEVPoCSmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the …
CVE-2025-40551Critical· 9.8CISA KEVPoCSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited …
New this week, ranked by depth score
The 12 that matter most of the 108 published.
CVE-2026-22778Critical· 9.8PoCvLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a hea…
CVE-2026-25632Critical· 10.0PoCEPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
CVE-2020-37070Critical· 9.8PoCCloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR)
CloudMe 1.11.2 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code through crafted network packets. Attackers can exploit the vulnerability by sending a specially crafted payload to the CloudMe…
CVE-2019-25276High· 7.8PoCStudio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path
Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted pa…
CVE-2019-25269High· 7.8PoCAmiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability
Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing …
CVE-2025-64712Critical· 9.8Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
CVE-2020-37082Critical· 9.8webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ dire…
CVE-2026-1709Critical· 9.4A flaw was found in Keylime
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network ac…
CVE-2020-37155High· 7.5PoCCore FTP Lite 1.3 - Denial of Service (PoC)
Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to …
GHSA-4f84-67cv-qrv3CriticalA single post-release of dydx-v4-client contained obfuscated multi-stage loader
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
CVE-2026-25481CriticalLangroid has WAF Bypass Leading to RCE in TableChatAgent
Langroid has WAF Bypass Leading to RCE in TableChatAgent
CVE-2026-25160Critical· 9.1Alist has Insecure TLS Config
Alist has Insecure TLS Config
Most-affected vendors
By CVEs published in the period.