Weekly digest
Week 7, 2026 (9–15 Feb)
172 new CVEs this week, in line with the recent average. Severity skewed high: 8 critical and 87 high, 55% of the total. 25 arrived with exploitation evidence or public exploit code already attached. No new KEV entries. adobe was the most-affected vendor with 44.
New this week, ranked by depth score
The 12 that matter most of the 172 published.
CVE-2026-2441High· 8.8CISA KEVPoCUse after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-26190Critical· 9.8PoCMilvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
CVE-2026-26216Critical· 10.0PoCCrawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was i…
CVE-2025-69872Critical· 9.8PoCDiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVE-2026-21531Critical· 9.8PoCAzure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
CVE-2025-68686Medium· 5.9CISA KEVAn Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all…
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all…
CVE-2026-2005High· 8.8PoCHeap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
CVE-2026-26217High· 8.6PoCCrawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment
Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read ar…
CVE-2020-37167High· 8.4PoCClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation …
CVE-2026-25890High· 8.1PoCFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
CVE-2026-1529High· 8.1PoCA flaw was found in Keycloak
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verifica…
CVE-2026-23111High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-…
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-…
Most-affected vendors
By CVEs published in the period.