Week 6, 2026
2 February to 8 February 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,192CVEs publishedin the whole week
- 94CriticalCVSS 9.0 and above
- 393HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-11953
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
@react-native-community/cli-server-api
ExploitedCritical9.8 - CVE-2026-24423
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
SmarterTools · SmarterMail
ExploitedCritical9.3 - CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds · Web Help Desk
ExploitedCritical9.8 - CVE-2019-19006
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Product not named
ExploitedCritical9.8 - CVE-2025-64328
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
FreePBX · filestore
ExploitedHigh8.6 - CVE-2021-39935
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all…
GitLab · GitLab
ExploitedMedium6.8
Most severe new CVEsBy CVSS score
- CVE-2026-23515
RCE - Command Injection in Signal K set-system-time plugin
SignalK · signalk-server
Critical10.0 - CVE-2026-25592
Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK
microsoft · semantic-kernel
Critical10.0 - CVE-2026-25142
SandboxJS Prototype Pollution -> Sandbox Escape -> RCE
nyariv · SandboxJS
Critical10.0 - CVE-2026-25510
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
ci4-cms-erp · ci4ms
Critical10.0 - CVE-2026-25520
SandboxJS has a Sandbox Escape
nyariv · SandboxJS
Critical10.0 - CVE-2026-25632
EPyT-Flow has unsafe JSON deserialization (__type__)
WaterFutures · EPyT-Flow
Critical10.0 - CVE-2026-25587
SandboxJS has a Sandbox Escape
nyariv · SandboxJS
Critical10.0 - CVE-2026-25586
SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
nyariv · SandboxJS
Critical10.0 - CVE-2025-10878
A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are…
Insaat · Fikir Odalari AdminPando
Critical10.0 - CVE-2026-1633
Synectix LAN 232 TRIO Missing Authentication for Critical Function
Synectix · LAN 232 TRIO
Critical10.0