CVEs published February 16 to February 22, 2026
1,314 CVEs were published Feb 16 to Feb 22, 2026, 113 of them critical. CISA added 8 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 1,314
- Critical
- 113
- Added to CISA KEV
- 8
- Busiest day
- Thu, Feb 19 (390)
- Quietest day
- Sun, Feb 22 (59)
- February 16, 202688 CVEs · 5 critical
- February 17, 202698 CVEs · 7 critical
- February 18, 2026238 CVEs · 18 critical
- February 19, 2026390 CVEs · 26 critical
- February 20, 2026376 CVEs · 50 critical
- February 21, 202665 CVEs · 6 critical
- February 22, 202659 CVEs · 1 critical
Added to CISA KEV 8
- CVE-2008-0015Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques
- CVE-2020-7796Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
- CVE-2024-7694TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File UploadTeamT5 ThreatSonar Anti-Ransomware
- CVE-2026-2441Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2021-22175When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versionsGitLab
- CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.Dell RecoverPoint for Virtual Machines
- CVE-2025-49113Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in aRoundcube Webmail · roundcube/roundcubemail
- CVE-2025-68461Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG dRoundcube Webmail