Digest · Tuesday
Security digest: February 3, 2026
4 known exploited (cisa kev) additions and 4 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Sangoma FreePBX, SolarWinds Web Help Desk, GitLab Community and Enterprise Editions. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-06.
- npm: 1 critical advisory (
@builder.io/qwik-city). Check withnpm audit (or: npm ls <package>). - Go: 1 critical advisory (
github.com/navidrome/navidrome). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
unstructured). Check withpip-audit (or: pip show <package>). - Maven: 1 critical advisory (
com.hubspot.jinjava:jinjava). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 4
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2025-64328 | Sangoma FreePBX Sangoma FreePBX OS Command Injection Vulnerability | 2026-02-24 |
| CVE-2025-40551 | SolarWinds Web Help Desk SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 2026-02-06 |
| CVE-2021-39935 | GitLab Community and Enterprise Editions GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability | 2026-02-24 |
| CVE-2019-19006 | Sangoma FreePBX Sangoma FreePBX Improper Authentication Vulnerability | 2026-02-24 |
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>`… CVE-2026-25579 CVSS 9.2 Critical
github.com/navidrome/navidrome< 0.60.0 → fixed in 0.60.0
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- JinJava Bypass through ForTag leads to Arbitrary Java Execution CVE-2026-25526 CVSS 9.8 Critical
com.hubspot.jinjava:jinjava>= 2.8.0, < 2.8.3 → fixed in 2.8.3;com.hubspot.jinjava:jinjava< 2.7.6 → fixed in 2.7.6
npm 1
Check: npm audit (or: npm ls <package>)
- Prototype Pollution via FormData Processing in Qwik City CVE-2026-25150 CVSS 9.3 Critical
@builder.io/qwik-city< 1.19.0 → fixed in 1.19.0
PyPI 1
Check: pip-audit (or: pip show <package>)
- Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write CVE-2025-64712 CVSS 9.8 Critical
unstructured<= 0.18.17 → fixed in 0.18.18