---
title: "Security digest: February 3, 2026"
url: https://erroneo.us/security/2026-02-03/
description: "February 3, 2026 vulnerability digest: 4 CISA KEV additions (GitLab, Sangoma, SolarWinds); 4 critical advisories (npm, Go, PyPI, Maven). What to patch and…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-03
date_modified: 2026-02-03
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 3, 2026

4 known exploited (cisa kev) additions and 4 critical advisories.

## Take stock

- Do you run any of these? Sangoma FreePBX, SolarWinds Web Help Desk, GitLab Community and Enterprise Editions. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-06.
- npm: 1 critical advisory ( @builder.io/qwik-city ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/navidrome/navidrome ). Check with govulncheck ./... .
- PyPI: 1 critical advisory ( unstructured ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( com.hubspot.jinjava:jinjava ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-64328](https://erroneo.us/security/cve/CVE-2025-64328/index.md) Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability (CISA due 2026-02-24)
- [CVE-2025-40551](https://erroneo.us/security/cve/CVE-2025-40551/index.md) SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (CISA due 2026-02-06)
- [CVE-2021-39935](https://erroneo.us/security/cve/CVE-2021-39935/index.md) GitLab Community and Enterprise Editions: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability (CISA due 2026-02-24)
- [CVE-2019-19006](https://erroneo.us/security/cve/CVE-2019-19006/index.md) Sangoma FreePBX:  Sangoma FreePBX Improper Authentication Vulnerability (CISA due 2026-02-24)

## Critical advisories

- [CVE-2026-25150](https://erroneo.us/security/cve/CVE-2026-25150/index.md) Prototype Pollution via FormData Processing in Qwik City — npm @builder.io/qwik-city < 1.19.0 → 1.19.0
- [CVE-2026-25579](https://erroneo.us/security/cve/CVE-2026-25579/index.md) Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints — Go github.com/navidrome/navidrome < 0.60.0 → 0.60.0
- [CVE-2025-64712](https://erroneo.us/security/cve/CVE-2025-64712/index.md) Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write — PyPI unstructured <= 0.18.17 → 0.18.18
- [CVE-2026-25526](https://erroneo.us/security/cve/CVE-2026-25526/index.md) JinJava Bypass through ForTag leads to Arbitrary Java Execution — Maven com.hubspot.jinjava:jinjava >= 2.8.0, < 2.8.3 → 2.8.3; Maven com.hubspot.jinjava:jinjava < 2.7.6 → 2.7.6

---
Source page: https://erroneo.us/security/2026-02-03/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt