Digest · Wednesday
Security digest: February 11, 2026
2 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 1 critical advisory (
github.com/milvus-io/milvus). Check withgovulncheck ./.... - npm: 1 critical advisory (
set-in). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise CVE-2026-26190 CVSS 9.8 Critical
github.com/milvus-io/milvus< 2.5.27 → fixed in 2.5.27;github.com/milvus-io/milvus>= 2.6.0, < 2.6.10 → fixed in 2.6.10
npm 1
Check: npm audit (or: npm ls <package>)
- set-in Affected by Prototype Pollution CVE-2026-26021 CVSS 9.4 Critical
set-in>= 2.0.1, < 2.0.5 → fixed in 2.0.5