---
title: "Security digest: February 11, 2026"
url: https://erroneo.us/security/2026-02-11/
description: "February 11, 2026 vulnerability digest: 2 critical advisories (Go, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-11
date_modified: 2026-02-11
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 11, 2026

2 critical advisories.

## Take stock

- Go: 1 critical advisory ( github.com/milvus-io/milvus ). Check with govulncheck ./... .
- npm: 1 critical advisory ( set-in ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-26190](https://erroneo.us/security/cve/CVE-2026-26190/index.md) Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise — Go github.com/milvus-io/milvus < 2.5.27 → 2.5.27; Go github.com/milvus-io/milvus >= 2.6.0, < 2.6.10 → 2.6.10
- [CVE-2026-26021](https://erroneo.us/security/cve/CVE-2026-26021/index.md) set-in Affected by Prototype Pollution — npm set-in >= 2.0.1, < 2.0.5 → 2.0.5

---
Source page: https://erroneo.us/security/2026-02-11/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt