Digest · Thursday

Security digest: February 19, 2026

5 critical advisories.

Take stock

Go: 2 critical advisories (github.com/akuity/kargo, github.com/dagu-org/dagu). Check with govulncheck ./....
PyPI: 1 critical advisory (semantic-kernel). Check with pip-audit (or: pip show <package>).
Maven: 1 critical advisory (org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
npm: 1 critical advisory (swiper). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVE-2026-27112 CVSS 9.4 Critical
github.com/akuity/kargo >= 1.9.0-rc.1, < 1.9.3 → fixed in 1.9.3; github.com/akuity/kargo >= 1.8.0-rc.1, < 1.8.11 → fixed in 1.8.11; github.com/akuity/kargo >= 1.7.0, < 1.7.8 → fixed in 1.7.8
Dagu affected by unauthenticated RCE via inline DAG spec in default configuration GHSA-6qr9-g2xw-cw92 CVSS 9.8 Critical
github.com/dagu-org/dagu <= 1.30.3 → no fix listed

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

carbon-apimgt does not properly restrict uploaded files CVE-2025-13590 CVSS 9.1 Critical
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 < 9.32.167 → fixed in 9.32.167

Check: npm audit (or: npm ls <package>)

Prototype pollution in swiper CVE-2026-27212 CVSS 9.4 Critical
swiper >= 6.5.1, < 12.1.2 → fixed in 12.1.2

Check: pip-audit (or: pip show <package>)

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution CVE-2026-26030 CVSS 9.9 Critical
semantic-kernel < 1.39.4 → fixed in 1.39.4