--- title: "Security digest: February 20, 2026" url: https://erroneo.us/security/2026-02-20/ description: "February 20, 2026 vulnerability digest: 2 CISA KEV additions (Roundcube); 2 critical advisories (npm, PyPI). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-02-20 date_modified: 2026-02-20 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 20, 2026 2 known exploited (cisa kev) additions and 2 critical advisories. ## Take stock - Do you run any of these? Roundcube Webmail. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-13. - npm: 1 critical advisory ( fast-xml-parser ). Check with npm audit (or: npm ls ) . - PyPI: 1 critical advisory ( mlflow ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2025-68461](https://erroneo.us/security/cve/CVE-2025-68461/index.md) Roundcube Webmail: RoundCube Webmail Cross-site Scripting Vulnerability (CISA due 2026-03-13) - [CVE-2025-49113](https://erroneo.us/security/cve/CVE-2025-49113/index.md) Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability (CISA due 2026-03-13) ## Critical advisories - [CVE-2026-25896](https://erroneo.us/security/cve/CVE-2026-25896/index.md) fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names — npm fast-xml-parser >= 5.0.0, < 5.3.5 → 5.3.5; npm fast-xml-parser >= 4.1.3, < 4.5.4 → 4.5.4 - [CVE-2026-2635](https://erroneo.us/security/cve/CVE-2026-2635/index.md) MLflow Use of Default Password Authentication Bypass Vulnerability — PyPI mlflow < 3.8.0rc0 → 3.8.0rc0 --- Source page: https://erroneo.us/security/2026-02-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt