Month report
February 2026
Rolled up 2026-09-14 11:40 from 371,001 CVE records
4,616 CVEs published, +25.7% on the same month last year. 450 rated critical, 28 listed by CISA as exploited. linux led with 220; the most common weakness class was CWE-79 (669). apple climbed 32 places, the largest move. 11 vendors ranked for the first time.
Published
4,616
Critical / high
450 / 1,690
Medium / low
1,971 / 292
Added to CISA KEV
28
Public exploit
226
Scanner template
47
Publication to KEV
How long before CISA listed them
Median days to listing
5
Listed within 7 days
60%
Listed within 30 days
75%
Detection gap
Listed as exploited, no public template
Listed this month
28
With a template
9
No template
19
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 220 | 1 | 1 | linux (220) · simatic s7 1500 cpu 1518 4 pn dp mfp (16) · simatic s7 1500 cpu 1518f 4 pn dp mfp (16) | — | ||
| 2 | redhat | 152 | 29 | 19 | 2 | red hat enterprise linux 9 (89) · red hat enterprise linux 8 (84) · red hat enterprise linux 10 (78) | ↑1 | |
| 3 | apple | 75 | 1 | 1 | 3 | macos (64) · ios and ipados (50) · visionos (33) | ↑32 | |
| 4 | microsoft | 64 | 4 | 6 | 12 | windows server 2025 (29) · windows server 2025 server core installation (29) · windows server 2022 23h2 edition server core installation (28) | ↓2 | |
| 5 | ibm | 57 | 1 | concert (11) · db2 recovery expert for luw (6) · cloud pak system (5) | ↑3 | |||
| 6 | mozilla | 54 | 29 | 4 | firefox (52) · thunderbird (51) · red hat enterprise linux 10 (32) | ↑19 | ||
| 7 | qnap systems | 49 | 1 | qsync central (28) · file station 5 (13) · quts hero (6) | ↑2 | |||
| 8 | d link | 48 | dwr m960 (20) · dir 823x (13) · dir 605l (3) | ↑23 | ||||
| 9 | wikimedia foundation | 47 | 1 | mediawiki (28) · checkuser (7) · vector (2) | · | |||
| 10 | adobe | 44 | after effects (15) · substance3d designer (7) · audition (6) | ↑2 | ||||
| 11 | tenda | 44 | f453 (12) · a21 (6) · hg9 (6) | ↑27 | ||||
| 12 | amd | 42 | amd epyc 9005 series processors (16) · amd epyc embedded 9005 series processors (14) · amd ryzen embedded 8000 series processors (11) | · | ||||
| 13 | tanium | 40 | threat response (5) · tanium appliance (4) · deploy (2) | new | ||||
| 14 | siemens | 39 | 1 | 2 | linux (22) · simatic s7 1500 cpu 1518 4 pn dp mfp (16) · simatic s7 1500 cpu 1518f 4 pn dp mfp (16) | ↓10 | ||
| 15 | itsourcecode | 37 | event management system (6) · news portal project (5) · school management system (5) | ↑15 | ||||
| 16 | imagemagick | 34 | imagemagick (34) · red hat enterprise linux 6 (3) · red hat enterprise linux 7 extended lifecycle support (2) | · | ||||
| 17 | openclaw | 33 | 1 | 2 | openclaw (33) · clawdbot (2) · openclaw bluebubbles (1) | new | ||
| 18 | tp link systems | 30 | 2 | archer ax53 v1 0 (11) · archer be230 v1 2 (11) · tapo c260 v1 (3) | ↑2 | |||
| 19 | comodo | 29 | comodo dome firewall (29) | · | ||||
| 20 | code projects | 28 | 1 | online reviewer system (12) · online music site (5) · contact management system (2) | ↓13 | |||
| 21 | freerdp | 27 | freerdp (27) · red hat enterprise linux 10 (3) · red hat enterprise linux 10 0 extended update support (3) | ↑8 | ||||
| 22 | nsasoft | 27 | 1 | nsauditor spotauditor (3) · nsauditor dnss domain name search software (2) · nsauditor netsharewatcher (2) | new | |||
| 23 | openemr | 27 | 2 | 2 | openemr (27) | · | ||
| 24 | sap se | 27 | 2 | sap businessobjects bi platform (2) · sap commerce cloud (2) · sap document management system (2) | ↓2 | |||
| 25 | gitlab | 26 | 1 | gitlab (25) · gitlab ai gateway (1) | ↑15 | |||
| 26 | apache | 25 | 2 | 3 | apache airflow (5) · apache superset (5) · apache tomcat (3) | ↓10 | ||
| 27 | 25 | 1 | 1 | 1 | chrome (20) · libjxl (2) · android (1) | ↑5 | ||
| 28 | dell | 24 | 1 | 1 | powermax (5) · unisphere for powermax (5) · powerprotect data manager (4) | ↓15 | ||
| 29 | copeland | 23 | 2 | copeland xweb 300d pro (23) · copeland xweb 500b pro (23) · copeland xweb 500d pro (23) | new | |||
| 30 | craftcms | 23 | 1 | cms (12) · commerce (10) · craftcms (1) | · | |||
| 31 | sourcecodester | 23 | 1 | patients waiting area queue management system (5) · online class record system (3) · simple responsive tourism website (3) | · | |||
| 32 | mediatek | 21 | 2 | 1 | mediatek chipset (21) | ↓21 | ||
| 33 | yokogawa electric | 21 | fast tools (15) · vnet ip interface package (6) | · | ||||
| 34 | cisco | 20 | 2 | 4 | 1 | cisco catalyst sd wan manager (6) · cisco unified computing system managed (5) · cisco nx os system software in aci mode (3) | ↑15 | |
| 35 | utt | 19 | hiper 810g (7) · 520w (5) · hiper 810 (3) | ↓9 | ||||
| 36 | gfi software | 18 | mailessentials ai (18) | new | ||||
| 37 | huawei | 18 | harmonyos (18) · emui (6) | ↓4 | ||||
| 38 | n8n io | 18 | 11 | 4 | n8n (18) | new | ||
| 39 | spip | 18 | 3 | 3 | 1 | spip (12) · interface traduction objets (2) · jeux (1) | new | |
| 40 | discourse | 17 | discourse (17) | ↓4 | ||||
| 41 | nvidia | 17 | nemo framework (10) · cumulus linux ga (3) · cumulus linux lts (3) | ↑3 | ||||
| 42 | smoothwall | 17 | smoothwall express (17) | · | ||||
| 43 | ancorathemes | 14 | 2 | blabber (1) · coworking (1) · fooddy (1) | ↓19 | |||
| 44 | free5gc | 14 | smf (4) · udm (4) · udr (3) | new | ||||
| 45 | gunet | 13 | openeclass (13) | new | ||||
| 46 | brocade | 12 | fabric os (7) · sannav (5) | · | ||||
| 47 | yeqifu | 12 | warehouse (12) | new | ||||
| 48 | invoiceplane | 11 | 2 | 5 | 1 | invoiceplane (11) | new | |
| 49 | mongodb | 11 | mongodb server (9) · mongodb go driver (1) · mongodb ruby driver (1) | · | ||||
| 50 | samsung mobile | 11 | 1 | samsung mobile devices (7) · chinese samsung members (1) · galaxy wearable (1) | ↑12 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-02 that are on the CISA KEV catalog today. The 28 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-796697 critical—
- 2CWE-86231712 critical—
- 3CWE-8927851 critical—
- 4CWE-2217420 critical↑1
- 5CWE-7814633 critical↑5
- 6CWE-1191438 critical↑20
- 7CWE-741343 critical↓3
- 8CWE-12113227 critical↑10
- 9CWE-9411825 critical↑4
- 10CWE-1201069 critical↑4
- 1CWE-2841058 critical↓3
- 2CWE-200966 critical↑3
- 3CWE-125932 critical↑7
- 4CWE-918938 critical↑11
- 5CWE-77895 critical↑1
- 6CWE-352802 critical↓7
- 7CWE-5027925 critical↑11
- 8CWE-122743 critical↑9
- 9CWE-3067340 critical↑11
- 10CWE-787738 critical↓3
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.