cvegen

february 2026

cves
4,616
against an average 2025 month
1.2×
busiest day
feb 19, 388
used in real attacks
20

february 2026 brought 4,616 cves, 1.2 times an average 2025 month.

16 of its 28 days ran above the 2025 average for that weekday.

388

on feb 19, the busiest day.

451

rated critical, cvss 9 or higher. 370 of them can be hit over the network with no login and nothing for a user to click.

1,474

in open-source packages, 3.3 times their 2025 monthly average. no other kind of software grew as fast.

337

came in two single drops: patchstack 213 on feb 20, github 124 on feb 25.

20 already used in real attacks

cisa kev, as of oct 24

  • 5
    microsoft windows
    feb 10
  • 2
    cisco catalyst sd-wan manager
    feb 25
  • 1
    notepad++
    feb 3
  • 1
    beyondtrust remote support and privileged remote access
    feb 6
  • 1
    fortinet forticlient ems
    feb 6
  • 1
    fortinet fortios
    feb 10
  • 1
    ivanti endpoint manager
    feb 10
  • 1
    microsoft office
    feb 10
  • 1
    apple products
    feb 11
  • 1
    google chromium
    feb 13
and 5 more productsall 20 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
february 1 to 28, 2026
cves
4,616
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667