Security Digest: February 18, 2026 - 8 Critical Vulnerabilities

Today's digest highlights critical vulnerabilities in widely-used software, including Ghost, LibreNMS, systeminformation, fabric.js, openclaw, Keras, and Node's tar module.

· 5 min read

Today's Critical Security Threats

Security researchers have identified eight critical vulnerabilities affecting popular frameworks and applications. Immediate action is required to protect your systems from potential exploitation.

Executive Summary

Today's digest highlights critical vulnerabilities in widely-used software, including Ghost, LibreNMS, systeminformation, fabric.js, openclaw, Keras, and Node's tar module. Each flaw could lead to severe security breaches such as SQL injection, command execution, and unauthorized data access. Immediate patching and mitigation steps are detailed below.

Critical Vulnerabilities

  • CVE-2026-26980: SQL Injection in Ghost's Content API
    • Impact: Allows unauthenticated data access.
    • Affected Systems: Ghost v3.24.0 to v6.19.0.
    • Immediate Action: Upgrade to v6.19.1.
    • Mitigation: Use a WAF to block suspicious requests temporarily.
  • CVE-2026-26990: Blind SQL Injection in LibreNMS
    • Impact: Extract sensitive database information.
    • Affected Systems: LibreNMS with authenticated user access.
    • Immediate Action: Apply the latest security patches.
    • Mitigation: Sanitize input parameters rigorously.
  • CVE-2026-26318: Command Injection in systeminformation
    • Impact: Execute arbitrary commands on Linux.
    • Affected Systems: systeminformation npm package on Linux.
    • Immediate Action: Upgrade to the latest version that patches this issue.
    • Mitigation: Validate inputs before execution.
  • CVE-2026-26280: RCE via systeminformation's wifiNetworks() Function
    • Impact: Remote command execution.
    • Affected Systems: systeminformation npm package.
    • Immediate Action: Update to the latest version.
    • Mitigation: Ensure proper input sanitization.
  • CVE-2026-27013: XSS in fabric.js
    • Impact: Allows stored XSS attacks.
    • Affected Systems: fabric.js applications using SVG export.
    • Immediate Action: Update to fabric.js v7.2.0 or newer.
    • Mitigation: Review JSON inputs for unsanitized user data.
  • CVE-2026-26317: CSRF Vulnerability in OpenClaw
    • Impact: Unauthorized state changes via browser requests.
    • Affected Systems: openclaw, clawdbot npm packages.
    • Immediate Action: Enable authentication for browser control and apply the fix.
    • Mitigation: Monitor and restrict loopback binding.
  • CVE-2026-1669: HDF5 Weight Loading Issue in Keras
    • Impact: Leaks sensitive file contents.
    • Affected Systems: Keras 3.x and TensorFlow 2.x.
    • Immediate Action: Avoid loading untrusted HDF5 files.
    • Mitigation: Use alternate weight formats.
  • CVE-2026-26960: Hardlink Vulnerability in Node Tar
    • Impact: Arbitrary file read/write.
    • Affected Systems: Node tar npm module.
    • Immediate Action: Use updated tar module with security fixes.
    • Mitigation: Restrict extraction directories and monitor for symlink usage.

What to Do Now

  1. Immediately apply the patches or updates mentioned for each vulnerability.
  2. Verify installations and configurations to ensure patches are effective.
  3. Monitor systems for unusual activity or unauthorized access attempts.

Related Resources

  • Vendor advisories and patches are available on GitHub and npm for each affected package.
  • Stay informed with our upcoming blog posts analyzing these vulnerabilities in depth.

Keep reading