Week 43, 2026

19–25 October 2026

New CVEs: 4,114
Critical: 369
High: 1,558
Newly exploited: 9
Advisories: 834
Malicious pkgs: 386

Newly exploited 9

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Unscored
CVE-2015-0279 ENISA Oct 25, 2026 JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
EPSS 3.9%
Critical 9.9
CVE-2026-114625 KEV Oct 23, 2026 Security Advisory 0199
Arista Networks · VeloCloud Orchestrator

EPSS 1%
Critical 9.2
CVE-2026-110447 KEV Oct 23, 2026 Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…
Collabora · Collabora Online - Built-in CODE Server

EPSS 73%
High 7.8
CVE-2026-106931 KEV Oct 20, 2026 SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privi…
EG Secure Solutions · SiteGuard Server Edition for Apache httpd · SiteGuard Server Edition for IIS · SiteGuard Server Edition for Nginx on FreeBSD

EPSS 2.5%
High 7.2
CVE-2026-96656 KEV Oct 20, 2026 Plex Media Server arbitrary file write
Plex · Media Server

EPSS 1.8%
Medium 6.7
CVE-2026-110936 KEV Oct 20, 2026 A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an …
Siemens · Siemens Software Center
Medium 6.5
CVE-2026-96654 KEV Oct 20, 2026 Plex Media Server URL injection
Plex · Media Server

EPSS 1.9%
Medium 4.3
CVE-2026-96652 KEV Oct 20, 2026 Plex Media Server SSRF
Plex · Media Server

EPSS 12%
Medium 4.3
CVE-2026-96655 KEV Oct 20, 2026 Plex Media Server arbitrary-host SSRF
Plex · Media Server

EPSS 11%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.2
CVE-2026-109619 RCE via stale global state
PHP Group · PHP

EPSS 100%
Critical 9.2
CVE-2026-109618 RCE via OOM corruption
PHP Group · PHP

EPSS 100%
Critical 9.2
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder
Google · Brotli

EPSS 83%
Critical 9.8
CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
WAVLINK · WL-WN530BE1-A

EPSS 3.5%
Critical 9.8
CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
chatchat-space · Langchain-Chatchat

EPSS 2.2%
Critical 10.0
CVE-2026-114575 TOTOLINK A950RG product.so UploadCustomModule command injection
Totolink · A950RG

EPSS 2.2%
Critical 9.9
CVE-2026-113506 aaPanel File Manager common.py ExecShell os command injection
EPSS 2.1%
Critical 9.9
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
DrayTek · Vigor2960

EPSS 2.1%
Critical 9.9
CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injection
H3C · Magic NX15

EPSS 2%
Critical 9.8
CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
FanRuan · FineReport

EPSS 2%
Critical 9.9
CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
DrayTek · Vigor2960

EPSS 1.9%
Critical 9.9
CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
DrayTek · Vigor2960

EPSS 1.9%
Critical 9.2
CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials
laravel · framework

EPSS 1.8%
Critical 9.8
CVE-2026-79861 Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)

EPSS 1.7%
Critical 9.1
CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A sp…
Totolink · Totolink

EPSS 1.6%

All 369 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 4.7
CVE-2026-112195 FusionPBX Dialplan Editor dialplan.php os command injection
EPSS 5%
High 8.6
CVE-2026-103038 PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
StreamSoft · PingTools Network Utilities

EPSS 3.4%
High 8.8
CVE-2026-52356 An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary command…
EPSS 2.1%
High 7.3
CVE-2026-112301 orbitale imagemagick-php Command.php font os command injection
orbitale · imagemagick-php

EPSS 2%
High 8.2
CVE-2026-116067 Paisa before 0.7.8 Path Traversal via Editor and Sheet API
ananthakumaran · paisa

EPSS 1.7%
Medium 6.8
CVE-2026-95715 Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)

EPSS 1.6%
High 8.6
CVE-2026-43850 A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
Advantech · ADAM-3600

EPSS 1.6%
High 7.4
CVE-2026-113396 DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
DrayTek · Vigor2960

EPSS 1.6%

Advisories

openSUSE-SU-2026:12234-1 chromedriver-156.0.8078.47-1.1 on GA media 353 CVEs
SUSE-SU-2026:4858-1 Security update for webkit2gtk3 237 CVEs
openSUSE-SU-2026:22167-1 Security update for the Linux Kernel 129 CVEs
SUSE-SU-2026:24422-1 Security update for the Linux Kernel 129 CVEs
SUSE-SU-2026:24446-1 Security update for the Linux Kernel 129 CVEs
SUSE-SU-2026:24437-1 Security update for the Linux Kernel 129 CVEs
SUSE-SU-2026:24386-1 Security update for the Linux Kernel 129 CVEs
SUSE-SU-2026:24371-1 Security update for the Linux Kernel 98 CVEs
SUSE-SU-2026:24379-1 Security update for the Linux Kernel 98 CVEs
SUSE-SU-2026:4736-1 Security update for MozillaThunderbird 86 CVEs