Skip to main content

Every Monday

Vulnerability brief, week 2026-W43

From 2026-10-19 to 2026-10-25 (UTC), as frozen on the Monday that followed. Each line names its sources.

First attested exploited
56
Added to CISA KEV
8
High EPSS at publication
1

Added to CISA KEV8

  1. CVE-2026-110447KEV since 2026-10-23

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    Severity criticalEPSS high

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-110447 for CVE-2026-110447
  2. CVE-2026-114625KEV since 2026-10-23

    Security Advisory 0199

    Severity criticalEPSS mediumFixed in 6.4.2.12 · 6.1.3.10 · 5.2.3.18

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-114625 for CVE-2026-114625
  3. CVE-2026-106931KEV since 2026-10-20

    EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

    Severity highEPSS mediumFixed in 8.00 · 7.00 · 3.10

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-106931 for CVE-2026-106931
  4. CVE-2026-110936KEV since 2026-10-20

    Siemens Software Center Uncontrolled Search Path Element Vulnerability

    Severity highEPSS lowFixed in 4.0.9.8

    Sources: CISA KEV, CISA-ADP, GCVE · enisa-cnw-kev, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-110936 for CVE-2026-110936
  5. CVE-2026-96652KEV since 2026-10-20

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Severity mediumEPSS mediumFixed in 1.43.3.10861

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-96652 for CVE-2026-96652
  6. CVE-2026-96654KEV since 2026-10-20

    Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

    Severity mediumEPSS mediumFixed in 1.43.3.10861

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-96654 for CVE-2026-96654
  7. CVE-2026-96655KEV since 2026-10-20

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Severity mediumEPSS mediumFixed in 1.43.3.10861

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-96655 for CVE-2026-96655
  8. CVE-2026-96656KEV since 2026-10-20

    Plex Media Server External Control of File Name or Path Vulnerability

    Severity highEPSS mediumFixed in 1.43.3.10861

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-96656 for CVE-2026-96656

Exploitation first attested12

  1. CVE-2026-109619PHP2Shellexploited since 2026-10-22

    RCE via stale global state

    Severity criticalEPSS highFixed in 12.2.4 · 12.1.4 · 11.2.4 · 11.1.4

    Sources: GCVE · previdian, GCVE · shadowserver, FIRST EPSS, NVD

    Watch PHP2Shell for CVE-2026-109619
  2. CVE-2026-109618PHP2Shellexploited since 2026-10-21

    RCE via OOM corruption

    Severity criticalEPSS highFixed in 12.2.4 · 12.1.4 · 11.2.4 · 11.1.4

    Sources: GCVE · previdian, GCVE · shadowserver, FIRST EPSS, NVD

    Watch PHP2Shell for CVE-2026-109618
  3. CVE-2024-29198exploited since 2026-10-20

    Severity highEPSS mediumFixed in 2.25.2 · 2.24.4

    Sources: GCVE · previdian, GCVE · shadowserver, FIRST EPSS, NVD

    Watch CVE-2024-29198 for CVE-2024-29198
  4. CVE-2021-23337exploited since 2026-10-23

    Severity highEPSS highFixed in 9.2.6.1 · 4.18.0 · 4.17.21 · 1.0

    Sources: GCVE · shadowserver, FIRST EPSS, NVD

    Watch CVE-2021-23337 for CVE-2021-23337
  5. CVE-2026-106173exploited since 2026-10-23

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-106173 for CVE-2026-106173
  6. CVE-2026-97237exploited since 2026-10-22

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-97237 for CVE-2026-97237
  7. CVE-2023-50917exploited since 2026-10-22

    Severity criticalEPSS highFixed in 2023-11-15

    Sources: GCVE · shadowserver, FIRST EPSS, NVD

    Watch CVE-2023-50917 for CVE-2023-50917
  8. CVE-2025-71434exploited since 2026-10-22

    Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2025-71434 for CVE-2025-71434
  9. CVE-2023-54413exploited since 2026-10-22

    WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang

    Severity mediumEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2023-54413 for CVE-2023-54413
  10. CVE-2024-58393exploited since 2026-10-22

    i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2024-58393 for CVE-2024-58393
  11. CVE-2024-58394exploited since 2026-10-22

    Retool 3.88.0 XSS via /api/imageProxy SVG Proxying

    Severity mediumEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2024-58394 for CVE-2024-58394
  12. CVE-2024-58396exploited since 2026-10-22

    YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2024-58396 for CVE-2024-58396

45 more CVEs qualified this week; an issue keeps the first 20.

Get the brief every Monday

One email a week, unsubscribe in one click. We first send a link to confirm the address.