Weekly Vulnerability Report: Oct 12 – Oct 18, 2026
21 new CVEs were published, 10 of them rated critical or high. 9 were added to CISA's exploited list.
Between October 12, 2026 and October 18, 2026, 21 new vulnerabilities were published, 600% more than the previous week (3). 10 of them, or 48%, were rated high or critical. The busiest day was October 12, 2026, with 9 CVEs.
CISA confirmed active exploitation of 9 vulnerabilities during the week. These are listed first below because attackers are already using them. Frappe had the most new CVEs (7), and authentication bypass by spoofing was the most common weakness type (3).
Confirmed exploited this week
- 8.6 High severity
Ivanti Connect Secure Authentication Bypass by Spoofing Exploited
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- 8.8 High severity
Microsoft Windows Command Injection Exploited
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- 7.2 High severity
Palo Alto Networks PAN-OS Code Injection Exploited
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this
- 7.3 High severity
Ahsay AhsayCBS Improper Authentication Exploited
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authe
- 10.0 Critical severity
Ahsay AhsayCBS Command Injection Exploited
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman
- 9.8 Critical severity
Cisco Secure Email Gateway Relative Path Traversal Exploited
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email
- 7.5 High severity
Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenti
- 6.5 Medium severity
Fortinet Multiple Products Path Traversal Exploited
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPA
- 9.8 Critical severity
BeyondTrust Remote Support Authentication Bypass by Spoofing Exploited
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations
The 12 most important new vulnerabilities
- 10.0 Critical severity
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Exploited
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server
- 8.6 High severity
Ivanti Connect Secure Authentication Bypass by Spoofing Exploited
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- 9.8 Critical severity
Collabora Online – Built-in CODE Server OS Command Injection Exploited
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in
- 9.8 Critical severity
BeyondTrust Remote Support Authentication Bypass by Spoofing Exploited
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations
- 9.8 Critical severity
Cisco Secure Email Gateway Relative Path Traversal Exploited
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email
- 8.8 High severity
Microsoft Windows Command Injection Exploited
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- 7.2 High severity
Palo Alto Networks PAN-OS Code Injection Exploited
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this
- 6.7 Medium severity
Siemens Software Center Uncontrolled Search Path Element Exploited
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially craft
- 7.0 High severity
Ivanti Connect Secure Missing Authentication for Critical Function Exploited
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
- 8.5 High severity
EG Secure Solutions SiteGuard Server Edition OS Command Injection Exploited
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
- 4.3 Medium severity
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Exploited
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience
- 8.0 High severity
steve: Improper Certificate Validation
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) a
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 4 | 19% |
| High | 6 | 29% |
| Medium | 11 | 52% |
| Low | 0 | 0% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.