Weekly Vulnerability Report: Oct 19 – Oct 25, 2026
23 new CVEs were published, 12 of them rated critical or high. 8 were added to CISA's exploited list.
Between October 19, 2026 and October 25, 2026, 23 new vulnerabilities were published, 34% fewer than the previous week (35). 12 of them, or 52%, were rated high or critical. The busiest day was October 22, 2026, with 12 CVEs.
CISA confirmed active exploitation of 8 vulnerabilities during the week. These are listed first below because attackers are already using them. WSO2 had the most new CVEs (7), and improper limitation of a pathname to a restricted directory was the most common weakness type (4).
Confirmed exploited this week
- 8.5 High severity
EG Secure Solutions SiteGuard Server Edition OS Command Injection Exploited
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
- 6.7 Medium severity
Siemens Software Center Uncontrolled Search Path Element Exploited
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially craft
- 4.3 Medium severity
Plex Media Server Server-Side Request Forgery (SSRF) Exploited
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
- 6.5 Medium severity
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Exploited
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
- 4.3 Medium severity
Plex Media Server Server-Side Request Forgery (SSRF) Exploited
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
- 7.2 High severity
Plex Media Server External Control of File Name or Path Exploited
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without si
- 9.8 Critical severity
Collabora Online – Built-in CODE Server OS Command Injection Exploited
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in
- 9.9 Critical severity
Arista VeloCloud Orchestrator SQL Injection Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
The 11 most important new vulnerabilities
- 9.8 Critical severity
Google Brotli Unchecked Return Value Exploited
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a
- 9.8 Critical severity
PHP Memory Corruption Exploited
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The su
- 9.9 Critical severity
Arista VeloCloud Orchestrator SQL Injection Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 8.1 High severity
PHP Stale Internal Request-State Exploited
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subse
- 9.8 Critical severity
bytebase: Authentication Bypass by Spoofing
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST en
- 9.1 Critical severity
YiShaAdmin: Improper Limitation of a Pathname to a Restricted Directory
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send craft
- 8.2 High severity
PHPOK: Improper Neutralization of Special Elements used in an SQL Command
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort t
- 7.5 High severity
Kavita: Improper Limitation of a Pathname to a Restricted Directory
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename v
- 8.2 High severity
Readymade Unilevel Ecommerce MLM: Improper Neutralization of Special Elements used in an SQL Command
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php w
- 8.2 High severity
NotificationX: Improper Neutralization of Special Elements used in an SQL Command
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}.
- 7.5 High severity
CPAS Audit Management System: Improper Limitation of a Pathname to a Restricted Directory
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 5 | 22% |
| High | 7 | 30% |
| Medium | 10 | 43% |
| Low | 1 | 4% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.