The 10 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 10 are confirmed or reported exploited in the wild.
-
CVE-2026-109619 PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. (CISA)
- Exploited in the wild: listed by CISA on Oct 26; US federal agencies must fix it by Oct 29.
- VulnCheck KEV: reported exploited (listed Oct 21), 17 public reports.
- Public exploit code: 49 known exploits (VulnCheck KEV).
- Likelihood (EPSS): >99.9% chance of exploitation activity in the next 30 days, in the top 1% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-109618 PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. (CISA)
- Exploited in the wild: listed by CISA on Oct 26; US federal agencies must fix it by Oct 29.
- VulnCheck KEV: reported exploited (listed Oct 21), 18 public reports.
- Public exploit code: 68 known exploits (VulnCheck KEV).
- Likelihood (EPSS): >99.9% chance of exploitation activity in the next 30 days, in the top 1% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. (CISA)
- Exploited in the wild: listed by CISA on Oct 27; US federal agencies must fix it by Nov 10.
- VulnCheck KEV: reported exploited (listed Oct 26), 3 public reports. First report: ellio.tech.
- Public exploit code: 9 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 55.5% chance of exploitation activity in the next 30 days, in the top 1% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. (CISA)
- Exploited in the wild: listed by CISA on Oct 27; US federal agencies must fix it by Nov 10.
- VulnCheck KEV: reported exploited (listed Oct 24), 2 public reports. First report: sansec.io.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 30.6% chance of exploitation activity in the next 30 days, higher than 98% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. (CISA)
- Exploited in the wild: listed by CISA on Oct 23; US federal agencies must fix it by Oct 26.
- VulnCheck KEV: reported exploited (listed Oct 14), 5 public reports. First report: github.com.
- Likelihood (EPSS): 11.6% chance of exploitation activity in the next 30 days, higher than 96% of all CVEs.
- CISA assessment (SSVC): exploitation seen; attacks can be automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. (CISA)
- Exploited in the wild: listed by CISA on Oct 20; US federal agencies must fix it by Oct 23.
- VulnCheck KEV: reported exploited (listed Oct 18), 2 public reports. First report: www.boredhackerblog.info.
- Public exploit code: 3 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 1.9% chance of exploitation activity in the next 30 days, higher than 80% of all CVEs.
- CISA assessment (SSVC): exploitation seen; attacks can be automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. (CISA)
- Exploited in the wild: listed by CISA on Oct 20; US federal agencies must fix it by Oct 23.
- VulnCheck KEV: reported exploited (listed Oct 18), 2 public reports. First report: www.boredhackerblog.info.
- Public exploit code: 3 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 1.8% chance of exploitation activity in the next 30 days, higher than 78% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. (CISA)
- Exploited in the wild: listed by CISA on Oct 20; US federal agencies must fix it by Nov 3.
- VulnCheck KEV: reported exploited (listed Oct 18), 3 public reports. First report: www.boredhackerblog.info.
- Public exploit code: 4 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 1.8% chance of exploitation activity in the next 30 days, higher than 79% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. (CISA)
- Exploited in the wild: listed by CISA on Oct 20; US federal agencies must fix it by Nov 3.
- VulnCheck KEV: reported exploited (listed Oct 18), 2 public reports. First report: www.boredhackerblog.info.
- Public exploit code: 3 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 1.6% chance of exploitation activity in the next 30 days, higher than 76% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. (CISA)
- Exploited in the wild: listed by CISA on Oct 20; US federal agencies must fix it by Oct 23.
- VulnCheck KEV: reported exploited (listed Oct 14), 2 public reports. First report: www.eg-secure.co.jp.
- Likelihood (EPSS): 2.5% chance of exploitation activity in the next 30 days, higher than 85% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
