The 10 vulnerabilities from the past seven days that most need attention, ranked by a fixed rule: flaws CISA confirmed as actively exploited come first (those used in ransomware at the top, then newest first), followed by the highest-scoring Critical CVEs published by NIST’s National Vulnerability Database.
| # | CVE | What it affects | Why it ranks | Date |
|---|---|---|---|---|
| 1 | CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | Actively exploited (CISA KEV) | October 23, 2026 |
| 2 | CVE-2026-114625 | Arista VeloCloud Orchestrator SQL Injection Vulnerability | Actively exploited (CISA KEV) | October 23, 2026 |
| 3 | CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | Actively exploited (CISA KEV) | October 20, 2026 |
| 4 | CVE-2026-96656 | Plex Media Server External Control of File Name or Path Vulnerability | Actively exploited (CISA KEV) | October 20, 2026 |
| 5 | CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Actively exploited (CISA KEV) | October 20, 2026 |
| 6 | CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | Actively exploited (CISA KEV) | October 20, 2026 |
| 7 | CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Actively exploited (CISA KEV) | October 20, 2026 |
| 8 | CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element Vulnerability | Actively exploited (CISA KEV) | October 20, 2026 |
| 9 | CVE-2026-97785 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | CVSS 10 Critical (NVD) | October 22, 2026 |
| 10 | CVE-2026-83938 | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. | CVSS 10 Critical (NVD) | October 22, 2026 |
Descriptions are quoted from CISA and NVD. Always confirm fixed versions in the vendor’s own advisory before prioritizing.
