Week 43, 2026

19 October to 25 October 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 4,090
Critical: 380
High: 1,544
Added to KEV: 8

Critical 380High 1,544Medium 1,762Low 240Not scored 164All 4,090 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-114625
Security Advisory 0199
Arista Networks · VeloCloud Orchestrator
ExploitedCritical9.4
CVE-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…
Collabora · Collabora Online - Built-in CODE Server
ExploitedCritical9.2
CVE-2026-96656
Plex Media Server arbitrary file write
Plex · Media Server
ExploitedHigh8.6
CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM…
EG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpd
ExploitedHigh8.5
CVE-2026-110936
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an…
Siemens · Siemens Software Center
ExploitedHigh8.4
CVE-2026-96654
Plex Media Server URL injection
Plex · Media Server
ExploitedMedium6.9
CVE-2026-96655
Plex Media Server arbitrary-host SSRF
Plex · Media Server
ExploitedMedium5.3
CVE-2026-96652
Plex Media Server SSRF
Plex · Media Server
ExploitedMedium5.3

Most severe new CVEsBy CVSS score

CVE-2026-114575
TOTOLINK A950RG product.so UploadCustomModule command injection
TOTOLINK · A950RG
Critical10.0
CVE-2026-79846
Unauthenticated Command Injection Vulnerabilities in AOS-8
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)
Critical10.0
CVE-2026-110264
Integer Overflow or Wraparound in GitLab
GitLab · GitLab
Critical10.0
CVE-2026-78162
Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
Apache Software Foundation · Apache Camel
Critical10.0
CVE-2026-110063
VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
Microsoft · VM Inspector for Azure Virtual Machines
Critical10.0
CVE-2026-79847
Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)
Critical10.0
CVE-2026-102785
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
yootheme.com · YOOtheme Pro extension for Joomla
Critical10.0
CVE-2026-79851
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)
Critical10.0
CVE-2026-83938
Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Microsoft · Azure Kubernetes Configuration Service
Critical10.0
CVE-2026-79849
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)
Critical10.0

Week 43, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses