AX·NEWS
Sign in

CVE watch

CVEs of week 43, 2026 (19 Oct – 25 Oct)

22 vulnerabilities first quoted by the shared stories that week, most severe first.

RSS feedOn your SOC screen

  1. CVE-2026-106173 9.8 Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Fortinet FortiSIEM 7.5.0 · ≤ 7.4.2 · ≤ 7.3.5 +3 2 outlets
  2. CVE-2026-113380 9.3 Signal bug could let someone keep listening after you hang up Signal RingRTC < 2.72.0 1 outlet
  3. CVE-2026-109618 9.2 AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026) PHP < 8.2.35 · < 8.3.36 · < 8.4.27 +1 21 outlets
  4. CVE-2026-109619 9.2 AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026) PHP < 8.2.35 · < 8.3.36 · < 8.4.27 +1 20 outlets
  5. CVE-2026-111497 9.2 PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Google Brotli < 1.0.10 · < 1.1.1 · < 1.2.1 4 outlets
  6. CVE-2026-112900 9.2 Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image 1 outlet
  7. CVE-2026-91403 9.1 Oracle releases Java SE security alerts for high-risk leaks. Users should upgrade as soon as possible. Oracle Java SE 8u511 → 27.0.1 (7 versions) 1 outlet
  8. CVE-2026-110936 8.4 Exploited ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan Siemens Software Center < V4.0.9.8 1 outlet
  9. CVE-2026-0257 7.8 Exploited Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA Palo Alto Networks PAN-OS < 12.1.7 · < 11.2.12 · < 11.1.15 +1 1 outlet
  10. CVE-2026-105482 7.4 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 22.23.3 · ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  11. CVE-2026-105483 7.4 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  12. CVE-2026-106069 7.4 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 22.23.3 · ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  13. CVE-2026-106072 6.7 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 22.23.3 · ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  14. CVE-2026-105481 6.5 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 22.23.3 · ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  15. CVE-2026-96652 5.3 Exploited CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws Plex Media Server < 1.43.3.10861 1 outlet
  16. CVE-2026-106074 4.8 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 22.23.3 · ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  17. CVE-2026-106070 3.7 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 26.12.0 1 outlet
  18. CVE-2026-106071 3.6 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 26.12.0 1 outlet
  19. CVE-2026-106073 3.3 Please update immediately: Node.js release high-risk security updates at the highest level nodejs node ≤ 22.23.3 · ≤ 24.22.0 · ≤ 26.12.0 1 outlet
  20. CVE-2026-115560 URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches 2 outlets
  21. CVE-2026-107891 CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes 1 outlet
  22. CVE-2026-111943 CVE-2026-111943: Compromised Intermediate Certificate Authority Go standard library crypto/x509 < 1.26.10 · < 1.27.3 1 outlet