Daily digest

Tuesday 20 October 2026

A heavy day: 1,938 new CVEs, well above the recent average of about 749. Severity skewed high: 180 critical and 782 high, 50% of the total. 139 arrived with exploitation evidence or public exploit code already attached. CISA added 6 CVEs to the Known Exploited Vulnerabilities catalog. Oracle Corporation was the most-affected vendor with 996.

1938

New CVEs

180

Critical

KEV additions

617

Records changed

Added to CISA KEV

Confirmed exploitation in the wild — federal remediation deadlines attach to these.

CVE-2026-106931High· 7.8CISA KEVPoC

1w ago

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

▾ AbyssalEG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpdEPSS 2.5%via NVD

CVE-2026-96656High· 7.2CISA KEVPoC

1mo ago

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so f…

▾ Abyssalplex · media_serverEPSS 0.82%via NVD

CVE-2026-110936Medium· 6.7CISA KEVPoC

1w ago

A vulnerability has been identified in Siemens Software Center (All versions)

A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a spe…

▾ MidnightSiemens · Siemens Software CenterEPSS 0.97%via NVD

CVE-2026-96654Medium· 6.5CISA KEVPoC

1mo ago

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

▾ Midnightplex · media_serverEPSS 0.46%via NVD

CVE-2026-96655Medium· 4.3CISA KEVPoC

1mo ago

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

▾ Midnightplex · media_serverEPSS 0.46%via NVD

CVE-2026-96652Medium· 4.3CISA KEVPoC

1mo ago

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

▾ Midnightplex · media_serverEPSS 0.46%via NVD

New this day, ranked by depth score

The 12 that matter most of the 1938 published.

MAL-2026-18119Critical⚠ Exploited

1w ago

Most-changed records

Existing CVEs whose severity, score, KEV or exploitation status moved.

CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
CVE-2014-6407Arbitrary Code Execution in Dockercvss41
CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
CVE-2026-43829A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.severity, cvss51
CVE-2026-43831A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.severity, cvss51
CVE-2026-43832A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.severity, cvss51
CVE-2026-43830A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.severity, cvss48
CVE-2026-112894Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)cvss, exploit_available53

Most-affected vendors

By CVEs published in the period.

Tuesday 20 October 2026

Added to CISA KEV

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load

A vulnerability has been identified in Siemens Software Center (All versions)

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'

New this day, ranked by depth score

Malicious code in ssemver (PyPI)

Malicious code in semer (PyPI)

Malicious code in deebug (PyPI)

Malicious code in debbug (PyPI)

Malicious code in trijigo-kalip (PyPI)

Malicious code in jiklpo-tsunari-kay (PyPI)

Malicious code in hijok-lampam (PyPI)

Malicious code in hijiko-pilaka (PyPI)

Malicious code in facewareretargeter (PyPI)

Malicious code in semvver (PyPI)

Malicious code in semverr (PyPI)

Malicious code in semveer (PyPI)

Most-changed records

Most-affected vendors