Daily digest

Friday 23 October 2026

555 new CVEs this day, in line with the recent average. Of those, 64 critical and 175 high. 46 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. Linux was the most-affected vendor with 210.

555

New CVEs

Critical

KEV additions

208

Records changed

Added to CISA KEV

Confirmed exploitation in the wild — federal remediation deadlines attach to these.

CVE-2026-114625Critical· 9.9CISA KEV0dayPoC

5d ago

Security Advisory 0199

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integ…

▾ HadalArista Networks · VeloCloud OrchestratorEPSS 1.0%via CVEORG

CVE-2026-110447Critical· 9.2CISA KEVPoC

1w ago

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an O…

▾ HadalCollabora · richdocumentscodeEPSS 12%via NVD

New this day, ranked by depth score

The 12 that matter most of the 555 published.

MAL-2026-18242Critical⚠ Exploited

4d ago

Most-changed records

Existing CVEs whose severity, score, KEV or exploitation status moved.

CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
CVE-2014-6407Arbitrary Code Execution in Dockercvss41
CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
CVE-2026-109618RCE via OOM corruptionepss, severity, cvss96
CVE-2026-109619RCE via stale global stateepss, severity, cvss96
CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoderseverity, cvss74
CVE-2026-114625Security Advisory 0199exploited, exploit_available80
CVE-2026-111756follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects (CVE-2026-111756)exploit_available, cvss53

Most-affected vendors

By CVEs published in the period.

Friday 23 October 2026

Added to CISA KEV

Security Advisory 0199

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208

New this day, ranked by depth score

Malicious code in sitecard (PyPI)

Malicious code in workslip (PyPI)

Malicious code in thornqueue (PyPI)

Malicious code in thistlerun (PyPI)

Malicious code in taskquay (PyPI)

Malicious code in slatejob (PyPI)

Malicious code in sedgehaul (PyPI)

Malicious code in runpier (PyPI)

Malicious code in reedworker (PyPI)

Malicious code in otterload (PyPI)

Malicious code in marshrunner (PyPI)

Malicious code in loadferry (PyPI)

Most-changed records

Most-affected vendors