Service & Internet Intelligence

Security intelligence

Newly published and actively exploited vulnerabilities from official sources: CISA KEV, NVD, ENISA EUVD, GitHub Advisories, OSV, Microsoft, Red Hat, Ubuntu, Debian, php.net, national CERTs (USOM, CERT-EU, NCSC UK, CERT-Bund, CERT-FR, JPCERT/CC) and vendor PSIRTs (Cisco, Fortinet, Palo Alto Networks). Every item states its sources, publication time and verification state.

Last updated: October 25 at 07:09 UTC · 10:09 TRT · 26 of 26 sources reachable · Next Microsoft Patch Tuesday: November 10, 2026

50 of 269 items

  1. CriticalVERIFIED

    Arista VeloCloud Orchestrator SQL Injection Vulnerability

    Affected: Arista — VeloCloud OrchestratorCVE-2026-114625CVSS 9.4 (v4.0, EUVD)EPSS 0.8% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: October 26, 2026

    Severity set by the Korantix rule

    Sources: CISA KEV, EUVD

  2. CriticalVERIFIED

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    Affected: Collabora — Collabora Online – Built-in CODE ServerCVE-2026-110447CVSS 9.2 (v4.0, EUVD)EPSS 2.3% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: October 26, 2026

    Remote code execution

    Severity set by the Korantix rule

    Sources: CISA KEV, EUVD

  7. CriticalVERIFIED

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects…

    Affected: WPFactory — Product Filter by WBWCVE-2026-112866CVSS 9.3 (v3.1, EUVD)EPSS 0.4% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  8. CriticalVERIFIED

    Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

    Affected: Tribulant Software — NewslettersCVE-2026-94075CVSS 9.8 (v3.1, EUVD)EPSS 0.6% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  9. CriticalVERIFIED

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newslette…

    Affected: Tribulant Software — NewslettersCVE-2026-111402CVSS 9.3 (v3.1, EUVD)EPSS 0.4% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  11. CriticalVERIFIED

    The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthentica…

    Affected: Unknown — asVereinbaseCVE-2026-110956CVSS 9.8 (v3.1, EUVD)EPSS 0.2% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  13. CriticalVERIFIED

    When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.

    Affected: gitroomhq — postiz-appCVE-2026-115932CVSS 9.6 (v3.1, EUVD)EPSS 0% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  24. CriticalVERIFIED

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

    Affected: ThemeREX Group — Little BirdiesCVE-2026-112859CVSS 9.8 (v3.1, EUVD)EPSS 56% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  26. CriticalVERIFIED

    Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

    Affected: Axiomthemes — Holistic CenterCVE-2026-112854CVSS 9.8 (v3.1, EUVD)EPSS 56% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  29. CriticalVERIFIED

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is f…

    Affected: Linux — LinuxCVE-2026-99079CVSS 9.8 (v3.1, EUVD)EPSS 21% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  30. CriticalVERIFIED

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers…

    Affected: Linux — LinuxCVE-2026-99078CVSS 9.8 (v3.1, EUVD)EPSS 23% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  38. CriticalVERIFIED

    edk2: Pre-boot RCE in EDK II PXE driver

    Affected: Red HatCVE-2026-97631CVSS 8.8 (v3.1, Red Hat)

    Operational impact
    May allow remote code execution.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Remote code execution

    Sources: Red Hat

  42. CriticalVERIFIED

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent deco…

    Affected: Google — BrotliCVE-2026-111497CVSS 9.2 (v4.0, EUVD)EPSS 71% (FIRST)

    Operational impact
    Organisations using the affected product may be at risk.
    Recommended first step
    Move to the vendor's fixed release; apply the workaround if one exists.

    Severity set by the Korantix rule

    Sources: EUVD

  46. HighVERIFIED

    EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

    Affected: EG Secure Solutions — SiteGuard Server EditionCVE-2026-106931CVSS 8.5 (v4.0, EUVD)EPSS 1.2% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: October 23, 2026

    Severity set by the Korantix rule

    Sources: CISA KEV, EUVD

  47. HighVERIFIED

    Plex Media Server External Control of File Name or Path Vulnerability

    Affected: Plex — Media ServerCVE-2026-96656CVSS 8.6 (v4.0, NVD)EPSS 0.8% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: October 23, 2026

    Severity set by the Korantix rule

    Sources: CISA KEV

  48. HighVERIFIED

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Affected: Plex — Media ServerCVE-2026-96655CVSS 5.3 (v4.0, NVD)EPSS 0.5% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: November 3, 2026

    Severity set by the Korantix rule

    Sources: CISA KEV

  49. HighVERIFIED

    Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

    Affected: Plex — Media ServerCVE-2026-96654CVSS 6.9 (v4.0, NVD)EPSS 0.5% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: October 23, 2026

    Severity set by the Korantix rule

    Sources: CISA KEV

  50. HighVERIFIED

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Affected: Plex — Media ServerCVE-2026-96652EPSS 0.5% (FIRST)

    Known exploited (CISA KEV)

    Operational impact
    Attackers are using this vulnerability in real attacks.
    Recommended first step
    Update the affected product now or apply the vendor's mitigation; prioritise internet-facing systems. CISA due date for US federal agencies: November 3, 2026

    Severity set by the Korantix rule

    Sources: CISA KEV

Source status

  • CISA Known Exploited Vulnerabilities: working (October 25 at 06:57 UTC · 09:57 TRT)
  • USOM — T.C. Siber Güvenlik Başkanlığı: working (October 25 at 06:57 UTC · 09:57 TRT)
  • Cisco PSIRT: working (October 25 at 06:57 UTC · 09:57 TRT)
  • CERT-EU — Cybersecurity Service for the EU institutions: working (October 25 at 06:57 UTC · 09:57 TRT)
  • JPCERT/CC — Japan Computer Emergency Response Team: working (October 25 at 06:57 UTC · 09:57 TRT)
  • BleepingComputer: working (October 25 at 06:57 UTC · 09:57 TRT)
  • The Record: working (October 25 at 06:57 UTC · 09:57 TRT)
  • SANS Internet Storm Center: working (October 25 at 06:57 UTC · 09:57 TRT)
  • KrebsOnSecurity: working (October 25 at 06:57 UTC · 09:57 TRT)
  • NIST NVD 2.0 — critical CVEs (last 72 h): working (October 25 at 06:57 UTC · 09:57 TRT)
  • NIST NVD 2.0 — PHP (CPE php:php, last 14 days): working (October 25 at 06:57 UTC · 09:57 TRT)
  • ENISA EU Vulnerability Database (CVSS ≥ 7, last 3 days): working (October 25 at 06:57 UTC · 09:57 TRT)
  • ENISA EUVD — exploited vulnerabilities: working (October 25 at 06:57 UTC · 09:57 TRT)
  • GitHub Security Advisories (reviewed, all ecosystems): working (October 25 at 06:57 UTC · 09:57 TRT)
  • GitHub Security Advisories — Composer (PHP): working (October 25 at 06:57 UTC · 09:57 TRT)
  • OSV.dev — Packagist (PHP) ecosystem: working (October 25 at 06:57 UTC · 09:57 TRT)
  • Microsoft Security Response Center — Security Update Guide: working (October 25 at 06:57 UTC · 09:57 TRT)
  • Red Hat Security Data API: working (October 25 at 06:57 UTC · 09:57 TRT)
  • Ubuntu Security (CVE tracker): working (October 25 at 06:57 UTC · 09:57 TRT)
  • Debian Security Advisories: working (October 25 at 06:57 UTC · 09:57 TRT)
  • php.net — release feed (security releases): working (October 25 at 06:57 UTC · 09:57 TRT)
  • NCSC (UK National Cyber Security Centre): working (October 25 at 06:57 UTC · 09:57 TRT)
  • BSI CERT-Bund (WID advisories, high/critical, new): working (October 25 at 06:57 UTC · 09:57 TRT)
  • CERT-FR (ANSSI): working (October 25 at 06:57 UTC · 09:57 TRT)
  • Fortinet PSIRT (FortiGuard): working (October 25 at 06:57 UTC · 09:57 TRT)
  • Palo Alto Networks Security Advisories: working (October 25 at 06:57 UTC · 09:57 TRT)

Severity: the vendor's or authority's own rating when it has one; otherwise the documented Korantix rule (a CISA KEV entry is at least High; Critical when used by ransomware or CVSS is 9.0 or higher; without a rating, the band of the published CVSS score). Top priority badge: only when the CVE is in CISA KEV, its FIRST EPSS is at least 0.5 and its published CVSS is at least 9.0. EPSS and CVSS are never estimated; a missing value stays blank. Times are shown in UTC and TRT. When sources disagree, the conflict is shown on the item, not hidden. Source terms: docs/growth/security-intelligence.md. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS scores: FIRST (first.org/epss).