Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is.
Below: every entry added between 19 October and 25 October 2026, copied from the catalogue and linked to its NVD record, plus what Romania's national cyber security directorate and Have I Been Pwned published in the same days. Nothing is estimated or rewritten.
The 8 actively exploited vulnerabilities added this week
| Added | Product | CVE | Known ransomware use |
|---|---|---|---|
| 23 Oct | Arista VeloCloud Orchestrator SQL Injection Vulnerability | CVE-2026-114625 | not known |
| 23 Oct | Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | CVE-2026-110447 | not known |
| 20 Oct | Plex Media Server External Control of File Name or Path Vulnerability | CVE-2026-96656 | not known |
| 20 Oct | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | CVE-2026-96655 | not known |
| 20 Oct | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | CVE-2026-96654 | not known |
| 20 Oct | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | CVE-2026-96652 | not known |
| 20 Oct | Siemens Software Center Uncontrolled Search Path Element Vulnerability | CVE-2026-110936 | not known |
| 20 Oct | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | CVE-2026-106931 | not known |
What Romania's DNSC flagged the same week
Alerts from DNSC, Romania's national cyber security directorate, with their original titles in Romanian:
- ALERTĂ: Vulnerabilități critice în GitLab, 23 October
- ALERTĂ: Vulnerabilități critice în PHP, 21 October
When a national authority and CISA point at the same product in the same week, that product goes to the top of the queue.
Breaches added to Have I Been Pwned
- Assurance Retraite: 70,372 accounts, added 20 October. Check the breach page
If your team's work addresses may be in one of these, check the breach page and the password reuse question, not only the address.
How to use a list like this in an hour
- Start with what faces the internet. VPN and access gateways, firewalls, routers, mail servers and public web platforms are how many ransomware incidents start.
- Search your inventory by product name, not by memory. "We don't run that" is a claim, and the asset list is the evidence.
- Patch or apply the vendor mitigation, then confirm the version. A patch that was downloaded but not applied reads as done in a ticket and is still exploitable.
- If you cannot patch today, reduce exposure: restrict the management interface to known addresses, disable the affected feature, or put the service behind an access gateway you trust.
Where this comes from
A small collector reads official sources every hour: DNSC, CERT-EU, CERT-FR (ANSSI), CERT-Bund (BSI), the UK NCSC, CISA KEV, Have I Been Pwned and three specialist newsrooms. It copies each item exactly, with its source link, and publishes the result on one page:
https://devaland.cloud/alerte-live.html (in Romanian, with every title kept in its original language).
Nothing on that page or in this post is written by a model. A security page that paraphrases an advisory wrongly does more harm than no page at all.
Sources: CISA KEV catalogue (dateAdded 2026-10-19 to 2026-10-25), DNSC alerts, Have I Been Pwned. Generated from the sources on 2026-10-26.
Top comments (0)