Set of Tue 27 Oct 2026

Set of Tue 27 Oct 2026

01 · Exploited CVE of the day

Collabora · Collabora Online – Built-in CODE Server

CVE-2026-110447

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

In CISA KEV since
Ransomware use
Unknown
EPSS
0.123 · top 4%scored 26 Oct 2026
CVSS
9.2v4.0 · CNA

CISA remediation due

Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.

02 · Top 10 this week

Exploited this week

  1. CVE-2026-110447 Collabora · Collabora Online – Built-in CODE Server

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    KEV 23 Oct 2026 · EPSS 0.123 · CVSS 9.2

    EPSS 30-day trendAdvisory ↗

  2. CVE-2026-114625 Arista · VeloCloud Orchestrator

    Arista VeloCloud Orchestrator SQL Injection Vulnerability

    KEV 23 Oct 2026 · EPSS 0.010 · CVSS 9.4

    EPSS 30-day trendAdvisory ↗

Critical in widely used software

  1. CVE-2026-107656 Fortinet · FortiSandbox

    An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0…

    published 26 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    CISA SSVC: exploitation none, automatable yes, technical impact total

    Score it in CVSS →NVD entry ↗

  2. CVE-2026-76466 Cisco · Cisco TelePresence Video Communication Server (VCS) Expressway

    Cisco Expressway Series Remote Code Execution Vulnerability

    published 21 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    CISA SSVC: exploitation none, automatable yes, technical impact total

    Score it in CVSS →NVD entry ↗

  3. CVE-2026-76473 Cisco · Cisco Emergency Responder

    Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.

    published 21 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    CISA SSVC: exploitation none, automatable yes, technical impact total

    Score it in CVSS →NVD entry ↗

  4. CVE-2026-109618 PHP Group · PHP

    RCE via OOM corruption

    published 21 Oct 2026 · CVSS 9.8 v3.1 · NVD · not known exploited · Debian DSA-6574-1

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗Debian advisory ↗

  5. CVE-2026-98959 Linux · Linux

    btrfs: fix xattr replace when multiple xattrs are packed in the same item

    published 23 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    Score it in CVSS →NVD entry ↗

How these are picked

Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.

Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.

Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.

NVD, CVE.org and Debian fetched 27 Oct, 03:30 UTC

03 · Featured tool

DNS Record Lookup SERVER-ONLY

A, AAAA, MX, TXT, NS, CNAME, SOA records with TTL.

KEV this week: 2 additions · dashboard →

PRICE Free

No account · no tracking · 82% of tools run in your browser

KEV + EPSS fetched 26 Oct, 20:07 UTC · hosted in Germany