Daily Cyber Brief, October 31, 2026

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host

Upgrade Arista VeloCloud Orchestrator to the fixed release for your branch: 5.2.3.18, 6.1.3.10, 6.4.2.12 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-10-26.

PHP has various global state that temporarily points into request memory

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status. CISA KEV federal due date 2026-10-29.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status. CISA KEV federal due date 2026-10-29.

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Upgrade EG Secure Solutions SiteGuard Server Edition to 3.10 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-10-23.

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208

Upgrade Collabora Collabora Online – Built-in CODE Server to 26.4.303 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-10-26.

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands

Upgrade Ivanti Connect Secure to the fixed release for your branch: 25.1.1.2, 25.1.3.0 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-10-16.

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load

Upgrade Plex Media Server to 1.43.3.10861 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-10-23.

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Upgrade Plex Media Server to 1.43.3.10861 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-10-23.

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status. CISA KEV federal due date 2026-11-13.

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of…

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status. CISA KEV federal due date 2026-11-01.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially…

Vendor solution (CVE record): Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. CISA KEV federal due date 2026-11-10.

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Upgrade Ivanti Connect Secure to 25.1.1.3 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-11-02.

This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Upgrade Siemens Software Center to 4.0.9.8 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-11-03.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular…

Upgrade GitLab Community Edition and Enterprise Edition to the fixed release for your branch: 19.2.8, 19.3.5, 19.4.2 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-11-01.

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Upgrade Plex Media Server to 1.43.3.10861 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-11-03.

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Upgrade Plex Media Server to 1.43.3.10861 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-11-03.

VMware ESX contains an insufficient logging vulnerability

Upgrade Broadcom VMware ESX to 9.0.2.0100 or later (fixed versions per the NVD record). CISA KEV federal due date 2026-11-11.

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status. CISA KEV federal due date 2026-11-10.

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status. CISA KEV federal due date 2026-10-31.

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

This makes it possible for unauthenticated attackers to execute code on the server

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers,…

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

This makes it possible for unauthenticated attackers to execute code on the server

No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.