Week of October 27, 2026
Your CVE score is data. The change is the signal.
The week's movers, every Tuesday. No noise, just what changed.
Ten CVEs crossed into CISA KEV this week, including a cluster of four in Plex Media Server plus Siemens, PHP, Collabora, and VeloCloud. Public exploits landed for IBM Langflow, Keycloak, and Open eClass. A broad week: edge gear, media servers, and developer tooling all moved on fresh evidence.
Silence is not clearance: a CVE that didn't move isn't a safe one, just one nothing has happened to that week. When something does move, that change is the exposure signal.
An uncontrolled search-path flaw (binary/DLL planting) in Siemens Software Center, now confirmed exploited by its CISA KEV listing. Confirmed at critical severity. No waiting for further evidence.
A server-side request forgery in Plex Media Server, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. No waiting for further evidence.
Improper neutralization of encoded URI schemes in Plex Media Server, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. No waiting for further evidence.
A code-injection flaw letting an attacker read every secret in IBM Langflow OSS, now weaponized with a public PoC and a Metasploit module. Active and escalating at high severity. Review against your inventory.
A weak password-recovery flaw in the Keycloak reset-credentials flow, now with a public proof of concept. Active and escalating at high severity. Review against your inventory.
An unrestricted file upload leading to code execution in Open eClass (Greek Universities Network), now with a public PoC. Active and escalating at high severity. Review against your inventory.
A SQL injection in Cisco AsyncOS email parsing, confirmed exploited and still escalating at high velocity six weeks on. Treat as immediate.
Updated every Tuesday. Subscribe to get it by email, or browse past issues.