Skip to content

Data collected

CVEs Live

Added to CISA KEV, 19 Oct 2026 to 25 Oct 2026

6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog in this week, which had not ended when the data was collected. Listed by risk: highest EPSS first.

Build snapshot collected · KEV catalog 2026.10.21 · EPSS of 21 Oct 2026 · not a live feed: collected once, at build time

  1. CVE-2026-106931Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    EG Secure Solutions · SiteGuard Server Edition

    EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

    Severity

    8.5HIGHCVSS 4.0 · jpcert

    Attack probability (EPSS)

    1.37%72th pct

    KEV dates

    added due
  2. CVE-2026-96656Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Plex · Media Server

    Plex Media Server External Control of File Name or Path Vulnerability

    Severity

    8.6HIGHCVSS 4.0 · cisa-cg

    Attack probability (EPSS)

    0.76%55th pct

    KEV dates

    added due
  3. CVE-2026-96654Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Plex · Media Server

    Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

    Severity

    6.9MEDIUMCVSS 4.0 · cisa-cg

    Attack probability (EPSS)

    0.43%36th pct

    KEV dates

    added due
  4. CVE-2026-96655Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Plex · Media Server

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Severity

    5.3MEDIUMCVSS 4.0 · cisa-cg

    Attack probability (EPSS)

    0.42%35th pct

    KEV dates

    added due
  5. CVE-2026-96652Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Plex · Media Server

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Severity

    5.3MEDIUMCVSS 4.0 · cisa-cg

    Attack probability (EPSS)

    0.42%35th pct

    KEV dates

    added due
  6. CVE-2026-110936Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Siemens · Software Center

    Siemens Software Center Uncontrolled Search Path Element Vulnerability

    Severity

    8.4HIGHCVSS 4.0 · siemens

    Attack probability (EPSS)

    0.26%17th pct

    KEV dates

    added due

All entries are in KEV, so the order is EPSS probability, then published CVSS. Scores are shown as each source published them.

The week in numbers

3 vendors had products added: Plex (4), EG Secure Solutions (1), Siemens (1). CISA marks none of the 6 as known to be used in ransomware campaigns.

    Due dates in this batch run from 23 Oct 2026 to 3 Nov 2026. They bind US federal civilian agencies; for everyone else they indicate how urgent CISA considers each fix.

    Other weeks

    Questions

    How many vulnerabilities were added to CISA KEV in the week of 19 Oct 2026?

    6, between 19 Oct 2026 and 25 Oct 2026, according to catalog version 2026.10.21 collected on 22 Oct 2026. The week had not ended at collection time, so the number can still grow.

    Why do additions come in batches?

    CISA updates the catalog on US business days and often adds several CVEs in one notice, for example a set of vulnerabilities in the same product that are chained in an attack. Weeks with no additions also happen.

    How is the week defined?

    By the "dateAdded" field of each entry, grouped in ISO 8601 weeks, Monday to Sunday.

    Related sections