Tuesday 20 Oct 2026

Added to CISA's known exploited list

• CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityEG Secure Solutions SiteGuard Server Edition · High 7.8 · CISA: check for compromise · Federal deadline 2026-10-23
• CVE-2026-96656 Plex Media Server External Control of File Name or Path VulnerabilityPlex Media Server · High 8.6 · CISA: check for compromise · Federal deadline 2026-10-23 · Fixed in 1.43.3.10861
• CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server · Medium 6.9 · Federal deadline 2026-10-23 · Fixed in 1.43.3.10861
• CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server · Medium 4.3 · Federal deadline 2026-11-03 · Fixed in 1.43.3.10861
• CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server · Medium 4.3 · Federal deadline 2026-11-03 · Fixed in 1.43.3.10861
• CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens Software Center · Medium 6.7 · Federal deadline 2026-11-03

Supply chain compromises

• Malicious release ccl-global-shopping 99.9.1 on npm was a malicious releaseccl-global-shopping 99.9.1
• Malicious release sc-wizard 99.9.1 on npm was a malicious releasesc-wizard 99.9.1
• Malicious release fanarena-common 99.9.1 on npm was a malicious releasefanarena-common 99.9.1
• Malicious release sc-announcer 99.9.1 on npm was a malicious releasesc-announcer 99.9.1
• Malicious release @platform-services/hrm-mfe-core 99.9.1 on npm was a malicious release@platform-services/hrm-mfe-core 99.9.1
• Malicious release test-workalendar-internal 0.0.1, 0.0.2, 0.0.3 on PyPI was a malicious releasetest-workalendar-internal 0.0.1, 0.0.2, 0.0.3
• Malicious release workcalender 17.1.0.dev0 on PyPI was a malicious releaseworkcalender 17.1.0.dev0
• Malicious release pafex 2.3 on PyPI was a malicious releasepafex 2.3
• Malicious release resion 22.0.1 on PyPI was a malicious releaseresion 22.0.1
• Malicious release workalender 17.1.0.dev0 on PyPI was a malicious releaseworkalender 17.1.0.dev0
• Malicious release research-probe-6150c1c915 0.1.0 on PyPI was a malicious releaseresearch-probe-6150c1c915 0.1.0
• Malicious release security-research-startup-snapshot-810764b303 0.1.0 on PyPI was a malicious releasesecurity-research-startup-snapshot-810764b303 0.1.0
• Malicious release semmver 1.0.0 on PyPI was a malicious releasesemmver 1.0.0
• Malicious release semveer 1.0.0 on PyPI was a malicious releasesemveer 1.0.0
• Malicious release semverr 1.0.0 on PyPI was a malicious releasesemverr 1.0.0
• Malicious release semvver 1.0.0 on PyPI was a malicious releasesemvver 1.0.0
• Malicious release @securihackbot/depconf-stage-1792484738 1.0.0 on npm was a malicious release@securihackbot/depconf-stage-1792484738 1.0.0
• Malicious release memories-core-web 99.0.0 on npm was a malicious releasememories-core-web 99.0.0
• Malicious release nwfp-build-config 1.0.0, 0.0.0-stage on npm was a malicious releasenwfp-build-config 1.0.0, 0.0.0-stage
• Malicious release rs-lookout-sandbox-poc 1.0.1 on npm was a malicious releasers-lookout-sandbox-poc 1.0.1
• Malicious release facewareretargeter 9.9.9 on PyPI was a malicious releasefacewareretargeter 9.9.9
• Malicious release hijiko-pilaka 1.0.0 on PyPI was a malicious releasehijiko-pilaka 1.0.0
• Malicious release hijok-lampam 1.0.0 on PyPI was a malicious releasehijok-lampam 1.0.0
• Malicious release jiklpo-tsunari-kay 1.0.0 on PyPI was a malicious releasejiklpo-tsunari-kay 1.0.0
• Malicious release trijigo-kalip 1.0.0 on PyPI was a malicious releasetrijigo-kalip 1.0.0
• Malicious release debbug 1.0.0 on PyPI was a malicious releasedebbug 1.0.0
• Malicious release deebug 1.0.0 on PyPI was a malicious releasedeebug 1.0.0
• Malicious release semer 1.0.0 on PyPI was a malicious releasesemer 1.0.0
• Malicious release ssemver 1.0.0 on PyPI was a malicious releasessemver 1.0.0

Critical flaws in products attackers have targeted

• CVE-2026-113252 Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (CGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113328 Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secuGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113235 Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium seGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113089 Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (ChromiumGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113023 Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium sGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113300 Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sevGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113014 Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securitGoogle Chrome · Critical 9.6 · Fixed in 156.0.8078.47
• CVE-2026-113189 Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47

10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON