Daily brief
Friday 23 Oct 2026
2 added to CISA's known exploited list, 1 reported exploited and not on CISA's list, 31 supply chain compromises.
Added to CISA's known exploited list
- CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Collabora Online – Built-in CODE Server · Critical 9.2 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 26.4.303
- CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista VeloCloud Orchestrator · Critical 9.9 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 5.2.3.18
Reported exploited, not on CISA's list yet
- CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially craFortinet FortiSIEM · Critical 9.4 · Exploitation reported by 4 outlets, first by Bluesky: exploited in the wild
Supply chain compromises
- Malicious release LiteLLM 1.107.0 on PyPI was a malicious releaselitellm 1.107.0
- Malicious release @tekmidian/pai 1.0.9, 1.0.8, 1.0.10 on npm was a malicious release@tekmidian/pai 1.0.9, 1.0.8, 1.0.10
- Malicious release qowa 0.1.0 on PyPI was a malicious releaseqowa 0.1.0
- Malicious release onsokets 0.1.0 on PyPI was a malicious releaseonsokets 0.1.0
- Malicious release skillward 0.1.1, 0.1.2 on npm was a malicious releaseskillward 0.1.1, 0.1.2
- Malicious release kestreljob 0.1.0 on PyPI was a malicious releasekestreljob 0.1.0
- Malicious release badgertask 0.1.0 on PyPI was a malicious releasebadgertask 0.1.0
- Malicious release brambletask 0.1.0 on PyPI was a malicious releasebrambletask 0.1.0
- Malicious release brookworker 0.1.0 on PyPI was a malicious releasebrookworker 0.1.0
- Malicious release cobbleload 0.1.0 on PyPI was a malicious releasecobbleload 0.1.0
- Malicious release ferretqueue 0.1.0 on PyPI was a malicious releaseferretqueue 0.1.0
- Malicious release flintqueue 0.1.0 on PyPI was a malicious releaseflintqueue 0.1.0
- Malicious release jobwharf 0.1.0 on PyPI was a malicious releasejobwharf 0.1.0
- Malicious release juniperrun 0.1.0 on PyPI was a malicious releasejuniperrun 0.1.0
- Malicious release larchworker 0.1.0 on PyPI was a malicious releaselarchworker 0.1.0
- Malicious release loadferry 0.1.0 on PyPI was a malicious releaseloadferry 0.1.0
- Malicious release marshrunner 0.1.0 on PyPI was a malicious releasemarshrunner 0.1.0
- Malicious release otterload 0.1.0 on PyPI was a malicious releaseotterload 0.1.0
- Malicious release reedworker 0.1.0 on PyPI was a malicious releasereedworker 0.1.0
- Malicious release runpier 0.1.0 on PyPI was a malicious releaserunpier 0.1.0
- Malicious release sedgehaul 0.1.0 on PyPI was a malicious releasesedgehaul 0.1.0
- Malicious release slatejob 0.1.0 on PyPI was a malicious releaseslatejob 0.1.0
- Malicious release taskquay 0.1.0 on PyPI was a malicious releasetaskquay 0.1.0
- Malicious release thistlerun 0.1.0 on PyPI was a malicious releasethistlerun 0.1.0
- Malicious release thornqueue 0.1.0 on PyPI was a malicious releasethornqueue 0.1.0
- Malicious release workslip 0.1.0 on PyPI was a malicious releaseworkslip 0.1.0
- Malicious release sitecard 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious releasesitecard 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14
- Malicious release @k18k/entrypoint-sdk-darwin-arm64 0.2.0 on npm was a malicious release@k18k/entrypoint-sdk-darwin-arm64 0.2.0
- Malicious release @k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1 on npm was a malicious release@k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1
- Malicious release @k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1 on npm was a malicious release@k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1
- Malicious release orqiva-runtime-win32-x64 0.1.0 on npm was a malicious releaseorqiva-runtime-win32-x64 0.1.0
10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON