7 newly exploited flaws this week, 3 of them zero-days (attacked before or as the fix came out). Here's what to patch first.
Patch these first
- Arista VeloCloud Orchestrator (zero-day, internet-facing)
Arista VeloCloud Orchestrator SQL Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - EG Secure Solutions SiteGuard Server Edition (zero-day)
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - Siemens Software Center (zero-day)
Siemens Software Center Uncontrolled Search Path Element Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - Collabora Online – Built-in CODE Server (12% chance of attack in 30 days)
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - Plex Media Server
Plex Media Server External Control of File Name or Path Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Also new this week
- Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
CISA deadlines this week
- Oct 26, 2026: Arista VeloCloud Orchestrator
- Oct 26, 2026: Collabora Online – Built-in CODE Server
- Oct 29, 2026: PHP
- Oct 31, 2026: Linux Kernel
Only care about the tech you run? Pick your products on patchsonar.com to filter the list, print a one-page brief, or get alerts in Slack, Teams or Discord.
Forward this to whoever handles your updates. Got it from a friend? Subscribe free.
General information only, not professional advice. Confirm version numbers with the vendor before you update.