← Vulnerabilities of the weekVulnerabilities of the week: October 19–25, 2026
The week’s top vulnerabilities: what they are and how they could harm you. Open an explanation to see who is affected and what to do.
#1 · CVE-2026-96656
attacks observed · KEV: attacks observed in the wild · CVSS 8.6 · EPSS: 0.8% chance of an attack attempt in the next 30 days
What this is
Plex Media Server has a flaw that lets an administrator write files of their choice. These files may run as programs when the software starts.
How it can harm you
Someone with administrator access can exploit the flaw over a network to write arbitrary files and potentially run their own program on the server. No interaction from another person is needed.
Read the explanation →#2 · CVE-2026-106931
attacks observed · KEV: attacks observed in the wild · CVSS 8.5 · EPSS: 1.2% chance of an attack attempt in the next 30 days
What this is
SiteGuard Server Edition has a flaw that can let an attacker make the system running it execute their own commands with the highest privileges.
How it can harm you
An attacker with local access and limited permissions could run their own program with full administrative powers on the affected system. They could read private files, change or delete records, or stop programs. No action by another user is needed. The flaw does not explain how an attacker would first obtain local access.
Read the explanation →#3 · CVE-2026-96654
attacks observed · KEV: attacks observed in the wild · CVSS 6.9 · EPSS: 0.5% chance of an attack attempt in the next 30 days
What this is
Media Server from Plex does not correctly handle address values passed to it. This lets an attacker call functions in other plugins and choose the values passed to those functions.
How it can harm you
An attacker can reach the flaw over a network without signing in or requiring anyone to interact. They can invoke other plugins' functions with their chosen values, potentially reading or changing some information. The specific information and functions at risk are unknown.
Read the explanation →#4 · CVE-2026-96652
attacks observed · KEV: attacks observed in the wild · CVSS 5.3 · EPSS: 0.5% chance of an attack attempt in the next 30 days
What this is
Plex Media Server can be tricked into sending a request to a destination chosen by an attacker.
How it can harm you
An attacker who can reach the program over the network and supply any token value can make your server send a request to a destination they choose. What information this could expose is not specified.
Read the explanation →#5 · CVE-2026-96655
attacks observed · KEV: attacks observed in the wild · CVSS 5.3 · EPSS: 0.5% chance of an attack attempt in the next 30 days
What this is
Plex Media Server lets a signed-in user make the program send requests to internal or external addresses of their choice.
How it can harm you
Someone who can sign in and reach the program over a network could make it contact internal or external addresses. This could expose some information, but exactly what could be revealed is unknown.
Read the explanation →#6 · CVE-2021-48014
attacks observed · CVSS 9.3 · EPSS: 1.7% chance of an attack attempt in the next 30 days
What this is
FineReport does not properly limit where it saves files. An attacker can make it write files outside the intended location.
How it can harm you
An attacker who can reach FineReport over a network can write arbitrary files without signing in. They can use this to run their own program on the server.
Read the explanation →#7 · CVE-2026-109618
attacks observed · public exploit available · public exploit on GitHub · Nuclei template · CVSS 9.2 · EPSS: 11.6% chance of an attack attempt in the next 30 days
What this is
PHP can mishandle memory after running out of space to store data while processing a request. When cleaning up afterward, it may use memory that has not been properly prepared.
How it can harm you
An attacker can run their own program on the server through a network connection, without signing in or requiring anyone to interact. The attack is technically difficult and requires additional conditions that are not specified.
Read the explanation →#8 · CVE-2026-109619
attacks observed · public exploit on GitHub · Nuclei template · CVSS 9.2 · EPSS: 6.0% chance of an attack attempt in the next 30 days
What this is
PHP can keep using memory after it has been released. Later requests can use this stale information and allow an attacker to run their own program on the server.
How it can harm you
An attacker can run their own program on the server over a network without signing in or requiring anyone to interact. Exploitation is complex and requires particular conditions; the exact conditions are not specified.
Read the explanation →
Check your server for free →