Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-22

CVE-2024-21762 Fortinet Fortiproxy: exploited in ransomware attacks, patch now

Most urgent: CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability
Critical severity (CVSS 9.8), exploited in the wild, used in ransomware, remotely exploitable, no login needed. Recommended action: upgrade to 2.0.14, 7.0.15, 7.2.9, 7.4.3.

On 22 October 2026, 49 new CVEs were published that we track: 3 critical, 1 already exploited in the wild (CISA KEV) and 3 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Patch these first

CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability

Critical severity (CVSS 9.8), priority 99/100 (patch now). Signals: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 2.0.14, 7.0.15, 7.2.9, 7.4.3 for fortinet fortiproxy.

References: NVD · Vendor Advisory · Vendor Advisory

CVE-2026-115414: OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influenc

High severity (CVSS 7.8), priority 47/100 (patch this month). Signals: high severity; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-79852: No description provided

Critical severity (CVSS 9.8), priority 46/100 (patch this month). Signals: critical severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115377: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability

Critical severity (CVSS 9.9), priority 43/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115375: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients ab

Critical severity (CVSS 9.9), priority 43/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-113873: SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to se

High severity (CVSS 7.5), priority 38/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115372: Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to se

High severity (CVSS 8.5), priority 37/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-95709: No description provided

High severity (CVSS 7.2), priority 33/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 22 October 2026?

CVE-2024-21762 (Fortinet FortiOS Out-of-Bound Write Vulnerability) ranks highest, with a priority score of 99/100. Recommended action: upgrade to 2.0.14, 7.0.15, 7.2.9, 7.4.3.

Are any of the new CVEs exploited in the wild?

Yes, 1 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts