Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-22

CVE-2026-112331 Motor.NET: top risk today, fix steps

Most urgent: CVE-2026-112331: Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produ
High severity (CVSS 7.5), remotely exploitable, no login needed. Recommended action: apply the vendor mitigation.

On 22 October 2026, 11 new CVEs were published that we track: 0 critical, 0 already exploited in the wild (CISA KEV) and 5 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Patch these first

CVE-2026-112331: Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produ

High severity (CVSS 7.5), priority 44/100 (patch this month). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-112330: Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publi

High severity (CVSS 7.5), priority 44/100 (patch this month). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115417: Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0

High severity (CVSS 7.5), priority 43/100 (patch this month). Signals: high severity; remotely exploitable, no login, no user action; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115419: The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK f

High severity (CVSS 8.1), priority 40/100 (patch this month). Signals: high severity; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-112332: Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that a

High severity (CVSS 7.5), priority 40/100 (patch this month). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115508: Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker

Medium severity (CVSS 6.5), priority 33/100 (routine). Signals: on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115505: libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that a

High severity (CVSS 7.6), priority 29/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-114583: tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-li

Medium severity (CVSS 6.9), priority 27/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 22 October 2026?

CVE-2026-112331 (Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produ) ranks highest, with a priority score of 44/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts