Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-23

CVE-2026-114625 VeloCloud Orchestrator (VCO) on-prem: exploited in the wild, how to patch

Most urgent: CVE-2026-114625: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to acce
Critical severity (CVSS 9.9), exploited in the wild. Recommended action: apply the vendor mitigation.

On 23 October 2026, 6 new CVEs were published that we track: 1 critical, 1 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Patch these first

CVE-2026-114625: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to acce

Critical severity (CVSS 9.9), priority 71/100 (patch now). Signals: critical severity; exploited in the wild (cisa kev). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115497: The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all version

High severity (CVSS 7.5), priority 46/100 (patch this month). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115546: Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on

High severity (CVSS 8.1), priority 42/100 (patch this month). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115547: An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially fo

Critical severity (CVSS 9.1), priority 41/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-109198: The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cros

High severity (CVSS 7.2), priority 37/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-54615: Part-DB is an open source inventory management system for electronic components

Medium severity (CVSS 6.0), priority 26/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-86020: Part-DB is an open source inventory management system for electronic components

Medium severity (CVSS 4.6), priority 17/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 23 October 2026?

CVE-2026-114625 (VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to acce) ranks highest, with a priority score of 71/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

Yes, 1 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts