Blog · 2-hour update · 2026-10-23

CVE-2026-115812 AWS multi-model-server: critical flaw, patch first

Most urgent: CVE-2026-115812: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e
Critical severity (CVSS 9.8). Recommended action: upgrade to newer than 1.1.11.

On 23 October 2026, 20 new CVEs were published that we track: 1 critical, 0 already exploited in the wild (CISA KEV) and 3 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-115812 in multi-model-server (critical, CVSS 9.8, priority 39/100). Recommended action: upgrade to newer than 1.1.11. 4 of the 8 top items can be attacked remotely without a login. Most affected: aws (2), connman (1). 3 of 20 new CVEs already have a fix or vendor patch; for the other 17, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-115812: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e

Critical severity (CVSS 9.8), priority 39/100 (patch this month). Signals: critical severity; on your watchlist. Recommended action: upgrade to newer than 1.1.11 for aws multi-model-server.

References: NVD · Vendor Advisory

CVE-2026-106069: A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different

High severity (CVSS 7.4), priority 31/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-105483: A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenti

High severity (CVSS 7.4), priority 31/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-105482: A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re

High severity (CVSS 7.4), priority 31/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-110975: A flaw was found in Kruize Autotune

High severity (CVSS 7.4), priority 31/100 (routine). Signals: high severity; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-57845: Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers t

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-87901: Improper sanitization in the registration module allows reflected Cross-Site Scripting.

High severity (CVSS 8.3), priority 29/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-105481: A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent b

Medium severity (CVSS 6.5), priority 28/100 (routine). Signals: remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

Most affected vendors

aws: 2 new CVEs
connman: 1 new CVE

How to act on this list

Start with anything marked exploited or patch now.
Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 23 October 2026?

CVE-2026-115812 (Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e) ranks highest, with a priority score of 39/100. Recommended action: upgrade to newer than 1.1.11.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

NIST National Vulnerability Database: CVE details and affected versions
CVE Program: official CVE records
CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
FIRST EPSS: exploit probability
Distribution and vendor advisories linked under each item.

← All posts