Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-23

CVE-2026-42018 Jfrog Artifactory: exploited in the wild, how to patch

Most urgent: CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability
High severity (CVSS 7.5), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8.

On 23 October 2026, 14 new CVEs were published that we track: 1 critical, 2 already exploited in the wild (CISA KEV) and 3 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Patch these first

CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability

High severity (CVSS 7.5), priority 80/100 (patch now). Signals: high severity; epss top 4%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8 for jfrog artifactory.

References: NVD · Vendor Advisory

CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

Critical severity (CVSS 9.9), priority 71/100 (patch now). Signals: critical severity; exploited in the wild (cisa kev). Recommended action: upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 for arista velocloud orchestrator.

References: NVD · Mitigation, Vendor Advisory

CVE-2026-115812: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e

Critical severity (CVSS 9.8), priority 44/100 (patch this month). Signals: critical severity; remotely exploitable, no login, no user action; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115570: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

High severity (CVSS 7.4), priority 31/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-91093: A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might

High severity (CVSS 8.5), priority 30/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115813: Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and ea

Medium severity (CVSS 5.8), priority 30/100 (routine). Signals: remotely exploitable, no login, no user action; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115863: ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message

High severity (CVSS 7.6), priority 27/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115845: An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server

Medium severity (CVSS 6.4), priority 27/100 (routine). Signals: on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 23 October 2026?

CVE-2026-42018 (JFrog Artifactory Improper Authentication Vulnerability) ranks highest, with a priority score of 80/100. Recommended action: upgrade to 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8.

Are any of the new CVEs exploited in the wild?

Yes, 2 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts