Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-23

CVE-2026-18577 n-able n-central: exploited in the wild, how to patch

Most urgent: CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
High severity (CVSS 8.1), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 2026.3.

On 23 October 2026, 14 new CVEs were published that we track: 3 critical, 2 already exploited in the wild (CISA KEV) and 1 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Patch these first

CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

High severity (CVSS 8.1), priority 86/100 (patch now). Signals: high severity; epss top 3%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 2026.3 for n-able n-central.

References: NVD · Patch, Release Notes · Vendor Advisory

CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

High severity (CVSS 7.4), priority 83/100 (patch now). Signals: high severity; epss top 5%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to newer than 2026.1 for n-able n-central.

References: NVD · Vendor Advisory · Vendor Advisory

CVE-2026-115893: Wasmtime is a runtime for WebAssembly

Critical severity (CVSS 9.9), priority 35/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115889: Wasmtime is a runtime for WebAssembly

Critical severity (CVSS 9.9), priority 35/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115931: Postiz lets a signed-in user ask the backend to run a function on one of their connected channels

Critical severity (CVSS 9.9), priority 35/100 (patch this month). Signals: critical severity. Recommended action: upgrade to 2.25.2 for gitroomhq postiz-app.

References: NVD · Patch · Vendor Advisory

CVE-2026-115938: Craft CMS allows any authenticated control panel user to submit an element-search condition whose element sele

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115937: The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that th

High severity (CVSS 7.5), priority 31/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115935: The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated con

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

Most affected vendors

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 23 October 2026?

CVE-2026-18577 (N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability) ranks highest, with a priority score of 86/100. Recommended action: upgrade to 2026.3.

Are any of the new CVEs exploited in the wild?

Yes, 2 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts