Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-24

CVE-2026-115975 Cervantessec Cervantes: top risk today, fix steps

Most urgent: CVE-2026-115975: Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit
High severity (CVSS 7.1). Recommended action: upgrade to newer than 1.3-beta.

On 24 October 2026, 20 new CVEs were published that we track: 0 critical, 0 already exploited in the wild (CISA KEV) and 1 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-115975 in cervantes (high, CVSS 7.1, priority 25/100). Recommended action: upgrade to newer than 1.3-beta. Most affected: cervantessec (1). 1 of 20 new CVEs already have a fix or vendor patch; for the other 19, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-115975: Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit

High severity (CVSS 7.1), priority 25/100 (routine). Signals: high severity. Recommended action: upgrade to newer than 1.3-beta for cervantessec cervantes.

References: NVD · Patch · Patch

CVE-2026-108013: BigFix Platform uses Mozilla CA certificate bundle (PEM)

Medium severity (CVSS 6.8), priority 24/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115803: A flaw has been found in Scada-LTS 2.8.0

Medium severity (CVSS 4.3), priority 15/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115802: A weakness has been identified in InternScience InternAgent 1.5.0

Medium severity (CVSS 4.3), priority 15/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-97353: The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership chec

High severity (CVSS n/a), priority 0/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-97352: The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of

High severity (CVSS n/a), priority 0/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-87835: The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may s

High severity (CVSS n/a), priority 0/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-114429: The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content

High severity (CVSS n/a), priority 0/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

Most affected vendors

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 24 October 2026?

CVE-2026-115975 (Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit) ranks highest, with a priority score of 25/100. Recommended action: upgrade to newer than 1.3-beta.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts