Blog · 2-hour update · 2026-10-24

CVE-2026-116019 Getgrav Grav: top risk today, fix steps

On 24 October 2026, 18 new CVEs were published that we track: 0 critical, 0 already exploited in the wild (CISA KEV) and 14 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-116019 in grav (high, CVSS 8.8, priority 31/100). Recommended action: upgrade to 2.2.13. 1 of the 8 top items can be attacked remotely without a login. Most affected: yunaiv (2), bookstackapp (1), bottelet (1). 14 of 18 new CVEs already have a fix or vendor patch; for the other 4, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-116019: Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitr

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: upgrade to 2.2.13 for getgrav grav.

References: NVD · Vendor Advisory · Patch

CVE-2026-116009: Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permis

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: upgrade to 2.9.3 for owen2345 camaleon-cms.

References: NVD · Patch · Patch

CVE-2026-110018: The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: upgrade to newer than 2.17.0 for kodezen ablocks gutenberg blocks user dashboard builder popup builder form builder animation builder.

References: NVD

CVE-2026-116014: open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps

High severity (CVSS 8.1), priority 28/100 (routine). Signals: high severity. Recommended action: upgrade to 1.5.7 for open62541 open62541.

References: NVD · Patch · Patch

CVE-2026-114705: Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incor

Medium severity (CVSS 6.5), priority 28/100 (routine). Signals: remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116011: Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote un

High severity (CVSS 7.5), priority 26/100 (routine). Signals: high severity. Recommended action: upgrade to 1.3.4 for crowcpp crow.

References: NVD · Vendor Advisory · Patch

CVE-2026-116016: yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to

High severity (CVSS 7.1), priority 25/100 (routine). Signals: high severity. Recommended action: upgrade to newer than 2026.09 for yunaiv yudao-cloud.

References: NVD · Patch

CVE-2026-114194: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Fun

Medium severity (CVSS 6.5), priority 23/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

Most affected vendors

• yunaiv: 2 new CVEs
• bookstackapp: 1 new CVE
• bottelet: 1 new CVE
• crowcpp: 1 new CVE
• francoisjacquet: 1 new CVE
• getgrav: 1 new CVE

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 24 October 2026?

CVE-2026-116019 (Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitr) ranks highest, with a priority score of 31/100. Recommended action: upgrade to 2.2.13.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

← All posts