Blog · 2-hour update · 2026-10-25

CVE-2026-116067 GetFile, GetSheet, DeleteBackups: top risk today, fix steps

On 25 October 2026, 41 new CVEs were published that we track: 0 critical, 0 already exploited in the wild (CISA KEV) and 29 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-116067 (high, CVSS 8.2, priority 34/100). Recommended action: apply the vendor mitigation. 4 of the 8 top items can be attacked remotely without a login. Most affected: imagemagick (21), parse-community (5), siyuan-note (2). 29 of 41 new CVEs already have a fix or vendor patch; for the other 12, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-116067: Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and Delete

High severity (CVSS 8.2), priority 34/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116070: Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js th

Medium severity (CVSS 6.5), priority 33/100 (routine). Signals: remotely exploitable, no login, no user action; on your watchlist. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116165: Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: upgrade to 8.6.101, 9.10.4-alpha.4 for parse-community parse-server.

References: NVD · Vendor Advisory

CVE-2026-116068: Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any org

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116066: Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF

Medium severity (CVSS 6.8), priority 29/100 (routine). Signals: remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116149: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of

High severity (CVSS 8.1), priority 28/100 (routine). Signals: high severity. Recommended action: upgrade to 6.9.13-58, 7.1.2-33 for imagemagick imagemagick.

References: NVD · Vendor Advisory

CVE-2026-116069: NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote

Medium severity (CVSS 6.5), priority 28/100 (routine). Signals: remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116163: Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the vali

High severity (CVSS 7.4), priority 26/100 (routine). Signals: high severity. Recommended action: upgrade to 8.6.102, 9.10.5-alpha.2 for parse-community parse-server.

References: NVD · Vendor Advisory

Most affected vendors

• imagemagick: 21 new CVEs
• parse-community: 5 new CVEs
• siyuan-note: 2 new CVEs
• dbcli: 1 new CVE
• wwbn: 1 new CVE

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 25 October 2026?

CVE-2026-116067 (Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and Delete) ranks highest, with a priority score of 34/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

← All posts