PatchTheCVEBlog · 2-hour update · 2026-10-26
CVE-2026-110447 Collabora Online: exploited in the wild, how to patch
By the PatchTheCVE security team · Updated 2026-10-26 · Data from NVD, CISA KEV, EPSS and vendor advisories
Critical severity (CVSS 9.8), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 26.4.303.
On 26 October 2026, 86 new CVEs were published that we track: 3 critical, 1 already exploited in the wild (CISA KEV) and 8 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-110447 (Collabora Online): upgrade to 26.4.303.
- 1 exploited in the wild (CISA KEV): patch these before anything else.
- 6 of the top 8 can be attacked over the network without a login.
- 8 of 86 new CVEs already have a fix or vendor patch.
- Most affected vendors: bplugins, villatheme, bdtask.
What happened in this 2-hour window: the most serious item is CVE-2026-110447 in online (critical, CVSS 9.8, priority 94/100). Recommended action: upgrade to 26.4.303. 1 new CVE from the list below is already being exploited (CVE-2026-110447), so those go first. 6 of the 8 top items can be attacked remotely without a login. Most affected: bplugins (3), villatheme (2), bdtask (1). 8 of 86 new CVEs already have a fix or vendor patch; for the other 78, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
- Risk: Critical (CVSS 9.8), priority 94/100 (patch now)
- Exploitation: exploited in the wild (CISA KEV); attackable over the network without a login
- Affected: collabora online
- What to do: upgrade to 26.4.303 for collabora online
Why it ranks here: critical severity; epss top 4%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Vendor Advisory
CVE-2026-115905: zip is a zip library for Rust that supports reading and writing simple ZIP files
- Risk: Critical (CVSS 10.0), priority 40/100 (patch this month)
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-102649: Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator
- Risk: Critical (CVSS 9.9), priority 40/100 (patch this month)
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; on your watchlist.
References: NVD
CVE-2026-112346: OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability whe
- Risk: Critical (CVSS 9.8), priority 39/100 (patch this month)
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-115748: **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XM
- Risk: High (CVSS 8.8), priority 36/100 (routine)
- What to do: apply the vendor mitigation
Why it ranks here: high severity; on your watchlist.
References: NVD
CVE-2026-115721: **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to
- Risk: High (CVSS 7.5), priority 36/100 (routine)
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action; on your watchlist.
References: NVD
CVE-2026-116540: netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerabil
- Risk: Medium (CVSS 5.9), priority 31/100 (routine)
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: remotely exploitable, no login, no user action; on your watchlist.
References: NVD
CVE-2026-115909: zip is a zip library for Rust that supports reading and writing simple ZIP files
- Risk: High (CVSS 7.5), priority 31/100 (routine)
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
Most affected vendors
- bplugins: 3 new CVEs
- villatheme: 2 new CVEs
- bdtask: 1 new CVE
- hashicorp: 1 new CVE
- omega solution: 1 new CVE
- wolfvision: 1 new CVE
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 26 October 2026?
CVE-2026-110447 (Collabora Online – Built-in CODE Server OS Command Injection Vulnerability) ranks highest, with a priority score of 94/100. Recommended action: upgrade to 26.4.303.
Are any of the new CVEs exploited in the wild?
Yes, 1 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.