Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is.

Below: every entry added between 19 October and 25 October 2026 , copied from the catalogue and linked to its NVD record, plus what Romania's national cyber security directorate and Have I Been Pwned published in the same days. Nothing is estimated or rewritten.

The 8 actively exploited vulnerabilities added this week

Added Product CVE Known ransomware use

23 Oct Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 not known

23 Oct Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVE-2026-110447 not known

20 Oct Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-96656 not known

20 Oct Plex Media…