CISA added CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server used within Nextcloud, to its Known Exploited Vulnerabilities catalog on October 23. It allows remote code execution; federal agencies must mitigate by October 26 under BOD 26-04.
Attackers are actively exploiting the issue.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CISA added CVE-2026-114625, an actively exploited SQL injection flaw in Arista VeloCloud Orchestrator on-prem, to its Known Exploited Vulnerabilities catalog. Organizations must apply mitigations by October 26 to meet BOD 26-04 requirements.
Oracle has patched CVE-2026-91241, a flaw in Oracle Business Intelligence Enterprise Edition that it rates 9.1 Critical under CVSS 3.1, in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The fix shipped in Oracle's October 2026 Critical Patch Update, and Oracle urges customers to apply it promptly.
Capcom says about 11.77 million CAPCOM ID records were exposed, each with an email address and login metadata. 43 also exposed birth date, gender, country and nickname, and 196 accounts had passwords changed without authorization and reset. Capcom says it has not confirmed any compromise of customer-set passwords, and credit card information was not included.
Cisco published three hardening advisories covering 20 CVEs in its voice and collaboration software, Expressway Series and Snort 3. Cisco as the CNA scores two Unified CM-family CVEs at 9.8 and a Snort 3 CVE at 9.0, and says none is known to be exploited.
Oracle's October 2026 Critical Patch Update includes 38 new security patches for Oracle Essbase 21.8.3.0.0. Oracle as the CNA scores four of the flaws 9.9 under CVSS 3.1 and one at 9.8.
