IT security 2026-10-20

Level Critical — 78/100 — 2026-10-20

Critical day: 30 stories ranked, 6 of the top 10 reported as actively exploited, 6 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (64/100).

1. EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability — 64/100 (CVE-2026-106931)
2. Plex Media Server External Control of File Name or Path Vulnerability — 64/100 (CVE-2026-96656)
3. Siemens Software Center Uncontrolled Search Path Element Vulnerability — 62/100 (CVE-2026-110936)
4. Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability — 60/100 (CVE-2026-96654)
5. Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — 60/100 (CVE-2026-96652)
6. Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — 60/100 (CVE-2026-96655)
7. CVE-2026-101809 — Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). — 39/100 (CVE-2026-101809)
8. CVE-2026-81212 — IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into… — 39/100 (CVE-2026-81212)
9. CVE-2026-87337 — Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Eng… — 39/100 (CVE-2026-87337)
10. CVE-2026-91216 — Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). — 39/100 (CVE-2026-91216)