Watch FloorOct 19, 8:00 PM to Oct 20, 8:00 PM ET
Daily brief, Tuesday, October 20, 2026
6 newly exploited, 61 new critical CVEs, 24 ransomware posts, 1 new breaches.
Breaking
Nothing spreading fast in technology large companies run.
Newly exploited in the wild
- 7.8CVE-2026-106931 EG Secure Solutions SiteGuard Server EditionCISA KEVAn attacker can execute arbitrary OS commands with root or SYSTEM privileges on EG Secure Solutions SiteGuard Server Edition.
- 7.2CVE-2026-96656 Plex Media ServerCISA KEVAn admin user can write arbitrary files that may be executed on load on Plex Media Server.
- 6.7CVE-2026-110936 Siemens Software CenterCISA KEVSiemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the priv
- 6.5CVE-2026-96654 Plex Media ServerCISA KEVDetectionAn attacker can call other plugins' functions and supply their own parameters on Plex Media Server.
- 4.3CVE-2026-96652 Plex Media ServerCISA KEVDetectionAn attacker with any X-Plex-Token value can force Plex Media Server to POST to an attacker's chosen destination.
- 4.3CVE-2026-96655 Plex Media ServerCISA KEVDetectionAn authenticated attacker can request arbitrary internal or external addresses via Plex Media Server.
New public exploit code
No new Nuclei templates, Metasploit modules, Exploit-DB or VulnCheck XDB entries.
New critical CVEs
- 10.0CVE-2026-91221 Oracle Oracle SOA Suite+1 more CVEs in the same releaseAn attacker with network access can bypass authentication and compromise Oracle SOA Suite.
- 9.8CVE-2026-91323 Oracle Oracle WebLogic Server+1 more CVEs in the same releaseAn attacker with HTTP access can bypass authentication and access Oracle WebLogic Server.
- 9.6CVE-2026-113252 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome on Windows.
- 9.8CVE-2026-101767 Oracle Oracle Application Object LibraryAn attacker with network access can bypass authentication and access Oracle Application Object Library.
- 9.6CVE-2026-113072 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 10.0CVE-2026-101809 Oracle WorkflowAn attacker can bypass authentication and access Workflow.
- 9.9CVE-2026-91250 Oracle Oracle SOA Suite+1 more CVEs in the same releaseA low-privileged attacker with network access via multiple protocols can escalate privileges on Oracle SOA Suite.
- 10.0CVE-2026-87337 Oracle Oracle Access ManagerAn unauthenticated attacker with network access via HTTP can disclose sensitive information on Oracle Access Manager.
- 9.6CVE-2026-113078 Google chromeA remote attacker can execute arbitrary code outside the sandbox in Google Chrome.
- 10.0CVE-2026-91299 Oracle JD Edwards EnterpriseOne OrchestratorAn attacker can bypass authentication and access JD Edwards EnterpriseOne Orchestrator.
- 9.9CVE-2026-91638 Oracle Oracle Essbase+5 more CVEs in the same releaseAn attacker with network access via HTTP can bypass authentication and compromise Oracle Essbase.
- 9.8CVE-2026-91490 Oracle identity manager connector+1 more CVEs in the same releaseAn unauthenticated attacker with network access via LDAP can compromise Oracle Identity Manager Connector.
- 9.6CVE-2026-87347 Oracle Oracle HTTP ServerAn attacker can obtain sensitive information from Oracle HTTP Server.
- 9.6CVE-2026-101420 Oracle PeopleSoft Enterprise PeopleToolsA low-privileged attacker can bypass authentication and access PeopleSoft Enterprise PeopleTools.
- 9.6CVE-2026-91243 Oracle Oracle Business Process Management SuiteAn attacker can bypass authentication in Oracle Business Process Management Suite.
- 9.1CVE-2026-91241 Oracle Oracle Business Intelligence Enterprise EditionAn attacker with network access can bypass authentication in Oracle Business Intelligence Enterprise Edition.
- 9.9CVE-2026-91354 Oracle Oracle Outside In TechnologyA low-privileged attacker with network access via HTTP can bypass access control on Oracle Outside In Technology.
- 9.1CVE-2026-91656 Oracle essbaseAn attacker with network access via HTTP can compromise Oracle Essbase.
- 9.1CVE-2026-87866 Curl curlAn attacker can trick curl into accepting a TLS connection from a peer with a manipulated certificate.
- 9.1CVE-2026-86411 Curl curlAn `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new
32 more critical CVEs in this window: see them on the dashboard.
Ransomware
24 victims posted to leak sites. Most active: Booba Project (6), N0n (5), SilentRansomGroup (3), payload (2), Mimori (2).
New data breaches
- Assurance Retraite lassuranceretraite.fr70,372 accounts
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Breaking stories as RSS or JSON. watchfloor.fyi
Powered by MikeGPT