SvertokSearch

Security & FraudPublished:

CISA adds six exploited security flaws to its priority catalog

The six entries cover Plex Media Server, SiteGuard Server Edition and Siemens Software Center; binding deadlines apply to covered federal agencies.

A registry beam with six rust apertures and an active trace meets a broad remediation rail above separate federal and voluntary paths.

CISA added six security flaws to its Known Exploited Vulnerabilities Catalog on October 20 after finding evidence of real-world exploitation. A listing does not mean every affected system has been attacked.

The six additions

The official catalog identifies:

  • CVE-2026-96652 in Plex Media Server, a server-side request forgery flaw that can make the server send an unintended request.
  • CVE-2026-96654 in Plex Media Server, a flaw in handling encoded web addresses that can let an attacker call plugin functions with chosen parameters.
  • CVE-2026-96655 in Plex Media Server, a server-side request forgery flaw that can let an authenticated user request internal or external addresses.
  • CVE-2026-96656 in Plex Media Server, an external file-path control flaw that can let an administrator write files that may run when loaded.
  • CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition, an operating-system command injection flaw that can allow commands to run with root or SYSTEM privileges.
  • CVE-2026-110936 in Siemens Software Center, an uncontrolled search-path flaw that can let an authenticated local attacker run code with the application’s privileges.

The Plex, EG Secure Solutions and Siemens advisories are linked in Sources. CISA’s alert and catalog do not identify particular victim organizations or the scale of exploitation.

What covered federal agencies must prioritize

Binding Operational Directive 26-04 sets risk-based patching and forensic-triage requirements for Federal Civilian Executive Branch agencies. Its deadlines are federal requirements for covered agencies, not a universal deadline for every organization.

CISA separately encourages other organizations to use the catalog as a priority signal, evaluate whether affected systems are exposed, and follow the relevant vendor guidance.

Next story

Microsoft extends Project Perception to monitor and contain AI agents

An abstract agent capsule carries its own identity ring while an outer policy rail and guardian arcs control its paths.

The new design gives agents distinct identities, watches their connections and uses policy-driven Guardian Agents to respond at machine speed.

Published October 20, 2026Source: Microsoft

CISA flags an actively exploited Apple out-of-bounds write flaw

A rust-colored memory tile pushes beyond the boundary of a segmented generic device frame.

Apple says CoreGraphics flaw CVE-2026-86950 can allow code execution through a malicious file and is fixed in its Sept. 28 updates.

Published October 11, 2026Source: CISA

CISA flags an actively exploited WordPress Core flaw

A paper trail emerges through a breached digital wall beside a fitted gold repair panel.

CISA lists CVE-2026-87902 as exploited; WordPress says conditional page-template resolution can include a readable local PHP file and lead to remote code execution (RCE).