Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026102903105454 | Publication Time | 2026-10-29 15:13:55 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-29 15:13:55 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】CISA Adds 10 Known Exploited Vulnerabilities to the KEV Catalog (2026/10/19-2026/10/25) |
|||
| [Content] Forwarded from TWCERTCC-200-202610-00000039 【CVE-2026-106931】EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVSS v3.1: 7.8) 【Ransomware Exploitation: Unknown】 EG Secure Solutions SiteGuard Server Edition has an OS Command Injection vulnerability. An attacker may exploit this vulnerability to execute arbitrary operating system commands with root or SYSTEM privileges on a system running the affected product. 【CVE-2026-96656】Plex Media Server External Control of File Name or Path Vulnerability (CVSS v3.1: 7.2) 【Ransomware Exploitation: Unknown】 Plex Media Server has an External Control of File Name or Path vulnerability that may allow an administrator user to write arbitrary files, which could be executed when loaded. 【CVE-2026-96655】Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVSS v3.1: 4.3) 【Ransomware Exploitation: Unknown】 Plex Media Server has a Server-Side Request Forgery vulnerability that may allow an authenticated user to send requests to arbitrary internal or external addresses through specific path parameters. 【CVE-2026-96654】Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVSS v3.1: 6.5) 【Ransomware Exploitation: Unknown】 Plex Media Server has an Improper Neutralization of Encoded URI Schemes in a Web Page vulnerability. An attacker may exploit this vulnerability to invoke functions of other plugins and pass custom parameters. 【CVE-2026-96652】Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVSS v3.1: 4.3) 【Ransomware Exploitation: Unknown】 Plex Media Server has a Server-Side Request Forgery vulnerability. An attacker can use an arbitrary X-Plex-Token value and include a complete URL in the protocol parameter, thereby forcing the Plex server to send a POST request to a destination specified by the attacker. 【CVE-2026-110936】Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVSS v3.1: 6.7) 【Ransomware Exploitation: Unknown】 Siemens Software Center has an Uncontrolled Search Path Element vulnerability that may allow an authenticated local attacker to place a specially crafted DLL file in a directory searched by the application, thereby executing arbitrary code with the privileges of the affected application. 【CVE-2026-114625】Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVSS v3.1: 9.9) 【Ransomware Exploitation: Unknown】 The on-premises version of Arista VeloCloud Orchestrator has an SQL Injection vulnerability that may allow a remote attacker to access privileged internal functions and affect the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the Orchestrator itself and the data it manages. 【CVE-2026-110447】Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVSS v3.1: 9.8) 【Ransomware Exploitation: Unknown】 Collabora Online – Built-in CODE Server has an OS Command Injection vulnerability when used on the Nextcloud platform. This vulnerability may lead to remote code execution when the CODE server is not running. 【CVE-2026-109618】PHP Memory Corruption Vulnerability (CVSS v3.1: 9.8) 【Ransomware Exploitation: Unknown】 PHP has a Memory Corruption vulnerability that may lead to unauthenticated remote code execution. 【CVE-2026-109619】PHP Stale Internal Request-State Vulnerability (CVSS v3.1: 8.1) 【Ransomware Exploitation: Unknown】 PHP has a Stale Internal Request-State vulnerability that may lead to unauthenticated remote code execution. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] 【CVE-2026-106931】Please refer to the affected versions listed by the vendor: https://www.eg-secure.co.jp/siteguard/news/alert-202610-1 【CVE-2026-96656】Please refer to the affected versions listed by the vendor: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-96655】Please refer to the affected versions listed by the vendor: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-96654】Please refer to the affected versions listed by the vendor: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-96652】Please refer to the affected versions listed by the vendor: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-110936】Please refer to the affected versions listed by the vendor: https://cert-portal.siemens.com/productcert/html/ssa-580366.html 【CVE-2026-114625】Please refer to the affected versions listed by the vendor: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 【CVE-2026-110447】Please refer to the affected versions listed by the vendor: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 【CVE-2026-109618】Please refer to the affected versions listed by the vendor: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w 【CVE-2026-109619】Please refer to the affected versions listed by the vendor: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp |
|||
| [Recommended Actions] 【CVE-2026-106931】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://www.eg-secure.co.jp/siteguard/news/alert-202610-1 【CVE-2026-96656】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-96655】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-96654】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-96652】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://forums.plex.tv/t/plex-media-server/30447/711 【CVE-2026-110936】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://cert-portal.siemens.com/productcert/html/ssa-580366.html 【CVE-2026-114625】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 【CVE-2026-110447】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 【CVE-2026-109618】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w 【CVE-2026-109619】 The vendor has released a security update to address this vulnerability. Please update to the relevant version: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp |
|||
|
[Reference]
|
|||