Daily briefing · October 22, 2026
Ten CVEs seen exploited before CISA confirmation, led by a critical VeloCloud Orchestrator flaw
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention10 seen before CISA
Verdict for the day: ATTENTION. None of the 10 featured vulnerabilities has reached weaponized-exploit status, but all 10 show exploitation observed by VulnCheck ahead of any CISA confirmation, an early warning that attackers are already using these flaws. The list is led by CVE-2026-114625 in VeloCloud Orchestrator (CVSS 9.4), followed by critical remote code execution bugs in DedeCMS and FineReport and a series of unauthenticated SQL injection and path traversal flaws.
Today’s brief
- All 10 featured CVEs were observed exploited by VulnCheck before CISA; none has a weaponized exploit yet.
- CVE-2026-114625 (VeloCloud Orchestrator, CVSS 9.4) lets any authenticated user gain operator privileges and affect the VCO host.
- DedeCMS (CVE-2021-48016) and FineReport (CVE-2021-48014) allow unauthenticated remote code execution (CVSS 9.3).
- Most of the rest are unauthenticated SQL injection or path traversal flaws in web applications and CMSs.
Critical highlights
1
Critical (CVSS 9.4) flaw in the on-prem VeloCloud Orchestrator: an authenticated user can escalate to operator privileges and affect the VCO host, compromising the confidentiality, integrity and availability of the orchestrator and its data. Exploitation was seen by VulnCheck before CISA, so network management infrastructure deserves priority.
2
PHP code injection in DedeCMS via the Referer header lets unauthenticated attackers run PHP code and system commands remotely (CVSS 9.3). A proof of concept exists and the Shadowserver Foundation has recorded exploitation evidence.
3
Path traversal in FineReport 9.0 allows unauthenticated attackers to write arbitrary files, including a JSP webshell, leading to remote code execution (CVSS 9.3). A proof of concept is available and exploitation evidence has been observed.
4
Unauthenticated SQL injection in Weaver E-cology (8.0, 9.0 and 10.0 before 10.76) allows extraction of database information. A proof of concept exists and exploitation was observed ahead of CISA.
5
CVE-2024-58393◆ VulnCheckHIGH 8.8PoCaffects Readymade Unilevel Ecommerce MLM Unauthenticated SQL injection in the 'id' parameter of Readymade Unilevel Ecommerce MLM exposes database contents. A proof of concept is available and exploitation has been observed in the wild.
6
Unauthenticated SQL injection in PHPOK (4.5.000 before 5.4.081) via the sort parameter allows data extraction through error messages. Exploitation evidence dates back to 2023, so any unpatched instance is a likely target.
7
Unauthenticated path traversal in YiShaAdmin (2.2 to 3.1) allows reading and deleting arbitrary files on the system. A proof of concept exists, and the delete capability raises the risk of damage as well as data leakage.
8
Unauthenticated SQL injection in the NotificationX WordPress plugin (2.0.0 before 2.3.12) via the REST API. WordPress sites running vulnerable versions face the risk of database exposure.
9
Unauthenticated SQL injection in SeaCMS (through 8.7) via the rlist[] parameter allows database extraction through error messages. A proof of concept is available and exploitation was observed ahead of CISA.
10
CVE-2024-58396◆ VulnCheckHIGH 8.7PoCaffects CPAS Audit Management System Unauthenticated path traversal in CPAS Audit Management System V4 allows reading arbitrary system files via the fileId parameter. A proof of concept exists and exploitation evidence was recorded by the Shadowserver Foundation, a concern for an audit platform that holds sensitive data.
Ransomware today
The most recently identified victim is GTL Concreto e Logística LTDA, a Brazilian manufacturing company claimed by the emperador group. Over the last 30 days the most active groups are N0n (6 victims), emperador (5) and thegentlemen (5), followed by lockbit5 and incransom (3 each) and akira (2), all with activity concentrated in Brazil.
GTL Concreto e Logística LTDA BRemperador · Manufacturing
N0n 6emperador 5thegentlemen 5lockbit5 3incransom 3akira 2
Active groups & APTs
Groups listed as active or recently updated include Elderwood (China), Lazarus Group (North Korea), APT29 (Russia), WIRTE, TA577 and vicesociety. No known victims are tied to any of them in the data provided, so this is a monitoring signal rather than a confirmed campaign.
Brazil focus
Recent Brazilian victims span several sectors: Hospital Sírio-Libanês and CLIMEDI (healthcare), Universidade de Passo Fundo (education), Pantanal Agricola (agriculture), Prafesta and MPI LTDA (manufacturing and other) and Suhai Segurança Pessoal (professional services). The groups thegentlemen, emperador, N0n and THE SEVEN DEADLY SINS are behind these cases, with thegentlemen appearing in four of the eight listed.
GTL Concreto e Logística LTDAemperador · Manufacturing
Suhai Segurana Pessoalthegentlemen · Professional Services
CLIMEDIthegentlemen · Healthcare
Hospital Sírio-LibanêsTHE SEVEN DEADLY SINS · Healthcare
Prafesta Ind. e Com. de Embalagens LtdaN0n · Manufacturing
Universidade de Passo Fundothegentlemen · Education
Pantanal Agricolathegentlemen · Agriculture and Food Production
MPI LTDAemperador · Other
Today’s recommendation: Prioritize patching or isolating the VeloCloud Orchestrator and any exposed instances of DedeCMS, FineReport, E-cology, SeaCMS and the other affected web applications, and review logs for signs of past exploitation, since activity was observed before the official alert. Where a patch is unavailable, restrict internet access to these services and place them behind a WAF.
With exploitation already under way before official confirmation, the practical question is whether any of these exposures exist in your own environment, and the only way to know is to test your attack surface regularly.Before an attacker finds it, find it first: run a free initial exposure assessment and see whether your infrastructure is vulnerable to flaws like these.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →