CVE Threat Map: Critical CVEs Exploited Now — Cybersecurity News
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
This cybersecurity news map tracks the critical CVEs attackers are actively exploiting in October 2026. Each entry explains the flaw in plain language, who it hits, and what to patch first.
What is the cybersecurity news CVE threat map?
It tracks five critical self-host CVEs under active exploitation, including CVE-2026-110447 (Nextcloud Collabora) and CVE-2026-105740 (Langflow MCP). Each card gives the attack scenario, affected software versions, and the patch or workaround — updated as the threat landscape changes through 2026.
Five critical vulnerabilities attackers are using against self-hosted servers right now. Plain English, no jargon — and a free CVE checker for each one.
Last updated: October 15, 2026. Sources: CISA KEV catalog, NVD, vendor advisories.
CRITICAL · CVSS 10.0
CVE-2026-21962 — Oracle WebLogic Proxy Plug-in
What it is: A flaw in the WebLogic Server proxy plug-in that lets attackers run their own code on the server — the worst kind of vulnerability, and it is on CISA's exploited-in-the-wild list.
What it is: Add-ons configured with host network mode expose unauthenticated endpoints to your local network — any device on the same Wi-Fi can reach them without logging in.
Fix: Update Supervisor to 2026.03.2; review which add-ons use host network mode and whether they need to.
What it is: Command injection in proxy.php of Nextcloud's built-in Collabora CODE Server app. Attackers planted PHP web shells with web-server permissions in September and October 2026 — and disabling the app does not fix it.
Fix: Update richdocumentscode to 26.4.303 or newer, or remove the app entirely.
What it is: Authenticated remote code execution — any Langflow user, even low-privilege, can add a malicious MCP server and get full command execution on the host.
Fix: Upgrade to 1.10.3 or newer (1.9.0 minimum); audit every configured MCP server for commands you did not authorize.
Bloggers, forum mods, and Discord admins: paste this one line into any HTML page. It embeds this live threat map as a frame — no JavaScript supply-chain risk, no cookies, no fingerprinting of your visitors. Just keep the "Powered by Ingenious AI" line under it.
Privacy promise: the embed sets no cookies, runs no trackers, and collects no visitor data. Your readers stay yours.
Honest scope: this map tracks the self-host CVEs getting real-world exploitation attention. It is a triage aid, not a pentest — patch everything, and verify with a real scan.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
How do I check if my software has a CVE?
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
How do I know if I am affected by a CVE?
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.