CVE-2026-114625

Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild VeloCloud Orchestrator vulnerability CVE-2026-114625 SQL injection exploited in the wild

Do Son October 22, 2026

TL;DR Arista says attackers are actively exploiting CVE-2026-114625, a critical VeloCloud Orchestrator vulnerability rated CVSS 9.9. The...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

CVE-2026-114625CVSS 9.9
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intel📅 Updated: Oct 22, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2026-109619CVSS 9.2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not...
Admin intel📅 Updated: Oct 22, 2026
CVE-2026-109618CVSS 9.2
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request....
Admin intel📅 Updated: Oct 22, 2026
CVE-2014-125131CVSS 5.1
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2015-20124CVSS 8.7
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers...
Watchtower Verified📅 Updated: Oct 22, 2026

CVE-2026-93909CVSS 9.1
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0...
📅 Updated: Oct 22, 2026
CVE-2026-93895CVSS 9.1
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access...
📅 Updated: Oct 22, 2026
CVE-2026-55200CVSS 9.2
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper...
📅 Updated: Oct 22, 2026
CVE-2026-114611CVSS 9.1
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to...
📅 Updated: Oct 22, 2026
CVE-2026-101420CVSS 9.6
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are...
📅 Updated: Oct 22, 2026
CVE-2026-63830CVSS 9.4
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The...
📅 Updated: Oct 22, 2026
CVE-2026-114612CVSS 9.9
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0...
📅 Updated: Oct 22, 2026
CVE-2026-114607CVSS 9.1
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic...
📅 Updated: Oct 22, 2026