---
title: "Security digest: October 23, 2026"
url: https://erroneo.us/security/2026-10-23/
description: "October 23, 2026 vulnerability digest: 2 CISA KEV additions (Arista, Collabora); 6 critical advisories (npm, Composer (PHP), Go…). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-23
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 23, 2026

2 known exploited (cisa kev) additions and 6 critical advisories.

## Take stock

- Do you run any of these? Arista VeloCloud Orchestrator, Collabora Collabora Online – Built-in CODE Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-26.
- npm: 2 critical advisories ( obsidian-tc ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( laravel/framework ). Check with composer audit .
- Go: 1 critical advisory ( github.com/labstack/echo/v4 , github.com/labstack/echo/v5 ). Check with govulncheck ./... .
- crates.io (Rust): 1 critical advisory ( wasmtime ). Check with cargo audit .
- PyPI: 1 critical advisory ( pillow ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-114625](https://erroneo.us/security/cve/CVE-2026-114625/index.md) Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection Vulnerability (CISA due 2026-10-26)
- [CVE-2026-110447](https://erroneo.us/security/cve/CVE-2026-110447/index.md) Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CISA due 2026-10-26)

## Critical advisories

- [CVE-2026-77363](https://erroneo.us/security/cve/CVE-2026-77363/index.md) obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback — npm obsidian-tc < 1.3.1 → 1.3.1
- [CVE-2026-114509](https://erroneo.us/security/cve/CVE-2026-114509/index.md) Laravel TokenGuard authentication bypass through non-string API credentials — Composer (PHP) laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0; Composer (PHP) laravel/framework < 12.68.0 → 12.68.0
- [GHSA-cxf3-9h37-7rr8](https://erroneo.us/security/ghsa/GHSA-cxf3-9h37-7rr8/index.md) Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls — Go github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1; Go github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1
- [CVE-2026-115889](https://erroneo.us/security/cve/CVE-2026-115889/index.md) Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation — crates.io (Rust) wasmtime < 36.0.19 → 36.0.19; crates.io (Rust) wasmtime >= 37.0.0, < 43.0.0 → 43.0.0
- [CVE-2026-77366](https://erroneo.us/security/cve/CVE-2026-77366/index.md) obsidian-tc tokens can access arbitrary configured vaults — npm obsidian-tc < 1.3.1 → 1.3.1
- [CVE-2026-112398](https://erroneo.us/security/cve/CVE-2026-112398/index.md) Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution — PyPI pillow <= 12.3.0 → 13.0.0

---
Source page: https://erroneo.us/security/2026-10-23/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt