Five of October 2026's worst CVEs. One input box. Pick your product, type or paste your version string, and get an instant patched / vulnerable / unknown verdict from this free CVE checker — against the real published advisories, with every version table sourced below.
This cybersecurity news checker covers the flaws dominating October 2026 headlines: Nextcloud CVE-2026-110447, Langflow CVE-2026-105740, GitLab CVE-2026-97229, Cisco SEG CVE-2026-76519, and Docker Hub GhostPat. Paste your version under each heading for an instant, free verdict — no signup required.
Check the version of the "Collabora Online – Built-in CODE Server" app (richdocumentscode), not Nextcloud core. Admin > Apps, or run occ app:list | grep richdocumentscode.
Sources: fixed in richdocumentscode 26.4.303 (shipped Sep 11, 2026), advisory Oct 14, 2026. Disabling the app does NOT protect you — update or remove it. Standalone Collabora servers are not affected. Full self-test: Nextcloud CVE-2026-110447 check.
Your Langflow server version. On the host: pip show langflow | grep -i version. Docker users: your image tag (e.g. langflowai/langflow:1.8.2 → type 1.8.2).
Sources: fixed in 1.10.3+ (1.9.0 is the minimum); a second CVE record extends the flaw through 1.10.2. Disclosed Oct 5, 2026; active exploitation with 1,423+ honeypot hits. Full self-test: Langflow CVE-2026-105740 check.
Your self-managed GitLab version. On the host: gitlab-rake gitlab:env:info | grep "GitLab version".
Sources: vulnerable 19.2.0–19.2.7, 19.3.0–19.3.4, 19.4.0–19.4.1; fixed in 19.2.8 / 19.3.5 / 19.4.2 (Oct 12, 2026). Versions older than 19.2 are not listed in the advisory — upgrade to a supported release regardless. Full self-test: GitLab CVE-2026-97229 check.
Your Content Scanner Tools version. On the appliance CLI: contentscannerstatus. Note: the flaw only bites when File Reputation is enabled and assigned to a mail policy.
Sources: fixed in Content Scanner Tools 25.3.0.5525+ (no restart required), advisory Oct 14, 2026. Secure Email and Web Manager, Secure Web Appliance, and Secure Email Cloud are not affected. Full self-test: Cisco SEG CVE-2026-76519 check.
Honest answer: there is no client version for this one. GhostPat was a server-side Docker Hub flaw (open August 2024 – September 30, 2026) that let an attacker convert an account into an organization and inherit its personal access tokens — silently publishing images as you. Docker fixed it server-side in under four hours and found no evidence of exploitation across ~304,000 reviewed pushes. What you do instead:
Full self-test: Docker GhostPat check.
No. The entire check runs in JavaScript in your browser against version tables embedded in this page. No request is made, no analytics sees your input, nothing leaves your machine.
Nextcloud built-in CODE app: Admin > Apps, or occ app:list | grep richdocumentscode. Langflow: pip show langflow | grep version. GitLab: gitlab-rake gitlab:env:info | grep version. Cisco SEG: contentscannerstatus on the CLI. Docker Hub: no version exists — the GhostPat flaw was fixed server-side.
It means you are not exposed to the specific CVE this check covers. If you were vulnerable during the exploitation window, patch and hunt for compromise indicators — patching closes the hole but does not remove anything an attacker already planted.
Each table is built from the vendor's published advisory and linked on this page. Versions are compared numerically (including hotfix/build suffixes like 25.3.0.5525). Anything that doesn't parse as a version returns "unknown" rather than a guess.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.