October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,172
Critical
1,207
High
5,396
Medium
5,729
Low
600
Severity not reported
3,240
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42922 A authorization bypass vulnerability exists in the /nodered functionality of FUX... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109516 The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authen... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-61564 AVideo is a video-sharing Platform. |
critical | 10.0 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-61567 AVideo is a video-sharing Platform. |
critical | 10.0 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118690 Signal K Server before 2.33.0 contains a missing authentication vulnerability th... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-63190 FearlessCMS is a flat-file `content` management system centered on simplicity an... |
critical | 9.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117574 A flaw was found in ai-gateway-payload-processing. |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103409 A Missing authentication for critical function vulnerability in Juniper Networks... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103406 An Improper Neutralization of Special Elements used in an OS Command vulnerabili... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-44179 XWiki Remote Macros provides XWiki rendering macros that are useful when migrati... |
critical | 9.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115968 Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Memb... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67074 HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115904 Topluyo is a social networking platform. |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111411 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115607 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118477 The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFa... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114278 The che-machine-exec service constructs a shell command by concatenating user-co... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103780 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103792 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103799 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86400 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-90717 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86397 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109218 The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103688 The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-84999 The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-106013 The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass v... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110879 jackson-databind validates the outer class of a class-name type ID but accepts a... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-58256 GRR is a resource management and reservation application. |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118355 Improper input validation in Command in Google Chrome prior to 156.0.8078.73 all... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118342 Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118340 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118332 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118316 Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118321 Improper input validation in Core in Google Chrome on on Android prior to 156.0.... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118306 Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118308 Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote a... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118309 Improper input validation in UI in Google Chrome on on Android prior to 156.0.80... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.