October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,200
Critical
3,101
High
7,090
Medium
6,614
Low
672
Severity not reported
4,723
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (125), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-22070 ColorOS Assistant has an unauthenticated start-download channel, leading to file... |
critical | 9.8 | — | Oppo / coloros assistant | 2026-04-30 | 2026-10-26 |
| CVE-2026-42799 Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow... |
critical | 9.8 | — | Asrmicro / asr1803 firmware | 2026-04-30 | 2026-10-26 |
| CVE-2026-33447 CVE-2026-33447 is a buffer overflow in a message parsing function of the
Secure... |
critical | 9.8 | — | Absolute / secure access | 2026-04-30 | 2026-10-26 |
| CVE-2026-2311 IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by... |
critical | 9.8 | — | Ibm / i | 2026-04-30 | 2026-10-26 |
| CVE-2026-42994 Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtaine... |
critical | 9.8 | — | Bitwarden / cli | 2026-05-01 | 2026-10-26 |
| CVE-2026-44603 Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN c... |
critical | 9.1 | — | Torproject / tor | 2026-05-07 | 2026-10-26 |
| CVE-2026-41586 Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framew... |
critical | 9.8 | — | Hyperledger / fabric | 2026-05-07 | 2026-10-26 |
| CVE-2026-112393 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
| CVE-2026-78846 Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP l... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-109780 Mitigation bypass in the DOM: Core & HTML component. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109772 Same-origin policy bypass in the DevTools component. |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109774 Invalid pointer, undefined behavior in the DOM: Notifications component. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-42208 BerriAI LiteLLM SQL Injection Vulnerability |
critical | 9.8 | Listed | BerriAI / LiteLLM | 2026-05-08 | 2026-10-26 |
| CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Crit... |
critical | 9.8 | Listed | WebPros / cPanel & WHM and WP2 (WordPress Squared) | 2026-04-29 | 2026-10-26 |
| CVE-2026-41873 ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('H... |
critical | 9.8 | — | Apache / pony mail | 2026-04-28 | 2026-10-26 |
| CVE-2026-26015 DocsGPT is a GPT-powered chat for documentation. |
critical | 9.8 | — | Arc53 / docsgpt | 2026-04-29 | 2026-10-26 |
| CVE-2026-7690 A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. |
critical | 9.8 | — | Wavlink / wl-wn570ha1 firmware | 2026-05-03 | 2026-10-26 |
| CVE-2026-42370 A stack overflow vulnerability exists in the WebCam Server Login functionality o... |
critical | 9.8 | — | Geovision / gv-vms firmware | 2026-05-04 | 2026-10-26 |
| CVE-2026-7372 A stack overflow vulnerability exists in the WebCam Server Login functionality o... |
critical | 9.0 | — | Geovision / gv-vms firmware | 2026-05-04 | 2026-10-26 |
| CVE-2026-5788 An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, an... |
critical | 9.8 | — | Ivanti / endpoint manager mobile | 2026-05-07 | 2026-10-26 |
| CVE-2026-7821 Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.... |
critical | 9.1 | — | Ivanti / endpoint manager mobile | 2026-05-07 | 2026-10-26 |
| CVE-2026-7413 A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides r... |
critical | 9.8 | — | Yarbo / lawn mower firmware | 2026-05-07 | 2026-10-26 |
| CVE-2026-41691 Copilot said: i18nextify is a JavaScript library that adds
i18nextify is a JavaS... |
critical | 9.1 | — | I18next / i18next-http-backend | 2026-05-07 | 2026-10-26 |
| CVE-2026-35435 Improper access control in Azure AI Foundry M365 published agents allows an unau... |
critical | 10.0 | — | Microsoft / azure ai foundry | 2026-05-07 | 2026-10-26 |
| CVE-2026-8034 A server-side request forgery (SSRF) vulnerability was identified in the GitHub... |
critical | 9.8 | — | Github / enterprise server | 2026-05-07 | 2026-10-26 |
| CVE-2026-41900 OpenLearnX is an open-source, decentralized learning and assessment platform. |
critical | 10.0 | — | Th30d4y / openlearnx | 2026-05-08 | 2026-10-26 |
| CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability |
critical | 9.8 | Listed | Palo Alto Networks / PAN-OS | 2026-05-06 | 2026-10-26 |
| CVE-2026-25293 Buffer overflow due to incorrect authorization in PLC FW |
critical | 9.8 | — | Qualcomm / qca7005 firmware | 2026-05-04 | 2026-10-26 |
| CVE-2026-26332 vm2 is an open source vm/sandbox for Node.js. |
critical | 10.0 | — | Vm2 Project / vm2 | 2026-05-04 | 2026-10-26 |
| CVE-2026-42221 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.8 | — | Nginxui / nginx ui | 2026-05-04 | 2026-10-26 |
| CVE-2026-42222 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.8 | — | Nginxui / nginx ui | 2026-05-04 | 2026-10-26 |
| CVE-2026-34000 A flaw was found in the X.Org X server. |
critical | 9.1 | — | X.org / x server | 2026-05-05 | 2026-10-26 |
| CVE-2026-34002 A flaw was found in the X.Org X server. |
critical | 9.1 | — | X.org / x server | 2026-05-05 | 2026-10-26 |
| CVE-2026-40010 Missing invocation of Servlet http web request method changeSessionId after sess... |
critical | 9.1 | — | Apache / wicket | 2026-05-06 | 2026-10-26 |
| CVE-2026-7910 Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-05-06 | 2026-10-26 |
| CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNC... |
critical | 9.1 | — | Torproject / tor | 2026-05-07 | 2026-10-26 |
| CVE-2026-42216 OpenEXR provides the specification and reference implementation of the EXR file... |
critical | 9.1 | — | Openexr / openexr | 2026-05-07 | 2026-10-26 |
| CVE-2026-42217 OpenEXR provides the specification and reference implementation of the EXR file... |
critical | 9.8 | — | Openexr / openexr | 2026-05-07 | 2026-10-26 |
| CVE-2026-41509 CROSS implementation contains reference and optimized implementations of the CRO... |
critical | 9.8 | — | Cross-crypto / cross-implementation | 2026-05-08 | 2026-10-26 |
| CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.