October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,209
Critical
3,102
High
7,090
Medium
6,615
Low
674
Severity not reported
4,728
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-41509 CROSS implementation contains reference and optimized implementations of the CRO... |
critical | 9.8 | — | Cross-crypto / cross-implementation | 2026-05-08 | 2026-10-26 |
| CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116485 danmu_api before 1.21.7 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65184 The root-privileged `wsserver` terminal-bridge daemon builds a shell command fro... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113078 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-112346 OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-102649 Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes oper... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115889 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-45321 TanStack Unspecified Vulnerability |
critical | 9.6 | Listed | TanStack / TanStack | 2026-05-12 | 2026-10-26 |
| CVE-2026-44335 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | Praison / praisonaiagents | 2026-05-08 | 2026-10-26 |
| CVE-2026-41583 ZEBRA is a Zcash node written entirely in Rust. |
critical | 9.1 | — | Zfnd / zebra-script | 2026-05-08 | 2026-10-26 |
| CVE-2026-41889 pgx is a PostgreSQL driver and toolkit for Go. |
critical | 9.8 | — | Jackc / pgx | 2026-05-08 | 2026-10-26 |
| CVE-2026-44694 n8n-MCP is an MCP server that provides AI assistants access to n8n node document... |
critical | 9.1 | — | N8n-mcp / n8n-mcp | 2026-05-08 | 2026-10-26 |
| CVE-2026-44400 MailEnable Enterprise Premium 10.55 and earlier contains an improper authorizati... |
critical | 9.8 | — | Mailenable / mailenable | 2026-05-08 | 2026-10-26 |
| CVE-2026-35157 Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to... |
critical | 9.8 | — | Dell / elastic cloud storage | 2026-05-11 | 2026-10-26 |
| CVE-2026-42608 Grav is a file-based Web platform. |
critical | 9.1 | — | Getgrav / grav | 2026-05-11 | 2026-10-26 |
| CVE-2026-44643 Angular Expressions provides expressions for the Angular.JS web framework as a s... |
critical | 10.0 | — | Peerigon / angular-expressions | 2026-05-11 | 2026-10-26 |
| CVE-2026-42858 Open edX Platform enables the authoring and delivery of online learning at any s... |
critical | 9.9 | — | Openedx / openedx | 2026-05-11 | 2026-10-26 |
| CVE-2026-43639 Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili... |
critical | 9.1 | — | Bitwarden / server | 2026-05-11 | 2026-10-26 |
| CVE-2026-43995 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-05-11 | 2026-10-26 |
| CVE-2026-43914 Vaultwarden is a Bitwarden-compatible server written in Rust. |
critical | 9.8 | — | Dani-garcia / vaultwarden | 2026-05-11 | 2026-10-26 |
| CVE-2026-27851 When safe filter is used with variable expansion, all following pipelines on the... |
critical | 9.1 | — | Dovecot / dovecot | 2026-05-12 | 2026-10-26 |
| CVE-2026-33821 Improper privilege management in Microsoft Dynamics 365 Customer Insights allows... |
critical | 9.9 | — | Microsoft / dynamics 365 customer insights | 2026-05-12 | 2026-10-26 |
| CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability |
critical | 10.0 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
| CVE-2026-105723 Untrusted pointer dereference in Windows Distributed File System (DFS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unau... |
critical | 9.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116232 A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116235 A flaw has been found in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110635 webp-converter before 3.0.0 contains an OS command injection vulnerability in sr... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110640 Whisper-node through 1.1.1 contains an OS command injection vulnerability that a... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-109566 Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2025-2707 A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. |
critical | 9.1 | — | Iocoder / ruoyi-vue-pro | 2025-03-24 | 2026-10-26 |
| CVE-2025-2708 A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. |
critical | 9.1 | — | Iocoder / ruoyi-vue-pro | 2025-03-24 | 2026-10-26 |
| CVE-2020-37282 office-converter through 1.0.2 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-0263 A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PA... |
critical | 9.8 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-0264 A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo... |
critical | 9.8 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-42584 Netty is an asynchronous, event-driven network application framework. |
critical | 9.1 | — | Netty / netty | 2026-05-13 | 2026-10-26 |
| CVE-2026-116214 MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability... |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-59106 A security vulnerability has been identified in the WolfProt interface implement... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.