October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,598
Critical
3,298
High
7,980
Medium
7,645
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90869 A remote attacker who knows a valid account's enrolled SSH public key can termin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-59979 YosemiteCrew provides organization-based service and task management. |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61542 Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118682 KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by defau... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118689 OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in Ovt... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118692 CherryTree through 1.7.2 contains an OS command injection vulnerability in CtAct... |
high | 7.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-85749 MailWatch for MailScanner is a web-based front-end to MailScanner. |
high | 8.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-119049 FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows... |
high | 7.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability |
high | 8.8 | Listed | Microsoft / Windows | 2026-10-13 | 2026-10-29 |
| CVE-2026-96202 Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-88094 Improper neutralization of special elements in output used by a downstream compo... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', be... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116778 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-67187 Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-sid... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116795 RE2JS is the JavaScript port of RE2, a regular expression engine that provides l... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118633 A path traversal vulnerability allows a remote unauthenticated attacker to execu... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118905 Node Version Manager (nvm) is a POSIX-compliant shell function for managing mult... |
high | 7.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119025 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-49142 OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in th... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerabil... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61572 AVideo is a video-sharing Platform. |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61569 AVideo is a video-sharing Platform. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-23705 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in th... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in t... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119119 Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker A... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119120 Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name f... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116048 A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116067 Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSh... |
high | 8.2 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115970 A vulnerability has been found in Travisun Opptrix 0.4.0. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115999 A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116006 A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-83785 Use after free in Windows COM+ Event System Service allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2025-14260 Due to the improper implementation of access control rules, the WSO2 product acc... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user s... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-78674 The BPMN System REST APIs do not sufficiently validate input parameters, allowin... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118304 Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.