October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,599
Critical
3,298
High
7,980
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112427 An authentication issue was addressed with improved state management. |
high | 8.1 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object inject... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-118335 Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-118330 Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-113180 Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-29 |
| CVE-2026-113170 Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-29 |
| CVE-2026-92158 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-73261 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-91303 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-61611 Lychee is a free, open-source photo-management tool. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-55786 Flyto2 Core is an execution kernel for automation and AI-agent workflows. |
high | 8.4 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-56838 PraisonAI is a multi-agent teams system. |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57114 PraisonAI is a multi-agent teams system. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57142 PraisonAI is a multi-agent teams system. |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-39902 Cacti is an open source performance and fault management framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-11837 A local privilege escalation vulnerability was found in the ansible.posix author... |
high | 7.3 | — | — | 2026-06-10 | 2026-10-29 |
| CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools t... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116391 Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116392 Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordi... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115606 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116389 Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116390 Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything —... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115328 JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi()... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115355 Mistune before 3.3.0 contains a path traversal vulnerability in the Include dire... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114624 baserCMS is a website development framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115457 baserCMS is a website development framework. |
high | 7.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115591 Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Con... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115590 Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allow... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115603 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111850 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-100353 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-2100 A flaw was found in p11-kit. |
high | 7.5 | — | P11-kit Project / p11-kit | 2026-03-26 | 2026-10-29 |
| CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe... |
high | 8.3 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-112085 webpack-dev-server is a development server that provides live reloading for webp... |
high | 8.2 | — | Webpack.js / webpack-dev-server | 2026-10-22 | 2026-10-29 |
| CVE-2026-94109 openEQUELLA before 2026.1.0 contains an authenticated stored server-side templat... |
high | 8.0 | — | — | 2026-09-20 | 2026-10-29 |
| CVE-2026-67615 openEQUELLA before 2026.1.0 contains an authenticated remote code execution vuln... |
high | 8.8 | — | — | 2026-09-22 | 2026-10-29 |
| CVE-2026-56834 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-52356 An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.