October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-25208 Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow B... |
critical | 9.8 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-22619 Eaton Intelligent Power Protector (IPP) is affected by insecure library loading... |
critical | 9.9 | — | Eaton / intelligent power protector | 2026-04-16 | 2026-10-26 |
| CVE-2026-5787 An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7... |
critical | 9.1 | — | Ivanti / endpoint manager mobile | 2026-05-07 | 2026-10-26 |
| CVE-2026-49268 A remote attacker can inject LDAP special characters into the Distinguished Name... |
critical | 9.1 | — | Apache / shiro | 2026-06-17 | 2026-10-26 |
| CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vul... |
critical | 9.1 | — | Haproxy / haproxy | 2026-06-18 | 2026-10-26 |
| CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability |
critical | 9.8 | Listed | ICagenda / iCagenda | 2026-06-20 | 2026-10-25 |
| CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulne... |
critical | 9.8 | Listed | JoomShaper / SP Page Builder | 2026-06-20 | 2026-10-25 |
| CVE-2026-0643 A flaw has been found in projectworlds House Rental and Property Listing 1.0. |
critical | 9.8 | — | Projectworlds / house rental and property listing project | 2026-01-07 | 2026-10-25 |
| CVE-2026-40088 PraisonAI is a multi-agent teams system. |
critical | 9.6 | — | Praison / praisonai | 2026-04-09 | 2026-10-25 |
| CVE-2026-42238 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.8 | — | Nginxui / nginx ui | 2026-05-04 | 2026-10-25 |
| CVE-2026-42557 jupyterlab is an extensible environment for interactive and reproducible computi... |
critical | 9.6 | — | Jupyter / jupyterlab | 2026-05-13 | 2026-10-25 |
| CVE-2026-8686 Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.... |
critical | 9.1 | — | Freertos / coremqtt | 2026-05-15 | 2026-10-25 |
| CVE-2026-53407 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before... |
critical | 9.8 | — | Zoom / workplace | 2026-06-12 | 2026-10-25 |
| CVE-2026-0126 In WC-Radio, there is a possible out of bounds write due to a missing bounds che... |
critical | 9.8 | — | Google / android | 2026-06-16 | 2026-10-25 |
| CVE-2026-32966 DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metada... |
critical | 9.8 | — | Apache / dolphinscheduler | 2026-06-17 | 2026-10-25 |
| CVE-2026-3894 Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) al... |
critical | 9.1 | — | Rti / connext professional | 2026-06-17 | 2026-10-25 |
| CVE-2026-39999 Authentication Bypass by Spoofing vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-25 |
| CVE-2026-49230 Improper Validation of Integrity Check Value vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-25 |
| CVE-2026-12773 A weakness has been identified in BerriAI litellm up to 1.59.8. |
critical | 9.8 | — | Litellm / litellm | 2026-06-21 | 2026-10-25 |
| CVE-2026-6653 Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.... |
critical | 9.8 | — | Xmlsoft / libxml2 | 2026-06-22 | 2026-10-25 |
| CVE-2026-9006 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque... |
critical | 9.1 | — | Ibm / websphere application server | 2026-06-22 | 2026-10-25 |
| CVE-2026-9072 IBM WebSphere Application Server and IBM WebSphere Application Server Liberty -... |
critical | 9.8 | — | Ibm / i | 2026-06-22 | 2026-10-25 |
| CVE-2026-49468 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
critical | 9.8 | — | Litellm / litellm | 2026-06-22 | 2026-10-25 |
| CVE-2026-54305 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-25 |
| CVE-2026-54307 n8n is an open source workflow automation platform. |
critical | 9.6 | — | N8n / n8n | 2026-06-23 | 2026-10-25 |
| CVE-2026-44726 Deno is a JavaScript, TypeScript, and WebAssembly runtime. |
critical | 9.1 | — | Deno / deno | 2026-06-23 | 2026-10-25 |
| CVE-2026-54316 Claude Code is an agentic coding tool. |
critical | 9.1 | — | Anthropic / claude code | 2026-06-23 | 2026-10-25 |
| CVE-2026-53753 Crawl4AI is an open-source LLM friendly web crawler & scraper. |
critical | 10.0 | — | Kidocode / crawl4ai | 2026-06-23 | 2026-10-25 |
| CVE-2026-55455 Appsmith is a platform to build admin panels, internal tools, and dashboards. |
critical | 9.1 | — | Appsmith / appsmith | 2026-06-24 | 2026-10-25 |
| CVE-2026-8592 OS Command Injection vulnerability in the process_string action of Rapid7 Insigh... |
critical | 9.8 | — | Rapid7 / insightconnect awk | 2026-06-25 | 2026-10-25 |
| CVE-2026-8660 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P... |
critical | 9.8 | — | Rapid7 / insightconnect ping | 2026-06-25 | 2026-10-25 |
| CVE-2026-8665 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra... |
critical | 9.8 | — | Rapid7 / insightconnect translate | 2026-06-25 | 2026-10-25 |
| CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon... |
critical | 9.8 | — | Rapid7 / insightconnect traceroute | 2026-06-25 | 2026-10-25 |
| CVE-2026-54906 concurrent-ruby is a modern concurrency tools for Ruby. |
critical | 9.8 | — | Rubyconcurrency / concurrent ruby | 2026-06-24 | 2026-10-25 |
| CVE-2026-54030 LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. |
critical | 9.3 | — | Librechat / librechat | 2026-06-25 | 2026-10-25 |
| CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lea... |
critical | 9.8 | — | Nodejs / node.js | 2026-06-26 | 2026-10-25 |
| CVE-2026-2053 The WSO2 API Manager's message flow component, when processing WS-Addressing hea... |
critical | 10.0 | — | Wso2 / api manager | 2026-06-26 | 2026-10-25 |
| CVE-2026-53914 In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deseria... |
critical | 9.8 | — | Jetbrains / kotlin | 2026-06-26 | 2026-10-25 |
| CVE-2026-57926 In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable t... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-06-26 | 2026-10-25 |
| CVE-2026-56290 Joomlack Page Builder Improper Access Control Vulnerability |
critical | 9.8 | Listed | Joomlack / Page Builder | 2026-06-29 | 2026-10-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.