October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59963 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111853 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111880 FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in... |
high | 7.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111923 Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM e... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112021 snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_jso... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112262 RisingWave before 3.1.0 contains a missing authorization vulnerability that allo... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112287 Krayin CRM before 2.2.7 contains a broken object level authorization vulnerabili... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111045 CLI Bridge provides filesystem access within a workspace root. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112264 BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112308 crewai-tools through 1.15.28 contains a server-side request forgery vulnerabilit... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112366 Picomatch through 4.0.7 contains a regular expression denial of service vulnerab... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111759 markdown-it is a Markdown parser. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-58098 When semop(2) blocks waiting for a semaphore condition, it releases the per-set... |
high | 8.4 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-110031 The Salon Booking System WordPress plugin before 10.31.11 does not prevent users... |
high | 7.2 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110981 The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly esc... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-96534 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Cal... |
high | 7.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-62439 A flaw was found in GIMP. |
high | 7.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-58099 When copying knotes from a parent kqueue to a child, the copy code did not corre... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-58100 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-103839 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103838 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103837 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103836 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103835 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103834 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103833 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103832 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103830 Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-111441 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObj... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111440 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactor... |
high | 7.0 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-6719 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109855 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-78164 Improper Neutralization of Special Elements Used in a Template Engine and Exposu... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80312 Improper Authentication vulnerability in Apache Camel OAuth component. |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80343 Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP c... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80344 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85250 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85251 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.