October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,949
Critical
3,231
High
7,652
Medium
7,322
Low
724
Severity not reported
5,020
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1400), google (802), linux (663), ibm (323), mozilla (182), oracle (157), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-30803 Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core... |
critical | 9.1 | — | Rti / connext micro | 2026-06-17 | 2026-10-26 |
| CVE-2026-11717 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-11718 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-9158 In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE conne... |
critical | 9.8 | — | Eclipse / 4diac forte | 2026-06-18 | 2026-10-26 |
| CVE-2026-50242 In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.14812... |
critical | 9.8 | — | Jetbrains / hub | 2026-06-19 | 2026-10-26 |
| CVE-2026-44087 Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-26 |
| CVE-2026-49871 Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under def... |
critical | 9.3 | — | Apache / apisix | 2026-06-19 | 2026-10-26 |
| CVE-2026-54309 n8n is an open source workflow automation platform. |
critical | 10.0 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-54310 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-44789 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-44791 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-44792 n8n is an open source workflow automation platform. |
critical | 9.0 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-55191 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.8 | — | Freerdp / freerdp | 2026-08-19 | 2026-10-26 |
| CVE-2026-55194 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.8 | — | Freerdp / freerdp | 2026-08-19 | 2026-10-26 |
| CVE-2026-63633 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.8 | — | Freerdp / freerdp | 2026-08-19 | 2026-10-26 |
| CVE-2026-20043 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated clien... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111816 Apache Traffic Server forwarded a malformed 302 response that should have been r... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111811 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated ne... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-75595 Netty is an asynchronous, event-driven network application framework. |
critical | 9.1 | — | Netty / netty | 2026-08-19 | 2026-10-26 |
| CVE-2026-19586 A pre-authentication OS command injection vulnerability has been identified in O... |
critical | 9.8 | — | Tp-link / er7212pc firmware | 2026-08-20 | 2026-10-26 |
| CVE-2026-17423 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o... |
critical | 9.1 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-17436 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-18670 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c... |
critical | 9.1 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-18716 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated... |
critical | 9.1 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-18832 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-19437 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-33943 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
critical | 9.8 | — | Capricorn86 / happy dom | 2026-03-27 | 2026-10-26 |
| CVE-2026-34568 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-5663 A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. |
critical | 9.8 | — | Offis / dcmtk | 2026-04-06 | 2026-10-26 |
| CVE-2026-5973 A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-34727 Vikunja is an open-source self-hosted task management platform. |
critical | 9.1 | — | Vikunja / vikunja | 2026-04-10 | 2026-10-26 |
| CVE-2026-25208 Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow B... |
critical | 9.8 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-22619 Eaton Intelligent Power Protector (IPP) is affected by insecure library loading... |
critical | 9.9 | — | Eaton / intelligent power protector | 2026-04-16 | 2026-10-26 |
| CVE-2026-5787 An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7... |
critical | 9.1 | — | Ivanti / endpoint manager mobile | 2026-05-07 | 2026-10-26 |
| CVE-2026-49268 A remote attacker can inject LDAP special characters into the Distinguished Name... |
critical | 9.1 | — | Apache / shiro | 2026-06-17 | 2026-10-26 |
| CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vul... |
critical | 9.1 | — | Haproxy / haproxy | 2026-06-18 | 2026-10-26 |
| CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability |
critical | 9.8 | Listed | ICagenda / iCagenda | 2026-06-20 | 2026-10-25 |
| CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulne... |
critical | 9.8 | Listed | JoomShaper / SP Page Builder | 2026-06-20 | 2026-10-25 |
| CVE-2026-0643 A flaw has been found in projectworlds House Rental and Property Listing 1.0. |
critical | 9.8 | — | Projectworlds / house rental and property listing project | 2026-01-07 | 2026-10-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.