October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,034
Critical
3,238
High
7,713
Medium
7,372
Low
727
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (709), ibm (323), oracle (187), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-24227 NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial... |
critical | 9.8 | — | Nvidia / tensorrt | 2026-07-14 | 2026-10-24 |
| CVE-2026-20156 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / roomos | 2026-07-15 | 2026-10-24 |
| CVE-2026-20157 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / roomos | 2026-07-15 | 2026-10-24 |
| CVE-2026-54052 n8n-MCP is an MCP server that provides AI assistants access to n8n node document... |
critical | 9.9 | — | N8n-mcp / n8n-mcp | 2026-07-15 | 2026-10-24 |
| CVE-2026-56453 HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vu... |
critical | 9.8 | — | Hcltech / dfxanalytics | 2026-07-16 | 2026-10-24 |
| CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-24 |
| CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability |
critical | 9.8 | Listed | Sangoma / Switchvox | 2026-07-17 | 2026-10-24 |
| CVE-2026-9198 IBM Langflow Code Injection Vulnerability |
critical | 9.8 | Listed | IBM / Langflow | 2026-07-17 | 2026-10-24 |
| CVE-2026-45568 zrok is software for sharing web services, files, and network resources. |
critical | 9.1 | — | Netfoundry / zrok | 2026-07-16 | 2026-10-24 |
| CVE-2026-54526 Argo Workflows is an open source container-native workflow engine for orchestrat... |
critical | 9.9 | — | Argoproj / argo workflows | 2026-07-16 | 2026-10-24 |
| CVE-2026-44181 Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr... |
critical | 10.0 | — | Jupyter / enterprise gateway | 2026-07-16 | 2026-10-24 |
| CVE-2026-44182 Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr... |
critical | 10.0 | — | Jupyter / enterprise gateway | 2026-07-16 | 2026-10-24 |
| CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. |
critical | 9.8 | — | — | 2026-07-17 | 2026-10-24 |
| CVE-2026-8297 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-07-17 | 2026-10-24 |
| CVE-2026-13448 IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated re... |
critical | 9.8 | — | Langflow / langflow | 2026-07-17 | 2026-10-24 |
| CVE-2026-13473 IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 throu... |
critical | 9.8 | — | Ibm / storage protect | 2026-07-17 | 2026-10-24 |
| CVE-2026-46420 setup-php is a GitHub action to set up PHP with extensions, php.ini configuratio... |
critical | 9.8 | — | Shivammathur / setup php | 2026-07-17 | 2026-10-24 |
| CVE-2026-41521 xrdp is an open source RDP server. |
critical | 9.1 | — | Neutrinolabs / xrdp | 2026-07-20 | 2026-10-24 |
| CVE-2026-12341 This vulnerability
impacts all versions of IdentityIQ and allows an unauthentica... |
critical | 9.8 | — | Sailpoint / identityiq | 2026-07-20 | 2026-10-24 |
| CVE-2026-16439 In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments c... |
critical | 9.1 | — | Eclipse / openj9 | 2026-07-21 | 2026-10-24 |
| CVE-2026-16441 In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previo... |
critical | 9.6 | — | Eclipse / openj9 | 2026-07-21 | 2026-10-24 |
| CVE-2026-8983 Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authen... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-8984 Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remot... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-8985 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-8986 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-65400 Apple macOS Improper Authentication Vulnerability |
critical | 9.8 | Listed | Apple / macOS | 2026-08-06 | 2026-10-24 |
| CVE-2026-69258 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.1 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-69263 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-69264 Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-64993 Dell RVTools versions prior to 4.8.1, contains an improper certificate validatio... |
critical | 9.1 | — | Dell / rvtools | 2026-08-06 | 2026-10-24 |
| CVE-2026-54489 Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.... |
critical | 9.8 | — | Dell / virtual storage integrator | 2026-08-06 | 2026-10-24 |
| CVE-2026-62836 Improper restriction of communication channel to intended endpoints in Azure SQL... |
critical | 10.0 | — | Microsoft / azure sql managed instance | 2026-08-07 | 2026-10-24 |
| CVE-2026-57104 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.6 | — | Microsoft / azure storage explorer | 2026-08-11 | 2026-10-24 |
| CVE-2026-65768 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / teams | 2026-08-11 | 2026-10-24 |
| CVE-2026-112859 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112858 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos all... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112856 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vaga... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112855 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112854 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center h... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112851 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotloc... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.