October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,728
Critical
3,236
High
7,711
Medium
7,361
Low
706
Severity not reported
4,714
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Brow... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2025-5278 A flaw was found in GNU Coreutils. |
medium | 4.4 | — | — | 2025-05-27 | 2026-10-31 |
| CVE-2026-116900 REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116892 SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-31 |
| CVE-2026-116888 SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting... |
medium | 5.4 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-31 |
| CVE-2026-116884 SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-31 |
| CVE-2026-116842 DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116828 YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116824 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in han... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116803 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116807 OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authe... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116815 OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.ser... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116820 YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116740 libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_par... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116744 ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_so... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116602 A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116605 A vulnerability was found in SourceCodester Online Food Ordering System 1.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-89209 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All v... |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116728 libfvde through 20260923 contains a heap out-of-bounds read vulnerability in lib... |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116732 libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf... |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116736 Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libp... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116488 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contain... |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116538 HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contain... |
medium | 4.7 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116542 Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulne... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116577 Tornado is a Python web framework and asynchronous networking library. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116283 A weakness has been identified in Kameleo up to 5.0.1.26. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116340 A vulnerability was identified in iFlytek astron-agent up to 1.1.2. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116369 A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116461 A vulnerability was determined in Omega Solution Restro POS up to 20261026. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116477 A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116254 A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d0... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116263 A flaw has been found in HaschekSolutions PictShare up to 3.7.1. |
medium | 4.6 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116280 A vulnerability was determined in Kameleo up to 5.0.1.26. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116210 Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerabi... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115906 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115910 Python Social Auth is a social authentication and registration mechanism. |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115917 vLLM is an inference and serving engine for large language models. |
medium | 4.7 | — | Vllm / vllm | 2026-10-26 | 2026-10-31 |
| CVE-2026-115921 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2013-10077 A weakness has been identified in OctoPrint 1.0.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.