October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,728
Critical
3,236
High
7,711
Medium
7,361
Low
706
Severity not reported
4,714
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59396 A denial-of-service vulnerability exists in UAA's private_key_jwt client-authent... |
medium | 4.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54532 CloudPirates Open Source Helm Charts is a collection of Helm charts. |
medium | 6.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-49442 Cacti is an open source performance and fault management framework. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-119763 changelog.com before commit 7b35e829 contains a missing authorization vulnerabil... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119728 A flaw was found in the H.264 video parser in gst-plugins-bad. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119729 A flaw was found in GStreamer. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119086 Missing queue-set type validation in the queue-set selection system call in Free... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Li... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114652 A data-query-logic neutralization weakness in the update-statement construction... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114653 A client-side encryption schema construction component in the MongoDB C# Driver... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114654 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Dr... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114655 libmongocrypt builds requests to external key management services (AWS, Azure an... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115479 baserCMS is a website development framework. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB... |
medium | 4.0 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114572 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114487 Missing authorization in the PAM AD computer import endpoint in Devolutions Serv... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-109763 Mitigation bypass in the File Handling component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Fa... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107259 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107261 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107263 Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107264 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107265 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107267 Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107251 Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107252 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107253 Vulnerability in Drupal Orphans Media. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107254 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107257 Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsi... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107258 Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107250 Vulnerability in Drupal ECA Helper. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-103299 The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secr... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2025-12523 Broken Object Level Authorization in Users Configuration Endpoint allows Informa... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119298 croc is a tool that allows any two computers to simply and securely transfer fil... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55551 ZAC is an open-source, workflow-based Common Ground component for Dutch municipa... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102260 HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authoriza... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118766 Botan is a C++ cryptography library. |
medium | 6.1 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.