October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,728
Critical
3,236
High
7,711
Medium
7,361
Low
706
Severity not reported
4,714
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118767 Botan is a C++ cryptography library. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119285 Fiber is an Express inspired web framework written in Go. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-46499 Collabora Online is a collaborative online office suite based on LibreOffice tec... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-48164 Collabora Online is a collaborative online office suite based on LibreOffice tec... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119299 gopacket provides packet processing capabilities for Go. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-50000 SecureDrop is an open-source whistleblower submission system that media organiza... |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119148 Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may al... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119421 Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a m... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerabilit... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119425 OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerabil... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119552 Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run s... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119559 OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119560 OPNsense core through 26.7.8 contains a configuration injection vulnerability th... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information expo... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119565 Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in up... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112348 Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerabilit... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119596 UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZ... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119598 Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119644 Blossom through 1.17.1 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119645 ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119646 Open Web Analytics before 1.14.1 contains an authorization vulnerability that al... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119648 Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119650 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119651 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119652 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119653 Nging through 5.3.5 contains an information disclosure vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119658 PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119659 Blossom through 1.17.1 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119661 ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119663 Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vul... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119664 Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vu... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119700 WPGraphQL before 2.24.2 contains an information disclosure vulnerability that al... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allo... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119702 WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the cr... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerabili... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119704 Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh,... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119705 SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/a... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119709 Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vu... |
medium | 5.8 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.