October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,712
Critical
3,235
High
7,708
Medium
7,359
Low
705
Severity not reported
4,705
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108766 Missing authorization on jdbc source config update in Apache Kylin. |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-108776 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-108780 Potential JDBC source configuration validation vulnerability in Apache Kylin. |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2024-9675 A vulnerability was found in Buildah. |
medium | 4.4 | — | Buildah Project / buildah | 2024-10-09 | 2026-10-30 |
| CVE-2024-4989 The callback URL parameter in WSO2 API Manager fails to validate user-supplied i... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2024-5139 The Authentication Endpoint accepts user-supplied input without sufficient encod... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2024-5563 Due to an incomplete implementation, reCaptcha is not applied to certain authent... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-44344 Chamilo LMS is an open-source learning management system. |
medium | 6.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-45141 Chamilo LMS is an open-source learning management system. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119291 Zuke is a code-first, strongly typed build automation system for Deno. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118778 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119278 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-111501 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restri... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111502 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111498 OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Lo... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111499 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permi... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111500 Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authenti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-92205 BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerabi... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-65444 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypas... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119665 WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119657 FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pi... |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that al... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119574 Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastPr... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119569 Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119573 Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes... |
medium | 4.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan. |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119370 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118500 The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116590 snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser dev... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-116685 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116773 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116860 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116582 Seroval facilitates JavaScript value stringification, including complex structur... |
medium | 4.7 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-113799 Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Bloc... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2025-70102 A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.... |
medium | 6.3 | — | — | 2026-06-15 | 2026-10-30 |
| CVE-2024-6423 The product failed to enforce validation constraints on user-supplied input in U... |
medium | 4.0 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-76292 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Spl... |
medium | 6.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-101432 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 5.3 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-30 |
| CVE-2026-76294 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.