October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,669
Critical
3,172
High
7,258
Medium
7,098
Low
643
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCI... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-91814 A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handlin... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91788 When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perf... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-88010 Traefik is an open source HTTP reverse proxy and load balancer. |
medium | 5.3 | — | Traefik / traefik | 2026-09-22 | 2026-10-29 |
| CVE-2026-115396 Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115395 Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerabil... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115394 Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-86981 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-118756 gopass before 1.17.0 contains a path traversal vulnerability in the filesystem s... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-40063 A information disclosure vulnerability exists in the /nodered/fuxa/scripts funct... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42949 A authorization bypass vulnerability exists in the /api/runscript functionality... |
medium | 5.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a se... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119053 lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds rea... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112356 GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scr... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88941 Kaspersky has fixed a vulnerability in the Network Agent for Windows module of K... |
medium | 5.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116045 A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116071 rotki before 1.44.2 contains a weak key derivation vulnerability that allows att... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116052 A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116641 The DB Tools rely on the TLS implementation in Golang’s standard library, which... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116018 ONEARMY community-platform before 2.165.2 contains an insecure direct object ref... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-100132 Acrobat for Edge is affected by an out-of-bounds read vulnerability that could l... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83786 Generation of error message containing sensitive information in Windows NTFS all... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83787 Insufficient verification of data authenticity in Windows DHCP Server allows an... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83788 Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose in... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-11854 The authentication endpoint generates an error message that includes reflected d... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-114398 Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that a... |
medium | 5.4 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2023-26142 All versions of the package crow are vulnerable to HTTP Response Splitting when... |
medium | 6.1 | — | Crowcpp / crow | 2023-09-12 | 2026-10-29 |
| CVE-2026-73070 Vim is an open source, command line text editor. |
medium | 5.5 | — | Vim / vim | 2026-08-11 | 2026-10-29 |
| CVE-2026-86875 An input validation issue was addressed with improved input validation. |
medium | 4.3 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-85866 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-114399 Trudesk through 1.2.11 contains a path traversal vulnerability that allows admin... |
medium | 6.5 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-109822 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an iss... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-97860 YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows service... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118029 Unverified ownership of the default query result location in the Athena module i... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115415 Improper neutralization of input used for LLM prompting in the environment tool... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88858 A user with the Viewer role in Grafana can crash the server by submitting a craf... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105613 PostgreSQL Anonymizer's range-based dummy functions dont constraint the range si... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105614 PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105616 PostgreSQL restricts acces to the salt and shift via the `SHOW` command for user... |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.