October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93008 A flaw was found in dnsmasq. |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118947 A flaw was found in the UMA resource registration endpoint of the keycloak-servi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118959 A flaw was found in the required action provider mechanism of Keycloak. |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-13116 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnera... |
medium | 4.3 | — | — | 2026-07-11 | 2026-10-30 |
| CVE-2026-107444 A flaw was found in Katello where the Docker Tags repositories API does not prop... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-29 |
| CVE-2025-13327 A flaw was found in uv. |
medium | 6.3 | — | Astral / uv | 2026-02-27 | 2026-10-29 |
| CVE-2026-68563 A flaw was found in ansible-collection-redhat-leapp. |
medium | 5.5 | — | — | 2026-07-30 | 2026-10-29 |
| CVE-2026-68562 A flaw was found in ansible-collection-redhat-leapp. |
medium | 6.2 | — | — | 2026-07-30 | 2026-10-29 |
| CVE-2024-9355 A vulnerability was found in Golang FIPS OpenSSL. |
medium | 6.5 | — | — | 2024-10-01 | 2026-10-29 |
| CVE-2026-92588 n8n is a workflow automation platform. |
medium | 4.4 | — | — | 2026-09-16 | 2026-10-29 |
| CVE-2026-93588 ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer derefer... |
medium | 4.3 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-86423 ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-86425 ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-90931 LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content dur... |
medium | 5.4 | — | — | 2026-09-14 | 2026-10-29 |
| CVE-2026-92587 n8n is a workflow automation platform. |
medium | 5.0 | — | — | 2026-09-16 | 2026-10-29 |
| CVE-2026-85167 n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerabili... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85170 n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gma... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85171 n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerabi... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85172 n8n versions before 2.34.1 contain a server-side request forgery vulnerability i... |
medium | 6.4 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85173 n8n versions before 2.36.2 contain a missing per-project authorization vulnerabi... |
medium | 4.3 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-84807 Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authoriz... |
medium | 5.4 | — | — | 2026-09-02 | 2026-10-29 |
| CVE-2026-85166 n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential referenc... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-70639 llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerab... |
medium | 5.5 | — | Ggml / llama.cpp | 2026-08-06 | 2026-10-29 |
| CVE-2026-72771 n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allo... |
medium | 6.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72774 n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypa... |
medium | 6.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72791 SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7... |
medium | 5.8 | — | — | 2026-08-12 | 2026-10-29 |
| CVE-2026-63308 Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulner... |
medium | 6.5 | — | Helm / helm | 2026-07-17 | 2026-10-29 |
| CVE-2026-65014 n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE... |
medium | 5.3 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-65902 DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLO... |
medium | 6.1 | — | Cure53 / dompurify | 2026-07-23 | 2026-10-29 |
| CVE-2026-61529 Endatix is a self-hosted form and survey management platform with a headless API... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61858 ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG e... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-29 |
| CVE-2026-61465 ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed mem... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-29 |
| CVE-2026-56371 ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-06-23 | 2026-10-29 |
| CVE-2026-56373 ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-07-10 | 2026-10-29 |
| CVE-2026-56365 ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG enco... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-06-30 | 2026-10-29 |
| CVE-2026-56362 ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability i... |
medium | 4.2 | — | Imagemagick / imagemagick | 2026-07-08 | 2026-10-29 |
| CVE-2026-56366 ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META rea... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-07-10 | 2026-10-29 |
| CVE-2026-41401 libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_p... |
medium | 6.5 | — | — | 2026-05-26 | 2026-10-29 |
| CVE-2026-47119 Agent Zero before version 1.15 contains a stored cross-site scripting vulnerabil... |
medium | 6.1 | — | — | 2026-05-27 | 2026-10-29 |
| CVE-2026-53987 The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML saniti... |
medium | 6.4 | — | — | 2026-07-09 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.