October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-40037 OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWi... |
medium | 6.5 | — | Openclaw / openclaw | 2026-04-08 | 2026-10-29 |
| CVE-2026-119138 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119118 Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119122 Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps com... |
medium | 6.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118687 Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118651 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118265 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116185 OpenRemote core before 1.31.0 contains an authorization bypass vulnerability tha... |
medium | 5.0 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116205 YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116118 A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116124 A security vulnerability has been detected in GNOME libgsf up to 1.14.60. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116097 A security vulnerability has been detected in CloudClassroom-PHP-Project. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116103 A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116109 A vulnerability has been found in continuedev Continue 2.0.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-114475 Missing authorization in the REST role-management routes of Progressive Robot hM... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114477 Missing authorization in the REST metrics route of Progressive Robot hMailServer... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114478 Insufficient preservation of the original sender in the forwarding of Progressiv... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-116057 A vulnerability has been found in KodCloud KodExplorer up to 4.55. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-114470 Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114471 Insertion of sensitive information into a log file in the SMTP server of Progres... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114473 Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robo... |
medium | 5.0 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114474 Use of a less trusted source for the envelope sender in the external-account dow... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-10031 SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows aut... |
medium | 5.4 | — | — | 2026-07-30 | 2026-10-29 |
| CVE-2026-102485 Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before... |
medium | 5.2 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-100834 http4k's Digest authentication module (org.http4k:http4k-security-digest) before... |
medium | 5.9 | — | — | 2026-09-27 | 2026-10-29 |
| CVE-2026-101987 An Improper Validation of Specified Quantity in Input vulnerability in the routi... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-102484 Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.... |
medium | 6.4 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-100724 http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51... |
medium | 5.4 | — | — | 2026-09-27 | 2026-10-29 |
| CVE-2026-100725 http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.... |
medium | 6.5 | — | — | 2026-09-27 | 2026-10-29 |
| CVE-2025-71394 SurrealDB versions before 2.2.2 contain a local file read vulnerability in the D... |
medium | 4.3 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-71395 SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-71396 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enfo... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-71397 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authen... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-71381 Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is no... |
medium | 6.5 | — | — | 2026-06-30 | 2026-10-29 |
| CVE-2025-71391 SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in t... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-71393 SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursio... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-30006 Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in th... |
medium | 6.1 | — | Xorcom / completepbx | 2025-03-31 | 2026-10-29 |
| CVE-2025-34253 D-Link Nuclias Connect firmware versions |
medium | 5.4 | — | Dlink / nuclias connect | 2025-10-16 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.