October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55444 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55465 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-61573 AVideo is a video-sharing Platform. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61575 AVideo is a video-sharing Platform. |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-54853 Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builde... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-34484 Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulne... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-46531 Cacti is an open source performance and fault management framework. |
medium | 5.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-39737 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42690 Subscriber Broken Access Control in LearnPress |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119121 Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability i... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-15146 GNU Wget versions |
medium | 5.9 | — | — | 2026-07-10 | 2026-10-29 |
| CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulne... |
medium | 4.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-83933 Improper link resolution before file access ('link following') in Windows Update... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-118656 Echo is a Go web framework. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118589 A weakness has been identified in nschloe meshio up to 5.3.5. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118092 Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstud... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115729 @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vu... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115480 baserCMS is a website development framework. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-117859 A flaw was found in the Pushed Authorization Request PAR implementation of the k... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113576 Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a... |
medium | 6.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file in... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2025-60482 A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptor... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-83764 Incorrect authorization in Windows Clipboard User Service allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85320 Use of uninitialized resource in Windows Print Spooler Components allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-19603 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19867 Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-16251 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19601 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.9 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19541 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18795 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.4 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18223 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 5.0 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18256 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18799 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18551 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-98059 In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark s... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-29 |
| CVE-2026-83765 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83766 Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypa... |
medium | 4.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.