October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,234
High
7,703
Medium
7,358
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCI... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-91814 A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handlin... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91788 When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perf... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-88010 Traefik is an open source HTTP reverse proxy and load balancer. |
medium | 5.3 | — | Traefik / traefik | 2026-09-22 | 2026-10-29 |
| CVE-2026-115396 Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115395 Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerabil... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115394 Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-86981 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-90862 Improper authentication in the Web Transfer Module of Progress Software WS_FTP S... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-90871 Improper limitation of a pathname to a restricted directory in Progress Software... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118693 CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXml... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118756 gopass before 1.17.0 contains a path traversal vulnerability in the filesystem s... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-75520 Domoticz is a free, open source home automation system for Linux, Windows, macOS... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-40063 A information disclosure vulnerability exists in the /nodered/fuxa/scripts funct... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42949 A authorization bypass vulnerability exists in the /api/runscript functionality... |
medium | 5.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a se... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119051 flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119053 lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds rea... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112356 GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scr... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118754 Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88941 Kaspersky has fixed a vulnerability in the Network Agent for Windows module of K... |
medium | 5.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119136 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient che... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover asser... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119140 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119131 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119132 Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability th... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119135 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host read... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116045 A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116071 rotki before 1.44.2 contains a weak key derivation vulnerability that allows att... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116052 A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116641 The DB Tools rely on the TLS implementation in Golang’s standard library, which... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116018 ONEARMY community-platform before 2.165.2 contains an insecure direct object ref... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-100132 Acrobat for Edge is affected by an out-of-bounds read vulnerability that could l... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83786 Generation of error message containing sensitive information in Windows NTFS all... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83787 Insufficient verification of data authenticity in Windows DHCP Server allows an... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83788 Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose in... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.