October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,234
High
7,703
Medium
7,358
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11854 The authentication endpoint generates an error message that includes reflected d... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-114398 Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that a... |
medium | 5.4 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2023-26142 All versions of the package crow are vulnerable to HTTP Response Splitting when... |
medium | 6.1 | — | Crowcpp / crow | 2023-09-12 | 2026-10-29 |
| CVE-2026-73070 Vim is an open source, command line text editor. |
medium | 5.5 | — | Vim / vim | 2026-08-11 | 2026-10-29 |
| CVE-2026-86875 An input validation issue was addressed with improved input validation. |
medium | 4.3 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-85866 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-118661 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-114399 Trudesk through 1.2.11 contains a path traversal vulnerability that allows admin... |
medium | 6.5 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-109822 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an iss... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-97860 YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows service... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118029 Unverified ownership of the default query result location in the Athena module i... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115415 Improper neutralization of input used for LLM prompting in the environment tool... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88858 A user with the Viewer role in Grafana can crash the server by submitting a craf... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105613 PostgreSQL Anonymizer's range-based dummy functions dont constraint the range si... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105614 PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105616 PostgreSQL restricts acces to the salt and shift via the `SHOW` command for user... |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105617 PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added o... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105618 PostgreSQL Anonymizer's documentation recommends applying rules on partitions an... |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105619 PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105620 PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110181 PostgreSQL Anonymizer contains a vulnerability related to anonymization function... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110182 PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110183 PostgreSQL Anonymizer contains a vulnerability related to static masking and sta... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shi... |
medium | 6.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118601 Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118604 Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execut... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118607 Alpine iLX-F511 diagapp Command Injection Vulnerability. |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118609 Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remo... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118611 Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-39742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114401 Trudesk through 1.2.11 contains a regular expression injection vulnerability tha... |
medium | 5.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-108763 The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restric... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110030 The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a gue... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110504 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sani... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110505 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prev... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110983 The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the o... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114270 The GeoDirectory WordPress plugin before 2.8.197 does not honour post password p... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115259 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 doe... |
medium | 4.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115282 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an au... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115299 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a C... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.