October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,236
High
7,702
Medium
7,359
Low
705
Severity not reported
4,702
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107445 A flaw was found in Katello where the Flatpak Remote Repositories API does not p... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-29 |
| CVE-2026-104109 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-112455 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and mult... |
medium | 5.6 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-114726 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
medium | 5.8 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote c... |
medium | 5.3 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114348 webpack-dev-server is a development server that provides live reloading for webp... |
medium | 5.3 | — | Webpack.js / webpack-dev-server | 2026-10-22 | 2026-10-29 |
| CVE-2026-91476 Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-90458 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g.,... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-87352 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 4.4 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-29 |
| CVE-2026-87373 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-59188 Part-DB is an open source inventory management system for electronic components. |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerabili... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115722 RPly through 1.1.4 contains an improper array index validation vulnerability in... |
medium | 6.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115509 Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerab... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115485 A flaw was found in the iscsiuio component of open-iscsi. |
medium | 6.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115536 A security flaw has been discovered in gedelumbung HospitalManagement up to c2d4... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-101974 An Improper Validation of Specified Quantity in Input vulnerability in rpd of Ju... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-107686 The Gitea web handlers for adding and removing reactions on issues and comments... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-29 |
| CVE-2025-52097 Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 a... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-29 |
| CVE-2026-115411 crawlseo before version 0.2.4 contains a server-side request forgery vulnerabili... |
medium | 5.0 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missin... |
medium | 6.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115249 A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115351 Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allo... |
medium | 4.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-108360 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
medium | 6.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2017-20288 QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerabili... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2024-58394 Retool before 3.88.0 contains a cross-site scripting vulnerability that allows u... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-90728 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90729 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.7 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-87878 Linux binaries have executable stack attribute enabled. |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87880 Sensitive information disclosure due to missing SSL certificate verification aff... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-81472 Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-2270 A confused deputy attack exists in the StatefulSet controller that allows a user... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerab... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an imprope... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-37982 A flaw was found in Keycloak. |
medium | 6.8 | — | Redhat / build of keycloak | 2026-05-19 | 2026-10-29 |
| CVE-2026-37979 A flaw was found in Keycloak. |
medium | 6.5 | — | Redhat / build of keycloak | 2026-05-19 | 2026-10-29 |
| CVE-2024-0340 A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux... |
medium | 5.5 | — | Linux / linux kernel | 2024-01-09 | 2026-10-29 |
| CVE-2026-97320 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. |
medium | 6.3 | — | — | 2026-09-24 | 2026-10-29 |
| CVE-2026-117548 A NULL pointer dereference flaw was found in 389-ds-base. |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.