October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,087
Critical
3,247
High
7,734
Medium
7,399
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-49868 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-26846 Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 a... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111375 FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in... |
critical | 9.1 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111281 Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a re... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-57496 NetLicensing MCP Server is a natural-language interface that enables agentic app... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-102182 A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-71253 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107188 A user can upload export reports with any file contents and specify any contents... |
critical | 9.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-97162 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extens... |
critical | 9.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-109442 piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113703 SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its l... |
critical | 9.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-97163 Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP pl... |
critical | 9.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-109395 Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerabi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77936 Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113620 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upg... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting H... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112371 A vulnerability was determined in H3C Magic NX15 NX15V100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-113389 A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113391 A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113506 A vulnerability has been found in aaPanel up to 8.25.0. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-35561 Insufficient authentication security controls in the browser-based authenticatio... |
critical | 9.8 | — | Amazon / athena odbc | 2026-04-03 | 2026-10-20 |
| CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110757 Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing str... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110759 Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-108709 Authentication bypass within in-house network in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-75994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-102210 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-79608 The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to bet... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-68573 Improper Authentication vulnerability in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-107460 Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-64610 Deserialization of Untrusted Data vulnerability in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-63619 Missing Authorization vulnerability in Apache Kylin. |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-109437 Cognition before 0.13.0 contains an unauthenticated remote code execution vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set s... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-64959 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.