October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,651
Critical
3,234
High
7,687
Medium
7,337
Low
703
Severity not reported
4,690
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116801 Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate th... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-41022 Eaton easySoft improperly validates TLS certificates presented by easyE4 devices... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-10537 A misconfiguration issue in the affected service in Control-M/Enterprise Manager... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117557 SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read v... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116840 llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-105006 Use after free in HID class driver allows an unauthorized attacker to elevate pr... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-65210 This issue may allow an authenticated IPMI Administrator to read arbitrary files... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65213 This issue may allow an IPMI authenticated administrator to execute commands as... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 by... |
medium | 6.5 | — | Php / php | 2026-09-25 | 2026-10-27 |
| CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-pr... |
medium | 5.9 | — | Php / php | 2026-09-25 | 2026-10-27 |
| CVE-2026-100749 Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gall... |
medium | 4.3 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-27 |
| CVE-2026-116826 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in Dup... |
medium | 6.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116822 YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116813 OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionServ... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116809 OpenPanel before 3.0.0 contains a missing authorization vulnerability in the eve... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116805 OpenPanel before 3.0.0 contains an information disclosure vulnerability that all... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116746 QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in th... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116604 A vulnerability has been found in SourceCodester Online Food Ordering System 1.0... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116515 A security vulnerability has been detected in itsourcecode Online Book Store 1.0... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116507 A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-115927 Tornado is a Python web framework and asynchronous networking library. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-76654 An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied... |
medium | 5.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116802 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116879 Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vuln... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116882 Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116883 Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116886 Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116887 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability t... |
medium | 4.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117533 REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerab... |
medium | 4.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117537 REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability tha... |
medium | 4.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116895 REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116899 REDAXO before 5.21.4 contains a broken access control vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117534 REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117538 REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in... |
medium | 4.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116631 A malicious web page could open a tel link in a window that was showing a differ... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116632 A malicious web page could insert arbitrary text into the FaceTime call prompt s... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-117468 Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not e... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117469 Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the directio... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.