October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,304
Critical
3,140
High
7,177
Medium
6,986
Low
625
Severity not reported
4,376
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114251 A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114437 In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forw... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106575 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-112936 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-83774 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-112937 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112939 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-21 |
| CVE-2026-83870 Out-of-bounds read in Windows Aggregated Data Platform Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-93744 IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to by... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-87800 IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-114105 Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability t... |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114075 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that al... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114080 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerabil... |
medium | 5.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114095 Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114065 Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that a... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114039 A weakness has been identified in projectworlds Advanced Library Management Syst... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113710 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113740 A flaw has been found in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113680 HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerabi... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113656 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113661 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113598 Modoboa before 2.8.0 contains an insecure direct object reference vulnerability... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113603 The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 Py... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113608 Configurable Reports block for Moodle (moodle-block_configurablereports) before... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113505 A flaw has been found in aaPanel up to 8.25.0. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113652 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.6 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113359 Baserow before 2.3.0 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112952 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112957 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-106577 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-83854 Improper access control in Windows Notification allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-107389 music-metadata is a metadata parser for audio and video media files. |
medium | 5.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-21 |
| CVE-2026-83864 Improper access control in Windows NTFS allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83865 Relative path traversal in Windows Internet (wininet.dll) allows an authorized a... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smar... |
medium | 5.9 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-94184 A stack-based buffer overflow flaw was found in fetchmail when built with NTLM s... |
medium | 5.3 | — | — | 2026-09-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.