October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,289
Critical
3,225
High
7,607
Medium
7,217
Low
653
Severity not reported
4,587
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112020 LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lod... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112030 A vulnerability was found in diem-project diem up to 5.1.3. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111986 A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.1... |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111991 A security vulnerability has been detected in WongKinYiu yolov9 0.1. |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111883 Locust through 2.46.7 contains a cross-site request forgery vulnerability that a... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerab... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111877 A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability i... |
medium | 6.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-98146 In the Linux kernel, the following vulnerability has been resolved:
accel/amdxd... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-55796 Frappe HR is an open-source human resources management solution (HRMS). |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111916 Admidio before 5.0.16 contains an information disclosure vulnerability that allo... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111921 Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability th... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111719 Roncoo-pay through commit 9428382 contains a missing authorization vulnerability... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111802 A flaw was found in Nautilus. |
medium | 6.6 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper aut... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecu... |
medium | 6.0 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111910 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorizatio... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111709 WhaTicket Community through commit cf04795 contains an insecure direct object re... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2024-58398 Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contai... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-87875 The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length... |
medium | 4.3 | — | — | 2026-09-09 | 2026-10-21 |
| CVE-2026-111689 Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that a... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111694 qKnow through 2.4.3 contains a missing authentication vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111699 Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111659 Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111664 Safing Portmaster before 2.2.5 contains a missing authorization vulnerability th... |
medium | 4.4 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111669 ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows a... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111674 Tbed through 20240319 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111679 Ekko Studio through 0.7.36 contains a missing authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111629 IoTSharp through 3.6.1 contains an insecure direct object reference vulnerabilit... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111649 Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object refer... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111654 FastBee through 2.1.0 contains an insecure direct object reference vulnerability... |
medium | 6.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111614 DataCap through 2025.1.1 contains an insecure direct object reference vulnerabil... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111619 FilePress through 3.0.1 contains an sql injection vulnerability that allows auth... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-112914 filelock is a platform-independent file lock for Python. |
medium | 5.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-101673 Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Busin... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101674 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101675 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.