October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,731
Critical
3,174
High
7,275
Medium
7,124
Low
648
Severity not reported
4,510
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50215 A use-after-free exists in the Windows WFP packet-capture driver shipped with Ak... |
medium | 4.4 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-103294 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
medium | 5.9 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-88833 A flaw was found in BusyBox's udhcpc DHCP client. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-49264 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54086 SLE API for Java is an implementation of CCSDS Space Link Extension Services. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110221 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110226 QloApps through 1.7.0 contains a broken access control vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulner... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110113 PublicCMS through V6.202608.a contains an insecure direct object reference vulne... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110118 WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability th... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102981 Plane is an open-source project management tool. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104126 JumpServer is an open source bastion host and an operation and maintenance secur... |
medium | 6.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110101 Koillection through 1.8.4 contains a stored cross-site scripting vulnerability t... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-93346 Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the ge... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77361 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111716 Arkon through 0.9.2 contains a broken access control vulnerability that allows a... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111721 Open WES through 1.0.0 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111666 Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnera... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111676 Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111696 data-platform-open through commit efeacd3 uses a hardcoded, publicly known defau... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111621 TDuck Survey Form through 5.3 contains a missing authorization vulnerability tha... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111631 Distributor before 2.3.2 contains a missing authorization vulnerability that all... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111646 SurveyKing before 1.13.0 contains a missing authorization vulnerability that all... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111651 Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111656 ChatWiki through 2.9.6 contains an insecure direct object reference vulnerabilit... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111661 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109957 EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111611 roncoo-education through 25.0.0-RELEASE contains an insecure direct object refer... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111616 Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability i... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109149 A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109156 A vulnerability has been found in SeldonIO MLServer up to 1.6.1. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109190 A vulnerability has been found in conductor-oss conductor 3.31.2. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111688 Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that a... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110816 ### Summary
`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Canno... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107348 Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBounce... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105760 vLLM is an inference and serving engine for large language models. |
medium | 5.3 | — | Vllm / vllm | 2026-10-05 | 2026-10-16 |
| CVE-2026-111682 EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that all... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerabili... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.