October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,731
Critical
3,174
High
7,275
Medium
7,124
Low
648
Severity not reported
4,510
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111703 yshop-crm through 2.1.3 contains an insecure direct object reference vulnerabili... |
medium | 6.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111718 AipexBase through commit 690adb9 contains a sql injection vulnerability that all... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111632 Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that all... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111637 NexoPOS through 6.2.4 contains a missing authentication vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111647 PickMall lilishop through 5.0.0 contains an insecure direct object reference vul... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111652 Engineercms through 2.0.5 contains a missing authorization vulnerability in Atta... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111657 BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerab... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111662 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that... |
medium | 5.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111284 Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111392 SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111617 WHartTest through 2.8.1 contains a missing authentication vulnerability that all... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111622 smart-sso through 2.1.1 contains an open redirect vulnerability in the /login ha... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111252 A denial of service vulnerability exists in the XML parsing of multiple versions... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111273 unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109838 IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive informat... |
medium | 5.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107851 Contao is an Open Source CMS. |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107854 Jexactyl is a customisable game management panel and billing system. |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-104774 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-41504 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-41508 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-97691 Convex is an open-source reactive database for application developers. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-41210 Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-53922 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-94410 A low privileged remote attacker is able to view a list of roles that should onl... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102342 ammonia is a Rust library for repairing and securing untrusted HTML. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102734 asteval is a Python expression evaluator designed for restricted execution. |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85733 FrankenPHP is a modern application server for PHP. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-62858 YOURLS is a self-hosted, customizable URL shortener written in PHP. |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103974 lichess.org is the forever free, adless and open source chess server. |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55414 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55875 Helium is a free online student planner for classes, homework, grades, and notes... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55871 GYM One is open-source gym management software for fitness centers, personal tra... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-94621 AliasVault is a privacy-first password manager with built-in email aliasing. |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109118 Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticate... |
medium | 4.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105664 The endpoint exposes an observable response discrepancy when processing ID value... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-90821 An input neutralization vulnerability in the Webhook URL form field component of... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97858 An attacker can cause the server to unbind the target device from its current ow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-54657 Open Zaak is an open-source data and services layer for Dutch case-oriented work... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-55836 Open Zaak is an open-source data and services layer for Dutch case-oriented work... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.