October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,717
Critical
3,173
High
7,271
Medium
7,122
Low
648
Severity not reported
4,503
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111320 ValueCell through 0.1.20 contains an unauthenticated server-side request forgery... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111321 TaskingAI through 0.3.0 contains a server-side request forgery vulnerability tha... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111330 JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability... |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111345 Trudesk through 1.2.11 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111346 ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111349 Craftplan through 0.7.5 contains a missing authorization vulnerability in the CR... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111350 Papermark through 0.22.0 contains a missing authorization vulnerability in the d... |
medium | 5.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111355 zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111358 SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulner... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111364 MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerabi... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111365 cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability t... |
medium | 6.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111368 ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerabi... |
medium | 6.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111728 Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93492 A flaw was found in Netty's HTTP/2 HpackEncoder. |
medium | 5.3 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-93579 A flaw was found in Netty's HTTP/2 stack. |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-89202 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85976 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-79715 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55154 EspoCRM is an open source customer relationship management application. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55842 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-19735 The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c deriv... |
medium | 4.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19740 The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bl... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-46694 EspoCRM is an open source customer relationship management application. |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-12272 The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for Word... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111387 Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111278 NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unaut... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111132 GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111142 Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mma... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111157 SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_a... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110888 Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Expl... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110775 Nexent through 2.7.0 contains a missing authorization vulnerability in check_fil... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110381 Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simpl... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109893 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110375 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109448 Integer wraparound in psqlODBC SQLBindParameter allows an application, or an att... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109143 A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109153 A vulnerability was detected in MosaicML Composer up to 0.32.1. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109160 A vulnerability was determined in PublicCMS up to 5.202608.a. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108924 A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103523 Thelia v2.6.0 contains an open redirect vulnerability in its address creation wo... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.