October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,606
Critical
3,110
High
6,989
Medium
6,776
Low
599
Severity not reported
4,132
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107309 Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Br... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107311 Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Per... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107306 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-95117 Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote a... |
low | 3.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-115569 Fallow is a codebase intelligence tool for TypeScript and JavaScript. |
low | 3.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-114555 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-100355 Campfire is a web-based chat application. |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119548 Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119567 vsftpd through 3.0.5 contains an access control bypass vulnerability that allows... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-21811 HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclo... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2012-5605 A flaw was found in Grinder, a component of Red Hat CloudForms. |
low | 3.3 | — | Redhat / cloudforms | 2013-01-04 | 2026-10-30 |
| CVE-2026-119417 CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-87096 Sensitive information disclosure and manipulation due to improper authorization... |
low | 3.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-59385 A user with SpaceDeveloper privileges could modify the URL of a space-scoped bro... |
low | 2.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118781 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
low | 2.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119280 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118475 A flaw was found in Eye of GNOME. |
low | 3.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-101209 Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Requ... |
low | 2.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54238 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSock... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-119602 libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerab... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119570 Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112922 A flaw was found in Ghostscript. |
low | 3.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-101415 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
low | 3.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-30 |
| CVE-2026-101779 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
low | 2.7 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-114721 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actio... |
low | 3.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-108518 DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when... |
low | 2.9 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2024-42155 In the Linux kernel, the following vulnerability has been resolved:
s390/pkey:... |
low | 1.9 | — | Linux / linux kernel | 2024-07-30 | 2026-10-30 |
| CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing c... |
low | 3.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-85498 A flaw was found in polkit. |
low | 3.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93586 ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulne... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-93587 ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-86422 ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability i... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-86424 ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (... |
low | 2.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-61871 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON dec... |
low | 3.7 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-61872 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF enc... |
low | 2.5 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-61862 ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vul... |
low | 2.9 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-61864 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transf... |
low | 2.9 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-61865 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough li... |
low | 2.9 | — | — | 2026-07-15 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.