October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,410
Critical
3,098
High
6,954
Medium
6,692
Low
597
Severity not reported
4,069
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (671), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92744 Under certain conditions, privilege manager agent allows a remote unauthenticate... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-109821 Improper Validation of Specified Quantity in Input vulnerability in the Elixir s... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115274 Improper Validation of Specified Quantity in Input vulnerability in the Elixir s... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97209 Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a l... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22105 Delta UFC500 charging stations derive the default credentials of the Service acc... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22109 The shipped WebUI template database retains the factory default passwords for al... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22110 The web server does not check authentication on POST or PUT. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22114 HTTP basic auth enforces no retry limit or backoff. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-87768 DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Al... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117182 An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddab... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39375 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61803 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61806 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61848 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 sp... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publis... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118765 Botan is a C++ cryptography library. |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118769 Botan is a C++ cryptography library. |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118773 Glob matches files using patterns the shell uses. |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2023-22793 A vulnerability allowing an unauthenticated attacker to perform remote code exec... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107238 A vulnerability allowing an authenticated domain user to perform remote code exe... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107239 A vulnerability allowing a member of the Veeam Virtualization Extensions Users g... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116366 An issue has been discovered in ClickHouse Server that, under certain conditions... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-85268 A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Googl... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-75882 An improper access control vulnerability in ESET Endpoint Encryption and ESET Fu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117350 Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119680 A stored cross-site scripting (XSS) vulnerability exists in the chart feature of... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119682 An improper access control vulnerability exists in the multi-factor authenticati... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-93327 A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Goo... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105454 RT's automatic link creation for URLs in HTML ticket content does
not HTML-esca... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105455 RTIR's ticket creation forms show the subject of the related
ticket when splitt... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105456 RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107255 Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forc... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107256 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107260 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107266 Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsi... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108099 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108514 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.