October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,304
Critical
3,140
High
7,177
Medium
6,986
Low
625
Severity not reported
4,376
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-22185 OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34,... |
not reported | — | — | — | 2026-01-07 | 2026-10-29 |
| CVE-2026-118245 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118249 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118253 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118261 Echo is a Go web framework. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105206 ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authori... |
not reported | — | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2025-34023 A path traversal vulnerability exists in the Karel IP1211 IP Phone's web managem... |
not reported | — | — | — | 2025-06-20 | 2026-10-29 |
| CVE-2025-34108 A stack-based buffer overflow vulnerability exists in the login functionality of... |
not reported | — | — | — | 2025-07-15 | 2026-10-29 |
| CVE-2025-34457 wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit... |
not reported | — | — | — | 2025-12-22 | 2026-10-29 |
| CVE-2025-34458 wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit... |
not reported | — | — | — | 2025-12-22 | 2026-10-29 |
| CVE-2025-25034 A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24... |
not reported | — | — | — | 2025-06-20 | 2026-10-29 |
| CVE-2024-58296 CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the... |
not reported | — | — | — | 2025-12-11 | 2026-10-29 |
| CVE-2024-58300 Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticat... |
not reported | — | — | — | 2025-12-11 | 2026-10-29 |
| CVE-2026-67203 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-67205 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116161 Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an informat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116165 Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing a... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-70387 Exposed dangerous method or function and Incorrect Authorization vulnerability i... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-59959 SAIL is a cross-platform library for loading and saving images with support for... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants t... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-59254 n8n before 2.28.1 contains an information disclosure vulnerability where externa... |
not reported | — | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-57203 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-58118 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-58119 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-58120 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-47235 SimulationCraft is a tool to explore combat mechanics in World of Warcraft. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116776 USB Test is a lightweight Windows CLI utility for verifying sector integrity and... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116796 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115775 Twisted is an event-based framework for internet applications, supporting Python... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-105923 A malicious SVG can trigger an integer overflow which in turn triggers a null-po... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-60111 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118664 decode-uri-component provides a more robust alternative to decodeURIComponent. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118668 langgraph-api implements the LangGraph API for rapid development and testing. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115567 Tokio is a runtime for writing applications with Rust. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115477 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116186 OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116162 Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire log... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-106036 Szafir accepts any client or server certificate without performing certificate a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112255 Initialization of a resource with an insecure default vulnerability in OpenText... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112256 Acceptance of extraneous untrusted data with trusted data vulnerability in OpenT... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.