October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,416
Critical
3,147
High
7,191
Medium
7,019
Low
631
Severity not reported
4,428
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93865 A missing authentication vulnerability in the Fireware OS FireCluster synchroniz... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-91093 A potential security vulnerability has been identified in HP One Agent for certa... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-90465 A missing authentication vulnerability in the FireCluster Sync processing allows... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-103593 A stack-based buffer overflow vulnerability in the Fireware OS logging service a... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102815 An
operating-system command injection vulnerability exists in the tmpServer
serv... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102814 An
authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE30... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-117174 Rejected reason: VUL-2026-008368 為先回報之相同問題 |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86018 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57210 Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-93862 An out-of-bounds read vulnerability in the FireCluster Sync processing allows an... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-57184 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-111478 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111486 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111575 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-77468 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-4950 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4951 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4952 The "ASMobile" web interface, which is part of the VertiGIS software package "GI... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114355 OS command injection in the root-privileged 'hardware_monitor' helper in DJI Cry... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114356 Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114357 Missing authentication for a critical function in the Android Debug Bridge daemo... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-112188 MISP contains a vulnerability in its server settings lookup mechanism that allow... |
not reported | — | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-114353 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant'... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114354 Missing authorization in the native binder service 'android.dji.server' (transac... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30049 The CGM CLININET application stores user passwords as unsalted MD5 hashes. |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30050 CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which d... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30051 The CGM CLININET application stores the production database login and password,... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30052 The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass vi... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30053 The CGM CLININET application runs the cgm-updater process listening on an open n... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30054 CGM CLININET is vulnerable to local privilege escalation. |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-58403 CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improp... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30043 CGM CLININET is vulnerable to Missing Authentication for Critical Function in th... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30045 CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which pro... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30046 In the CGM CLININET application server, multiple processes responsible for HL7 c... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30047 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-55543 TuxGuitar is an open-source guitar tablature editor. |
not reported | — | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-114509 Laravel is a web application framework. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114142 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2023-53693 In the Linux kernel, the following vulnerability has been resolved:
USB: gadget... |
not reported | — | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53694 In the Linux kernel, the following vulnerability has been resolved:
riscv: ftra... |
not reported | — | — | — | 2025-10-22 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.