October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,234
High
7,703
Medium
7,358
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58119 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-58120 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-47235 SimulationCraft is a tool to explore combat mechanics in World of Warcraft. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116776 USB Test is a lightweight Windows CLI utility for verifying sector integrity and... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116796 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115775 Twisted is an event-based framework for internet applications, supporting Python... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-105923 A malicious SVG can trigger an integer overflow which in turn triggers a null-po... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-60111 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118664 decode-uri-component provides a more robust alternative to decodeURIComponent. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118668 langgraph-api implements the LangGraph API for rapid development and testing. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115567 Tokio is a runtime for writing applications with Rust. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115477 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116186 OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116162 Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire log... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-106971 An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpa... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-106036 Szafir accepts any client or server certificate without performing certificate a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107027 Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unau... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107033 Insecure permissions in the MirakelInternalContentProvider component of Mirakel... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107038 Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows una... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107040 Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112255 Initialization of a resource with an insecure default vulnerability in OpenText... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112256 Acceptance of extraneous untrusted data with trusted data vulnerability in OpenT... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118673 KeePassXC is a cross-platform community-driven port of the Windows application K... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66911 Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Locati... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66912 Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email hea... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived f... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115795 P-Net before 1.0.3 does not check that a complete block header is present in the... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111730 P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckP... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111731 P-Net before 1.0.3 enters an infinite loop when handling a read request for the... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111732 P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111733 P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111734 P-Net before 1.0.3 does not validate the length of a received Ethernet frame in... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111735 P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111736 P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RP... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93570 Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injec... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93571 Szafir is vulnerable to Path Traversal in the uploaded filename. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107016 Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107021 Insecure permissions in the CardProvider content provider component of helloworl... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.