October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116694 OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116675 TinyMCE is an open source rich text editor. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-113793 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111064 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-109823 An attacker can read the name of filesystem paths of your application present vi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118132 NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulner... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116683 CTFer.io's CTFd Terraform Provider manages CTFd resources as code. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118170 The strapi/review-workflows package is vulnerable to a broken access control vul... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118171 The strapi/content-manager package is missing content-scope authorization in the... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118172 The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118173 MISP Guard, a proxy that enforces security policies on MISP feed data, contained... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116695 Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specifi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-78661 When coalescing adjacent text nodes in addText and fosterParent, appending to an... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-97045 In childTextNodesAreLiteral, walking up the tree previously stopped at the neare... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-22063 The private keys of eight eMudhra intermediate CA certificates have been comprom... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-101272 The mechanism binding files generated during a shredding process to the authenti... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-101273 Some of our API endpoints allowed to create order payments referencing a gift ca... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-101274 When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105420 Wing FTP Server does not verify user's base folder. |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116078 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorr... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115402 OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cau... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-108014 Private keys for eight eMudhra intermediate CA certificates have been compromise... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108015 Private keys for eight eMudhra intermediate CA certificates have been compromise... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118131 GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discre... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115522 Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93517 A heap buffer overflow in handling GLX
RenderLarge request where dataBytes excee... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112945 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-111762 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-104383 Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquil... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104384 Insufficiently Protected Credentials in tunnel gateway and provisioning interfac... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102790 Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations exp... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102812 A hard-coded
cryptographic key vulnerability exists in the user-configuration ba... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102813 An authentication flaw exists in the password-recovery functionality of TP-Link... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102816 An authorization vulnerability exists in the country or region configuration int... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2025-64394 A vulnerability allowing a low-privileged local user to write arbitrary files wi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106076 A vulnerability allowing an authenticated organization-transfer peer to inject S... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.