October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111730 P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckP... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111731 P-Net before 1.0.3 enters an infinite loop when handling a read request for the... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111732 P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111733 P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111734 P-Net before 1.0.3 does not validate the length of a received Ethernet frame in... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111735 P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111736 P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RP... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93570 Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injec... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93571 Szafir is vulnerable to Path Traversal in the uploaded filename. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-57448 Blombooru is a self-hosted personal booru for organizing and tagging private ima... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-79589 The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure acc... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107014 Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow una... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107016 Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107018 Insecure permissions in Ghost Commander File Manager versionCode 479 allows unau... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107019 Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterf... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107021 Insecure permissions in the CardProvider content provider component of helloworl... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107024 Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93903 LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect UR... |
not reported | — | — | — | 2026-09-30 | 2026-10-29 |
| CVE-2026-118662 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118669 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118426 In affected versions of Octopus Server with the LDAP authentication provider ena... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-7190 A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5697 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5698 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5699 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5700 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113688 Server-side request forgery in the SmartIT URL-based attachment feature of BMC I... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113689 Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113690 Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113691 Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT S... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113692 Path traversal in the SmartIT file-management feature of BMC IT Service Manageme... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113693 Exposure of sensitive information in the SmartIT system-account settings of BMC... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113694 Improper authorization in the SmartIT user attachment feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113695 Reflected cross-site scripting in the SmartIT inline-image attachment feature of... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113696 Improper authorization in the SmartIT change approval feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113697 Reflected cross-site scripting in the agent query feature of BMC Helix Operation... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-16889 In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66088 In openEQUELLA before 2026.1, the system.execute() function available to the scr... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.