October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,596
Critical
3,297
High
7,980
Medium
7,645
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-20585 Insufficient checks of the RMP on host buffer access in IOMMU may allow an attac... |
not reported | — | — | — | 2026-04-16 | 2026-10-28 |
| CVE-2023-31309 Improper validation in Power Management Firmware (PMFW) may allow an attacker wi... |
not reported | — | — | — | 2026-05-15 | 2026-10-28 |
| CVE-2023-31316 Improperly preserved integrity of hardware configuration state during a power sa... |
not reported | — | — | — | 2026-05-15 | 2026-10-28 |
| CVE-2023-31317 Improper restriction of operations within the bounds of a memory buffer in the A... |
not reported | — | — | — | 2026-05-15 | 2026-10-28 |
| CVE-2026-116794 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114125 Storybook is a frontend workshop for building user interface components and page... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-57190 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57189 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116694 OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116675 TinyMCE is an open source rich text editor. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-113793 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113789 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111064 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-109823 An attacker can read the name of filesystem paths of your application present vi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116677 OpenWISP Controller is a network and WiFi controller for provisioning, configura... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118132 NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulner... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116683 CTFer.io's CTFd Terraform Provider manages CTFd resources as code. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118170 The strapi/review-workflows package is vulnerable to a broken access control vul... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118171 The strapi/content-manager package is missing content-scope authorization in the... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118172 The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118173 MISP Guard, a proxy that enforces security policies on MISP feed data, contained... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116695 Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specifi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-78661 When coalescing adjacent text nodes in addText and fosterParent, appending to an... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-97045 In childTextNodesAreLiteral, walking up the tree previously stopped at the neare... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-22063 The private keys of eight eMudhra intermediate CA certificates have been comprom... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-101272 The mechanism binding files generated during a shredding process to the authenti... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-101273 Some of our API endpoints allowed to create order payments referencing a gift ca... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-101274 When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105420 Wing FTP Server does not verify user's base folder. |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116078 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorr... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115402 OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cau... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-108014 Private keys for eight eMudhra intermediate CA certificates have been compromise... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108015 Private keys for eight eMudhra intermediate CA certificates have been compromise... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118131 GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discre... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115522 Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93517 A heap buffer overflow in handling GLX
RenderLarge request where dataBytes excee... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112945 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-111762 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.