October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,583
Critical
3,295
High
7,975
Medium
7,639
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105987 KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116671 Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progressi... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116588 Datadog dd-trace-py is the Datadog Python APM client. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116591 compress provides various compression algorithms. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-88781 Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a ker... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-101034 An attacker who obtained the hardcoded key could decrypt domain/service account... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the req... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-114409 Docker Desktop before version 4.97.0 could write third-party API keys and OAuth... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116627 Improper neutralization of input during web page generation ('Cross-site Scripti... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116583 Seroval facilitates JavaScript value stringification, including complex structur... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-57187 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-57196 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-111459 An improper certificate validation vulnerability exists in Moxa Remote Connect S... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111460 A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Ser... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111461 An OS command injection vulnerability exists in OnCell G3150A-LTE Series. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-102787 Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-102789 Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controlle... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-85299 A Missing Authorization vulnerability in the disks.createSnapshot and regionDisk... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111548 A stack-based buffer overflow vulnerability exists in the web management interfa... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116870 In affected versions of Octopus Server, OIDC token issuer validation was perform... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117341 In affected versions of Octopus Server, creating a user invitation writes the in... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117466 In affected versions of Octopus Server, a user holding the System Manager role c... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-102800 Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulA... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-12887 In affected versions of Octopus Server, a user with permission to upload a malic... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-107145 The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-107146 The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persi... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-107147 The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentic... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-105946 Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-107472 An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-107590 An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding o... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117493 Stored cross-site scripting (XSS) in BloX widgets. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117494 Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-4337 Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT app... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-104593 osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_nam... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104597 libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initializat... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104598 libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65625 The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bl... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.