October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,583
Critical
3,295
High
7,975
Medium
7,639
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112111 The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stor... |
not reported | — | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112112 An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon al... |
not reported | — | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111997 ip-address before 10.7.4 allows a denial of service (CPU consumption from quadra... |
not reported | — | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-102503 Missing Authentication for Critical Function (CWE-306) and Missing Authorization... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-103091 Missing Authorization (CWE-862) and Initialization of a Resource with an Insecur... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-8168 Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSv... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108120 Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerabilit... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108121 Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-13695 SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in t... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111065 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111748 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-64944 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-64945 A vulnerability in Apache Answer. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-76994 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-79613 vulnerability in Apache Answer. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-79620 Exposure of sensitive information through data queries vulnerability in Apache A... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-79624 Insufficient session expiration vulnerability in Apache Answer. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-79633 vulnerability in Apache Answer. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108823 Exposure of Sensitive Information to an Unauthorized Actor during job manipulati... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108833 Default startup profile miss security settings in Apache Kylin. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108837 Allocation of resources without limits or throttling vulnerability in Apache Kyl... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-107354 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107355 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-62171 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-108979 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-93483 In Znuny through 7.3.6, an attacker can bypass specific standard login procedure... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-112179 In MISP, the event synchronization process contained a logic error in the prepar... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2025-3778 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-112178 MISP contains an access control flaw in the proposal (shadow attribute) visibili... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112180 MISP contains a data integrity flaw in its event deletion logic. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112183 MISP contains a CSS injection vulnerability in the remote event preview feature. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112184 MISP contains a reflected cross-site scripting (XSS) vulnerability in the workfl... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111046 FOSSBilling is an open source billing and client-management platform. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111053 FOSSBilling is an open source billing and client-management platform. |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-98654 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-90050 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90052 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-98165 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-107194 Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account t... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.