October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116876 Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vu... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116872 Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vu... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116748 Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in hand... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116811 OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116816 llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116623 A vulnerability was detected in code-projects Simple Content Management System 1... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116581 Seroval facilitates JavaScript value stringification, including complex structur... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116724 FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::l... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116755 Improper Neutralization of Special Elements used in a Command ('Command Injectio... |
high | 7.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-116257 A vulnerability was determined in BillaBear up to 2025.01.03. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116260 A weakness has been identified in libimobiledevice up to 1.4.0. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in... |
high | 7.2 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-112343 Syncplify Server! |
high | 8.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115924 Rembg is a tool to remove images background. |
high | 8.6 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116230 A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24... |
high | 7.8 | — | Ndemiccreations / plague inc | 2026-10-26 | 2026-10-31 |
| CVE-2026-116236 A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. |
high | 7.2 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-111578 The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 be... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-96192 Use after free in Microsoft Edge for iOS allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-119187 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | Digitalbazaar / forge | 2026-10-29 | 2026-10-31 |
| CVE-2026-119191 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | Digitalbazaar / forge | 2026-10-29 | 2026-10-31 |
| CVE-2026-110083 Adobe Experience Manager is affected by an Improper Neutralization of Special El... |
high | 7.1 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-110084 Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Inject... |
high | 7.1 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-78527 Contributor PHP Object Injection in GS Testimonial Slider |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Point... |
high | 8.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Point... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62847 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-28160 Unauthenticated Cross Site Scripting (XSS) in VikRentCar |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-48201 Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-14474 A flaw was found in SSSD's LDAP sudo provider. |
high | 8.8 | — | — | 2026-07-07 | 2026-10-30 |
| CVE-2026-14476 A path traversal flaw was found in SSSD's AD GPO provider. |
high | 8.0 | — | — | 2026-07-07 | 2026-10-30 |
| CVE-2026-116401 Unauthenticated Broken Access Control in HUSKY |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119331 Ladybird is a truly independent web browser. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119336 Pi-hole is a DNS sinkhole that protects devices from unwanted content without in... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-85893 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / edge chromium | 2026-09-15 | 2026-10-30 |
| CVE-2026-81396 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-78524 Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-73013 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.