October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79882 There is a command injection vulnerability in the PAPI protocol of AOS-10 that c... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79883 A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 co... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79884 A vulnerability in the web-based management interface of AOS-8 could allow an un... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79877 A remote code execution vulnerability in the underlying operating system of AOS-... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79878 A command injection vulnerability in the AOS-8 command line interface accessed b... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79879 Memory corruption vulnerabilities in the affected interface of AOS-10 could lead... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79880 A vulnerability in the command line interface of AOS-8 could allow an authentica... |
high | 8.7 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79881 An authentication bypass vulnerability in the underlying operating system of AOS... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-78402 Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sent... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62331 praktor is a multi-agent Claude Code orchestrator with Telegram input and output... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59387 The Nginx routing configuration for Cloud Controller blocks unauthenticated acce... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59978 AdminNeo is a full-featured database management tool written in PHP. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119335 Pi-hole is a DNS sinkhole that protects devices from unwanted content without in... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119332 Ladybird is a truly independent web browser. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119333 draw.io Desktop is the official Electron build of draw.io. |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119116 A use-after-free and double-free issue in the SetClient command handler of the k... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key... |
high | 8.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116243 pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a u... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116244 When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated cre... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116247 When a server in pgAdmin 4 had no password file, client certificate or client ke... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same... |
high | 8.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116242 pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS fail... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115419 The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 a... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114510 Flexible GraphRAG is a Python framework for building graph and retrieval-augment... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114622 baserCMS is a website development framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-113264 Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-30 |
| CVE-2026-114123 D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114136 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-112677 An authorization issue was addressed with improved access control. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-106763 An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to e... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-100517 Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for Wo... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-30 |
| CVE-2026-101410 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101431 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-107044 Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows un... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107047 Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized at... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107049 An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change an... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.