October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107052 Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead v... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107055 Insecure permissions in the autosave component of AppML neutriNote CE versionCod... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118763 sigstore-js provides JavaScript libraries for interacting with Sigstore services... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-11587 SQL injection allowing an authenticated user with access to ACL management to re... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-51905 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-86715 Plaintext storage of a password vulnerability in Crypttech Crypto and Informatic... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61804 myTinyWMS is a free, open-source warehouse management system. |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107347 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118772 joi is a schema description language and data validator for JavaScript. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-13303 HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side reque... |
high | 8.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-45049 Open Access Management (OpenAM) is an access management solution. |
high | 8.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-46560 Open Access Management (OpenAM) is an access management solution. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119325 Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken acc... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119409 OPNsense before 26.7.8 contains a command injection vulnerability that allows au... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119420 Lago through 1.55.0 contains an authentication bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112347 Kirki plugin for WordPress before 6.4.1 contains a broken object-level access co... |
high | 7.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2010-20125 DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119662 Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104061 Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the sc... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104062 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT i... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104064 Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdata... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104065 Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the import... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104066 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PI... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104067 Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in th... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119707 SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119710 PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerab... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119716 pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compile... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119717 pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compil... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119760 sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in reso... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to 5e64332464... |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119620 A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e643... |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.