October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,572
Critical
3,293
High
7,942
Medium
7,638
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-41114 Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-41216 An invalid pointer dereference vulnerability exists in the vtkPNGReader::Execute... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42057 An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGR... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-18147 A flaw was found in FreeIPA. |
high | 8.1 | — | — | 2026-09-09 | 2026-10-30 |
| CVE-2026-16445 A flaw was found in dracut. |
high | 7.5 | — | — | 2026-07-21 | 2026-10-30 |
| CVE-2026-19550 A flaw was found in FreeIPA. |
high | 8.2 | — | Redhat / enterprise linux | 2026-08-11 | 2026-10-30 |
| CVE-2026-19654 A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the op... |
high | 7.5 | — | Rsyslog / rsyslog | 2026-08-12 | 2026-10-30 |
| CVE-2026-16255 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 bef... |
high | 7.1 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-15816 A flaw was found in dracut. |
high | 7.5 | — | — | 2026-08-07 | 2026-10-30 |
| CVE-2026-13097 A privilege escalation flaw was found in FreeIPA. |
high | 8.7 | — | Redhat / enterprise linux | 2026-08-20 | 2026-10-30 |
| CVE-2026-119978 Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authen... |
high | 8.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116638 The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attac... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-118759 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115805 Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.2 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 8.2 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as im... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3... |
high | 7.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-110196 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107326 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107327 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107329 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-106781 An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-106972 An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-104594 libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-104324 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-101288 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2025-0326 The system fails to invalidate existing access tokens associated with sub-organi... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-63913 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
high | 8.2 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-114422 The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the cla... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114443 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plug... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117571 The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does n... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63914 In the Linux kernel, the following vulnerability has been resolved:
xfrm: route... |
high | 7.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-8822 A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functi... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-8824 A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInfo... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-9535 A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 func... |
high | 8.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-9536 A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader Find... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-63915 In the Linux kernel, the following vulnerability has been resolved:
nfc: hci: f... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63916 In the Linux kernel, the following vulnerability has been resolved:
HID: wacom:... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-119249 A malicious actor with access to the network could exploit a Binding to an Unres... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.