October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,572
Critical
3,293
High
7,942
Medium
7,638
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119250 A malicious actor with local access and low privileges could exploit an External... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-104615 A security vulnerability was discovered in SUSE Rancher Fleet's cluster registra... |
high | 7.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63917 In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: U... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63967 In the Linux kernel, the following vulnerability has been resolved:
iio: imu: s... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63968 In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix p... |
high | 7.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-118758 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118782 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93289 The affected products are vulnerable to command injection attack that could allo... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-92390 When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
docu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92391 A deeply nested multipart MIME structure constructed via the public API causes
a... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s
`CURLINFO_EF... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92092 A flaw was found in openshift-ansible. |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-78066 Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-79704 An out-of-bounds read vulnerability exists in the streaming RPC client of Apache... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-74758 A heap use-after-free in the RTMP protocol component of Apache bRPC (versions <... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78048 A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78058 Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56836 PraisonAI is a multi-agent teams system. |
high | 8.2 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-57146 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-61671 WeGIA is a web manager for charitable institutions. |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-56832 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-42009 A flaw was found in gnutls. |
high | 7.5 | — | Gnu / gnutls | 2026-05-18 | 2026-10-30 |
| CVE-2026-39910 STACKIT IaaS API contains a missing authorization check in the PUT servers servi... |
high | 8.8 | — | — | 2026-06-08 | 2026-10-30 |
| CVE-2026-119654 DataCap through 2025.1.1 contains a missing authorization vulnerability that all... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-15555 A flaw was found in JBoss marshalling. |
high | 8.8 | — | — | 2026-08-11 | 2026-10-30 |
| CVE-2026-119283 joserfc is a Python library that provides an implementation of several JSON Obje... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119290 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116622 The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118238 The Tenda W18E web management server is vulnerable to OS command injection via t... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108762 Path-confinement bypass during metadata backup deletion in Apache Kylin. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl
send... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is
se... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.