October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113620 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upg... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113390 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113391 A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113399 Incorrect boundary conditions in the SVG component. |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113389 A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set s... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86868 An authentication issue was addressed with improved state management. |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-77936 Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that a... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-77932 DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77933 DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-109442 piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-109444 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability th... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-109395 Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerabi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112371 A vulnerability was determined in H3C Magic NX15 NX15V100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112370 A vulnerability was found in H3C Magic NX15 100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112900 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112398 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112403 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112393 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
| CVE-2026-112779 Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t... |
critical | 9.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-109437 Cognition before 0.13.0 contains an unauthenticated remote code execution vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-12665 IBM MQ could allow a remote attacker to execute arbitrary code due to a stack bu... |
critical | 9.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-111862 Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a su... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107188 A user can upload export reports with any file contents and specify any contents... |
critical | 9.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107083 SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111057 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 10.0 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-111058 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109432 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression i... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST par... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112292 CheckCle through 1.6.0 contains a missing authorization vulnerability that allow... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-71253 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-90910 Missing authentication for critical function vulnerability in Apache Answer. |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Ligh... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110887 Improper Control of Generation of Code ('Code Injection') vulnerability in HiveP... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.