October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,478
Critical
1,340
High
5,869
Medium
6,255
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82416 FrankenPHP is a modern application server for PHP. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85990 Leantime is an open source project management system. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-61642 Squid is a caching proxy for the Web. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54640 OpenRemote is an open-source internet-of-things platform. |
high | 7.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54641 OpenRemote is an open-source internet-of-things platform. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110128 fuint through commit 4c4bc8a contains a missing authentication vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110124 FastBee through 2.1.0 contains an insecure direct object reference vulnerability... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110119 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerabi... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110115 Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal v... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110108 MateCloud through 5.0.8 contains a missing authorization vulnerability that allo... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110097 Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110102 Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109620 A vulnerability has been found in SourceCodester Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109606 A vulnerability was detected in SourceCodester Art Gallery Management System 1.0... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109607 A flaw has been found in SourceCodester Online Exam System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xt... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103030 Dio is a powerful HTTP client for Dart and Flutter. |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-79609 XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-57... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-79610 XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-55376 Heym builds and runs agentic systems and business-process automations on self-ho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110025 A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109525 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109605 A security vulnerability has been detected in SourceCodester Simple Cafe Billing... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability |
high | 8.6 | Listed | Ivanti / Connect Secure | 2026-10-13 | 2026-10-13 |
| CVE-2026-102699 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102702 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-95114 libwebsockets contains an out-of-bounds read vulnerability in the LEJP increment... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95115 Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote att... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95121 An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95122 mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::Genera... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95124 Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95127 An issue in libass v.0.17.5 allows a remote attacker to cause a denial of servic... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-65198 Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both au... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-53418 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for An... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53420 Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an u... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-11731 An authentication bypass vulnerability in the listed NETGEAR RAX series models a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11732 An insufficient input validation vulnerability in the website blocking feature (... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109521 A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.