October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107265 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107259 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107261 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107262 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem al... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107263 Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107258 Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107257 Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsi... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107254 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107252 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107253 Vulnerability in Drupal Orphans Media. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107250 Vulnerability in Drupal ECA Helper. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107251 Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-76027 Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowe... |
medium | 4.3 | — | Google / chrome | 2026-10-30 | 2026-10-30 |
| CVE-2026-119272 Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-30 | 2026-10-30 |
| CVE-2026-76024 Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-30 | 2026-10-30 |
| CVE-2026-118947 A flaw was found in the UMA resource registration endpoint of the keycloak-servi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118959 A flaw was found in the required action provider mechanism of Keycloak. |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110133 A flaw was found in Ghostscript. |
medium | 5.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119285 Fiber is an Express inspired web framework written in Go. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119317 On Linux, an authenticated, low-privileged Nessus user with scan-creation rights... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119278 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119281 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Pypdf Project / pypdf | 2026-10-29 | 2026-10-31 |
| CVE-2026-119210 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119201 Nuxt is an open-source web development framework for Vue.js. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119198 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119199 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119186 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119251 A malicious actor with local access and high privileges could exploit an Imprope... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118777 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118778 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118766 Botan is a C++ cryptography library. |
medium | 6.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118767 Botan is a C++ cryptography library. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-102260 HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authoriza... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.