October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118760 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2025-12523 Broken Object Level Authorization in Users Configuration Endpoint allows Informa... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-90871 Improper limitation of a pathname to a restricted directory in Progress Software... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-90872 Improper neutralization of directives in dynamically evaluated code in the Manag... |
medium | 6.6 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90991 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-90861 Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windo... |
medium | 6.6 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90862 Improper authentication in the Web Transfer Module of Progress Software WS_FTP S... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-88090 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-88078 Improper verification of cryptographic signature in Microsoft Edge (Chromium-bas... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85330 Incorrect authorization in Microsoft Edge for Android allows an unauthorized att... |
medium | 4.3 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-84296 Multi-Factor Authentication Bypass vulnerability in SSH component in Progress So... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-77817 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-77819 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-54865 Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42690 Subscriber Broken Access Control in LearnPress |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42694 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-20942 Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119137 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119138 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover asser... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119140 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119141 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119131 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119132 Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability th... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps com... |
medium | 6.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119135 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host read... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119136 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient che... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119124 ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-10-29 | 2026-10-31 |
| CVE-2026-119118 Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119121 Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability i... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119122 Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118084 Subscriber Insecure Direct Object References (IDOR) in Hotel Booking |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116848 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-113576 Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a... |
medium | 6.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110192 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110200 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.