October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118687 Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118680 SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespac... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118677 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulne... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118265 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118640 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118259 opentelemetry-java is the Java implementation of the OpenTelemetry API for recor... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-106484 Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-58458 Don't Starve Together (Steam AppID 322330) through build 747465 contains a memor... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shi... |
medium | 6.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110181 PostgreSQL Anonymizer contains a vulnerability related to anonymization function... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110182 PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110183 PostgreSQL Anonymizer contains a vulnerability related to static masking and sta... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105620 PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105613 PostgreSQL Anonymizer's range-based dummy functions dont constraint the range si... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105614 PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105616 PostgreSQL restricts acces to the salt and shift via the `SHOW` command for user... |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105617 PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added o... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105618 PostgreSQL Anonymizer's documentation recommends applying rules on partitions an... |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105619 PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93536 A use after free caused by missing lifecycle management of gesture sprites in Ge... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88858 A user with the Viewer role in Grafana can crash the server by submitting a craf... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-82962 ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethe... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118609 Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remo... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118611 Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118601 Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118604 Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execut... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118607 Alpine iLX-F511 diagapp Command Injection Vulnerability. |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118581 A BSON encoding component of the MongoDB Java Driver does not verify that an ext... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103404 An Incorrect Permission Assignment for Critical Resource vulnerability in Routin... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103405 An Improper Neutralization of Special Elements in Output Used by a Downstream Co... |
medium | 5.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103400 An Improper Neutralization of Special Elements in Output Used by a Downstream Co... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103391 An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in J... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103392 An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Net... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103393 An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networ... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103390 An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Netwo... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50543 Xibo is an open source digital signage platform with a web content management sy... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118029 Unverified ownership of the default query result location in the Athena module i... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50539 Xibo is an open source digital signage platform with a web content management sy... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50542 Xibo is an open source digital signage platform with a web content management sy... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.