October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2013-20008 Linksys WAG200G through 1.01.06 contains a weak password change mechanism that a... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2013-20009 Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerabi... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2014-125136 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2014-125137 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118271 A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118272 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118129 A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8... |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-58496 Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-50571 WebSub is a W3C recommendation produced by the Social Web Working Group. |
medium | 5.7 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118318 Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118319 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118322 Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118128 A vulnerability has been found in a2aproject a2a-js up to 1.1.0. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116773 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116774 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language mode... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116684 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 6.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116685 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116686 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-16491 Grafana’s RBAC service ignored the requested folder when checking whether a user... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-87085 Tanium addressed a SQL injection vulnerability in Provision. |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117526 A vulnerability was found in reduxjs redux-devtools 5.0.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116678 Vaultwarden is a Bitwarden-compatible server written in Rust. |
medium | 5.8 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116679 Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116680 HomeBox is a home inventory and organization system. |
medium | 6.4 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116657 Tanium addressed a denial of service vulnerability in Enforce. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116658 Tanium addressed a denial of service vulnerability in Enforce. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116659 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116660 Tanium addressed an improper access controls vulnerability in Enforce. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108325 Tanium addressed an insertion of sensitive information into log file vulnerabili... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108326 Tanium addressed an improper certificate validation vulnerability in Stream Clie... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108328 Tanium addressed an insertion of sensitive information into log file vulnerabili... |
medium | 4.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108332 Tanium addressed an improper link resolution before file access vulnerability in... |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108308 Tanium addressed a SQL injection vulnerability in Patch. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108309 Tanium addressed an uncontrolled resource consumption vulnerability in Performan... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108310 Tanium addressed a denial of service vulnerability in Tanium Server. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Serve... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108301 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.0 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.