October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108302 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-77173 A user could create a docx or odt file with a # in the filename with confidentia... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82984 When a team was configured as "visible to everyone", the web UI correctly blocke... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82986 The user in a group can bypass the group restriction set by an administrator on... |
medium | 4.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-87897 A SSRF vulnerability found that enables access to internal Chrome Devtools Proto... |
medium | 4.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-77172 App passwords were allowed to bypass password confirmation on sensitive endpoint... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-54462 Knative pkg provides common packages shared across Knative repositories. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57185 Asterisk is an open source private branch exchange and telephony toolkit. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-57194 Asterisk is an open source private branch exchange and telephony toolkit. |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-48380 Substance3D - Painter is affected by an out-of-bounds read vulnerability that co... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116674 systeminformation is a System and OS information library for node.js. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-109088 A malicious X server could send malformed RECORD EnableContext reolies that can... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117509 A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117510 A flaw has been found in Dexmal Dexbotic up to 0.2.0. |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117505 A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117506 A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117507 A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Fi... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-90725 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90726 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-68866 PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-16307 Authorization bypass through User-Controlled key vulnerability in Netiket Inform... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117603 Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nost... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117566 EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerabi... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117570 Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validat... |
medium | 5.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117562 rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that a... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117563 MrDoc through 1.1.1 contains a broken access control vulnerability in the manage... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117565 Artalk before 2.10.1 contains an unauthenticated server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117557 SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read v... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117555 CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117556 zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_pre... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117503 A vulnerability was determined in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117504 A vulnerability was identified in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117554 Admidio before 5.0.17 contains an improper access control vulnerability that all... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-10537 A misconfiguration issue in the affected service in Control-M/Enterprise Manager... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-107067 An issue in Shirt Pocket's SuperDuper! |
medium | 6.2 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-15586 Improper restriction of excessive authentication attempts vulnerability in İdvla... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-56084 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 5.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-90728 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90729 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.7 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90730 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.