October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76654 An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied... |
medium | 5.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-2270 A confused deputy attack exists in the StatefulSet controller that allows a user... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116602 A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116745 QloApps through 1.7.0 contains an information disclosure vulnerability in OrderC... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116746 QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in th... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116739 VMime through 0.9.2 contains an information disclosure vulnerability in the uuEn... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116740 libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_par... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116741 Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116742 HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability i... |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116743 libyal libmsiecf through 20260525 contains a double free vulnerability in libmsi... |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116744 ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_so... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116731 Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngi... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116732 libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf... |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116735 libpff through 20260926 contains an off-by-one bounds check in libpff_table_read... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116736 Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libp... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116737 libphdi through 20260902 contains a heap out-of-bounds read vulnerability in lib... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116725 gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_m... |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116728 libfvde through 20260923 contains a heap out-of-bounds read vulnerability in lib... |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116730 Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in Div... |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116590 snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser dev... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-116507 A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116514 A weakness has been identified in itsourcecode Airline Reservation System 1.0. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116515 A security vulnerability has been detected in itsourcecode Online Book Store 1.0... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86987 An authorization issue was addressed with improved entitlement checks. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-10-30 |
| CVE-2026-86971 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86954 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-86925 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-86920 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-84496 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-65397 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-43736 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116582 Seroval facilitates JavaScript value stringification, including complex structur... |
medium | 4.7 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116577 Tornado is a Python web framework and asynchronous networking library. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116575 Mem0 provides persistent memory infrastructure for AI agents and applications. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116502 A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-113943 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-113939 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-113913 An input validation issue was addressed with improved input validation. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-113914 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.