October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70381 An access-control vulnerability has been identified in the web server configurat... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116478 A vulnerability was detected in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116477 A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115927 Tornado is a Python web framework and asynchronous networking library. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116467 A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116476 A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116631 A malicious web page could open a tel link in a window that was showing a differ... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116632 A malicious web page could insert arbitrary text into the FaceTime call prompt s... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104592 libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPL... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-81509 nforwardauth is a forward auth service that allows the use of a single authentic... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72757 Routinator runs out of open connections on the HTTP server when many connections... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72752 Routinator runs out of memory when the JSON output is requested many times concu... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-70379 When the vSolution Matrix feature is enabled, affected devices may make current... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-50095 There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earl... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-50096 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGI... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33520 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGI... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33522 Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated a... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116461 A vulnerability was determined in Omega Solution Restro POS up to 20261026. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116463 A vulnerability was identified in FastStone Image Viewer up to 8.5. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116634 OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability t... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116398 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116408 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115922 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-115923 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115966 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115916 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-115917 vLLM is an inference and serving engine for large language models. |
medium | 4.7 | — | Vllm / vllm | 2026-10-26 | 2026-10-31 |
| CVE-2026-115918 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-30 |
| CVE-2026-115919 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115920 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115921 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115914 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-30 |
| CVE-2026-115804 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
medium | 6.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112839 Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommer... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-81039 The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fix... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82388 bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82389 In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create()... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.