October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116371 A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116384 A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116388 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploitin... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116395 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116396 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116403 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115913 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-115910 Python Social Auth is a social authentication and registration mechanism. |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115911 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-30 |
| CVE-2026-115906 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115597 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115598 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114710 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2013-10077 A weakness has been identified in OctoPrint 1.0.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116538 HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contain... |
medium | 4.7 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnera... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contai... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116541 Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerabil... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116542 Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulne... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116369 A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116394 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115678 Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds r... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115679 Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FT... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115680 Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116367 A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112344 Syncplify Server! |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-28 |
| CVE-2026-107080 OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains a... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-93849 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-93850 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-94386 Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oaut... |
medium | 4.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-92171 A flaw was found in the Infinispan Operator for Red Hat Data Grid. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116340 A vulnerability was identified in iFlytek astron-agent up to 1.1.2. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116497 A NULL pointer dereference vulnerability was found in gssproxy. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115930 The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carr... |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116284 A security vulnerability has been detected in Kameleo up to 5.3.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110733 Vulnerability in the SQL storage module of Apache SIS. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116486 Objenesis before 3.6 contains a type confusion vulnerability that allows code in... |
medium | 4.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116487 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contain... |
medium | 4.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116488 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contain... |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116492 Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.