October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116104 A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116097 A security vulnerability has been detected in CloudClassroom-PHP-Project. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116095 A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116096 A weakness has been identified in ggml-org llama.cpp. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116063 A weakness has been identified in DedeCMS up to 5.7.118. |
medium | 4.7 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116057 A vulnerability has been found in KodCloud KodExplorer up to 4.55. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116058 A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116056 A flaw has been found in KodCloud KodExplorer up to 4.56. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116055 A vulnerability was detected in SourceCodester Performance Indicator System 1.0. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116202 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116203 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the... |
medium | 6.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116205 YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116206 YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerabi... |
medium | 6.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116196 Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 bac... |
medium | 5.3 | — | Rclone / rclone | 2026-10-25 | 2026-10-27 |
| CVE-2026-116198 Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsC... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-10-25 | 2026-10-29 |
| CVE-2026-116200 Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connect... |
medium | 5.9 | — | Snipeitapp / snipe-it | 2026-10-25 | 2026-10-26 |
| CVE-2026-116192 rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerabil... |
medium | 5.9 | — | Rclone / rclone | 2026-10-25 | 2026-10-27 |
| CVE-2026-116193 Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability... |
medium | 5.3 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116194 Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerabi... |
medium | 6.8 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116195 Rclone before 1.75.2 contains a path traversal vulnerability in the local backen... |
medium | 6.1 | — | Rclone / rclone | 2026-10-25 | 2026-10-27 |
| CVE-2026-116182 phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in t... |
medium | 5.0 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116185 OpenRemote core before 1.31.0 contains an authorization bypass vulnerability tha... |
medium | 5.0 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116187 Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerabilit... |
medium | 5.0 | — | Rclone / rclone | 2026-10-25 | 2026-10-28 |
| CVE-2026-116188 rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulner... |
medium | 5.3 | — | Rclone / rclone | 2026-10-25 | 2026-10-28 |
| CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability becau... |
medium | 6.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116181 vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerabili... |
medium | 6.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116169 SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116170 SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-t... |
medium | 4.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass i... |
medium | 4.4 | — | — | 2026-10-25 | 2026-10-28 |
| CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but n... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116167 SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116168 SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset too... |
medium | 6.2 | — | — | 2026-10-25 | 2026-10-25 |
| CVE-2026-116152 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT deco... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116154 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in i... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in t... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116141 ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR d... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116053 A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116052 A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerabili... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.