October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115361 OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops ex... |
medium | 4.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115365 OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerabilit... |
medium | 6.6 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115354 Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Inclu... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115356 OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a tok... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114655 libmongocrypt builds requests to external key management services (AWS, Azure an... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115350 Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Includ... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115351 Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allo... |
medium | 4.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB... |
medium | 4.0 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114652 A data-query-logic neutralization weakness in the update-statement construction... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114653 A client-side encryption schema construction component in the MongoDB C# Driver... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114654 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Dr... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114644 The MongoDB C# Driver's BSON library contains an uncontrolled resource consumpti... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114645 A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI... |
medium | 5.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114646 A data-validation flaw exists in the BSON handling and binary serialization path... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114647 The MongoDB C# Driver does not reject replacement documents whose top-level fiel... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114649 The MongoDB C# Driver compares TLS client certificates by issuer and serial numb... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114650 A flaw in the client-side encryption support of the MongoDB .NET/C# driver can c... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114643 The MongoDB C# Driver writes GeoJSON extra members without checking whether thei... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113876 SmileCDR HAPI FHIR does not correctly check authorization for conditional create... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2025-69723 A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-54532 CloudPirates Open Source Helm Charts is a collection of Helm charts. |
medium | 6.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-77156 Incomplete validation of extracted archive entry paths in ast-cli's tar extracti... |
medium | 6.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-77157 ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the... |
medium | 6.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114609 fpdf2 is a PDF creation library for Python. |
medium | 5.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114610 fpdf2 is a PDF creation library for Python. |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-108360 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
medium | 6.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114485 Insufficient protection of sensitive information in the user list endpoint in De... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114486 Incorrect authorization in the Devolutions Gateway token generation in Devolutio... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114487 Missing authorization in the PAM AD computer import endpoint in Devolutions Serv... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114603 OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-78801 An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114515 OCO-Server is a self-hosted endpoint management application for computer invento... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115400 crawlseo before version 0.2.5 contains a cleartext storage vulnerability that al... |
medium | 4.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115411 crawlseo before version 0.2.4 contains a server-side request forgery vulnerabili... |
medium | 5.0 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115247 A security vulnerability has been detected in subhajitkhan online-clinic-managem... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115248 A vulnerability was detected in subhajitkhan online-clinic-management-system up... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115249 A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115329 Lotus through 0.10.2 contains an insecure direct object reference vulnerability... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115333 Lotus through 0.10.2 contains an improper authentication vulnerability in the Go... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115334 Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUse... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.