October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provide... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SS... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87950 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provide... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Cent... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-87939 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87940 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87941 Vulnerability in Drupal Patreon. |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-87942 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87944 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provi... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84917 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Force... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84919 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84920 Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions all... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84921 Missing Authorization vulnerability in Drupal Webform Submissions Delete allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84924 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84910 Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Br... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84912 Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allow... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84913 Missing Authorization vulnerability in Drupal AI Translate allows Forceful Brows... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84914 Missing Authorization vulnerability in Drupal Calculate Working Days allows Forc... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84915 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114722 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scop... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114725 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
medium | 5.0 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114726 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
medium | 5.8 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote c... |
medium | 5.3 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114717 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
medium | 5.8 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114718 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-si... |
medium | 6.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF val... |
medium | 4.3 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability i... |
medium | 6.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability th... |
medium | 5.7 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114659 Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass be... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114633 WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerabi... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-12664 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2... |
medium | 6.8 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-27 |
| CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10... |
medium | 6.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.