October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path tra... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.... |
medium | 6.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-76308 In Splunk SOAR versions below 8.7.0, an authenticated user could change the Ente... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encr... |
medium | 5.9 | — | Splunk / soar | 2026-10-21 | 2026-10-29 |
| CVE-2026-76303 In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_a... |
medium | 5.7 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76304 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a r... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76305 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a r... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-76292 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Spl... |
medium | 6.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76294 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76295 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Spl... |
medium | 4.3 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76296 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76297 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unau... |
medium | 5.4 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76287 In Splunk Enterprise versions below 10.4.4, a user that holds a role with the pr... |
medium | 5.4 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76289 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
medium | 6.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114384 A security vulnerability has been detected in itsourcecode Online Cake Ordering... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114501 Pillow is a Python imaging library. |
medium | 5.3 | — | Python / pillow | 2026-10-21 | 2026-10-30 |
| CVE-2026-114508 Laravel is a web application framework. |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114381 A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-96638 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-96641 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-96642 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-30 |
| CVE-2026-96643 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-27 |
| CVE-2026-96636 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-30 |
| CVE-2026-96637 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-27 |
| CVE-2026-114380 A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114406 The system certificate authority (CA) store in Red Hat products, distributed via... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114378 A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114379 A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-85518 A flaw was found in OpenSCAP. |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114375 A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114376 A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114438 A flaw was found in the Update User Locale required action of the Keycloak ident... |
medium | 4.2 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114362 A flaw has been found in HarnessRouter up to 0.31.12. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114374 A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111817 Apache Traffic Server can stall a chunked transfer that it passes through with i... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-112381 Apache Traffic Server can crash with a null pointer dereference when a client PO... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78116 The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO subm... |
medium | 5.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78117 The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6... |
medium | 4.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78119 The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.