October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114474 Use of a less trusted source for the envelope sender in the external-account dow... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114475 Missing authorization in the REST role-management routes of Progressive Robot hM... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114253 A vulnerability was determined in oretnom23 file-management-system-php up to 2e3... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113787 odf-kit allows users to generate, fill, read, and convert OpenDocument Format fi... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-102484 Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.... |
medium | 6.4 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-102485 Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before... |
medium | 5.2 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2025-60469 A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_t... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60476 A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptor... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114251 A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114252 A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c4... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114250 A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111835 Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111837 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2025-60493 A segmentation violation in the check_media_profile function (/mp4box/mp4box.c)... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60497 A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Proj... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60478 A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_p... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60487 A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c)... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60490 A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filt... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60491 A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) o... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60492 A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114437 In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forw... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-104949 WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2025-60489 A NULL pointer dereference in the dasher_insert_timeline_entry function (/filter... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-71438 An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Proj... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2024-7478 When a WSO2 product is configured to use an external user store, the system fail... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2025-60479 A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_sta... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2024-5563 Due to an incomplete implementation, reCaptcha is not applied to certain authent... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2024-6423 The product failed to enforce validation constraints on user-supplied input in U... |
medium | 4.0 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2024-4989 The callback URL parameter in WSO2 API Manager fails to validate user-supplied i... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2024-5139 The Authentication Endpoint accepts user-supplied input without sufficient encod... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-90484 The MySQL client response parser in Apache bRPC dereferences a null pointer when... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-87849 The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) cal... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-82953 NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (ver... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-84727 Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.1... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-114407 e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability t... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114399 Trudesk through 1.2.11 contains a path traversal vulnerability that allows admin... |
medium | 6.5 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-114401 Trudesk through 1.2.11 contains a regular expression injection vulnerability tha... |
medium | 5.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-114402 Trudesk through 1.2.11 contains a path traversal and authorization bypass vulner... |
medium | 4.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114404 PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114394 Trudesk through 1.2.11 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.