October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114060 SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability i... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114061 SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerabi... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114062 SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114064 Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in th... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114065 Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that a... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114054 vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authentic... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114056 ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerabili... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114057 ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerabili... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerabili... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114047 FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vul... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114038 A flaw was found in device-mapper-multipath. |
medium | 5.1 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-114041 FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cl... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114042 FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel th... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114043 FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipbo... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114044 FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the An... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113737 A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f279... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-113738 A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to e... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113740 A flaw has been found in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113741 A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111943 On most platforms, Go uses the given system root certificates. |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2021-48019 Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forward... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2021-48020 Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability cause... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distri... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2020-37286 Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability cause... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2020-37287 Vyper before 0.2.6 contains a call stack corruption vulnerability that causes in... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113707 A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-109682 Metasploit Framework versions before 6.5.7 allow HTTP requests made through send... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-109681 The FTP client trusts the server's PASV response IP:port without validation agai... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113705 A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-112202 Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-93744 IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to by... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-94402 IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91657 Vulnerability in Oracle Essbase (component: Security). |
medium | 4.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91660 Vulnerability in Oracle Essbase (component: Security). |
medium | 4.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91662 Vulnerability in Oracle Essbase (component: Java Based Agent). |
medium | 6.4 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91648 Vulnerability in Oracle Essbase (component: Java Based Agent). |
medium | 5.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91649 Vulnerability in Oracle Essbase (component: Java Based Agent). |
medium | 6.0 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91652 Vulnerability in Oracle Essbase (component: Security). |
medium | 5.0 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.