October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113671 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113659 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113660 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113661 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113662 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112861 Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign... |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113507 A vulnerability was found in aaPanel up to 8.25.0. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-92539 A service account with user-management permissions in one organization can read,... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-28329 SolarWinds Observability Self-Hosted was found to be affected by a Server-Side R... |
medium | 6.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-28330 SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-... |
medium | 4.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-28331 SolarWinds Patch Manager exposes sensitive information accessible to local users... |
medium | 4.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113652 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.6 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113655 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113656 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113649 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113650 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113505 A flaw has been found in aaPanel up to 8.25.0. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112957 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112958 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113681 OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-bet... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113683 VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113676 Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113677 Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113680 HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerabi... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113608 Configurable Reports block for Moodle (moodle-block_configurablereports) before... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113610 Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113611 Outline before 1.8.0 contains an improper access revocation vulnerability that a... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113612 SparkyFitness before 0.17.0 contains a missing authorization vulnerability that... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113603 The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 Py... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113604 Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 contains an authorization byp... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113599 Modoboa before 2.8.0 contains an insecure direct object reference vulnerability... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113600 Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerab... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113601 Memos before 0.27.0 contains a missing authorization vulnerability in the Activi... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113602 json-smart through 2.6.0 contains an input validation bypass vulnerability that... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113595 Sharkord before 0.0.26 contains a missing authorization vulnerability in the oth... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113597 Blinko through 1.8.8 contains an insecure direct object reference vulnerability... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113598 Modoboa before 2.8.0 contains an insecure direct object reference vulnerability... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113594 Sharkord before 0.0.8 contains a missing authorization vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112952 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.