October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112954 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112955 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-112956 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113359 Baserow before 2.3.0 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112948 Vitest is a testing framework powered by Vite. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112949 Vitest is a Vite-native testing framework for JavaScript and TypeScript projects... |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112950 Vitest is a Vite-native testing framework for JavaScript and TypeScript projects... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-112951 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112823 Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-m... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112824 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112829 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-109700 Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fiel... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111843 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-92454 The GUIX software JPEG decoder reads four kinds of marker segment without checki... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113466 A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113411 A vulnerability was found in Nerimity Desktop up to 2.2.2. |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112934 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-22 |
| CVE-2026-112935 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2026-112936 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112937 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112939 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112906 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-27 |
| CVE-2026-112909 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-27 |
| CVE-2026-112911 filelock is a platform-independent file lock for Python. |
medium | 6.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2026-112914 filelock is a platform-independent file lock for Python. |
medium | 5.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112915 filelock is a platform-independent file lock for Python. |
medium | 5.5 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112833 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112834 Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriou... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-111761 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
medium | 5.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-96406 A VideoStreaming interface reports the size of its whole class-specific descript... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-96582 A HID report descriptor is a sequence of items, each declaring in its header how... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-74048 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-74049 Execution After Redirect (EAR) vulnerability in Apache Tomcat. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113393 A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-34484 Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulne... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113400 Uninitialized memory in the Audio/Video: cubeb component. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113401 Denial-of-service in the PDF Viewer component. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113470 Cryptographic issue in the Security Block-lists, Allow-lists, and other State co... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-18205 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.