October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,341
High
5,878
Medium
6,268
Low
649
Severity not reported
3,343
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1317), google (757), oracle (161), ibm (140), adobe (138), broadcom (61), langflow (57), apache (47), apple (43), freerdp (42)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112935 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2026-112936 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112937 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112939 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112906 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-27 |
| CVE-2026-112909 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-27 |
| CVE-2026-112911 filelock is a platform-independent file lock for Python. |
medium | 6.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2026-112914 filelock is a platform-independent file lock for Python. |
medium | 5.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112915 filelock is a platform-independent file lock for Python. |
medium | 5.5 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112833 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112834 Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriou... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-111761 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
medium | 5.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-96406 A VideoStreaming interface reports the size of its whole class-specific descript... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-96582 A HID report descriptor is a sequence of items, each declaring in its header how... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-74048 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-74049 Execution After Redirect (EAR) vulnerability in Apache Tomcat. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113393 A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-34484 Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulne... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113400 Uninitialized memory in the Audio/Video: cubeb component. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113401 Denial-of-service in the PDF Viewer component. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113470 Cryptographic issue in the Security Block-lists, Allow-lists, and other State co... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-18205 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113385 A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Andr... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113388 A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113495 A flaw was found in cockpit-machines. |
medium | 5.0 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-113496 A flaw was found in cockpit-machines. |
medium | 5.0 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-113583 Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vul... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113382 A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113383 A vulnerability was detected in Optimal IdM OptimalCloud 5.0. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113384 A flaw has been found in Optimal IdM OptimalCloud 5.0. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113349 OpenCATS before 0.10.0 contains a missing authorization vulnerability in Calenda... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113350 react-admin before 5.15.5 contains a stored cross-site scripting vulnerability t... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113351 libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113353 LearnPress before 4.4.10 contains a missing authorization vulnerability in the a... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113354 Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113355 Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that... |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112783 OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/de... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112784 OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/te... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112785 OpenCATS before 0.10.0 contains a missing authorization vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112786 OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportU... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.