October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76787 The UpdateHub firmware-over-the-air client parses the CoAP probe response with Z... |
medium | 5.9 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112302 A weakness has been identified in kiwilan php-archive up to 2.3.02. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file in... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-112299 A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112300 A vulnerability was identified in DiffSK configobj up to 5.0.9. |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112781 Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability th... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112771 Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox al... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112297 A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112254 A vulnerability was found in agit8or1 clientst0r up to 3.17.586. |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112259 A flaw was found in GIMP. |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112251 A vulnerability was detected in antoinersx clawhost up to 0.0.45. |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCI... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-109434 Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerab... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2025-60482 A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptor... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-3161 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographi... |
medium | 5.9 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-3628 IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-4405 IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which c... |
medium | 4.0 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-4413 IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-4418 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-1510 IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap I... |
medium | 4.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-11319 TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path travers... |
medium | 6.2 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112247 A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safe... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112248 A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. |
medium | 4.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111757 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-55654 A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pi... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-55667 A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-60480 A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/des... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2023-38375 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-14511 IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a deni... |
medium | 6.5 | — | Ibm / mq | 2026-10-19 | 2026-10-23 |
| CVE-2026-15661 IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data in... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-12669 IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds re... |
medium | 4.3 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12670 IBM MQ could allow an authenticated attacker to cause a denial of service throug... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12727 IBM MQ could allow an authenticated attacker to cause potential process instabil... |
medium | 4.3 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12350 IBM MQ could allow an authenticated attacker to cause a denial of service by sen... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12155 IBM MQ could allow an authenticated attacker to cause a denial of service by sen... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12343 IBM MQ could allow an authenticated attacker to cause a denial of service due to... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-11828 IBM MQ could allow a remote attacker with queue manager control or man-in-the-mi... |
medium | 5.9 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-11829 IBM MQ could allow an authenticated attacker to cause a denial of service due to... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-11831 IBM MQ could allow an authenticated attacker to cause a limited denial of servic... |
medium | 5.4 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.