October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112190 A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112195 A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. |
medium | 4.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112159 A security vulnerability has been detected in JumpServer up to 4.10.19. |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111061 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111059 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-7203 The Management Console and product files expose sensitive data, including remote... |
medium | 4.9 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-13173 Tokens associated with user sessions are not revoked when the corresponding user... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-13591 The authentication endpoint of WSO2 Identity Server fails to provide a consisten... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-6623 The carbon console accepts user-supplied XML input without sufficiently encoding... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-7043 The ForgeRock client fails to correctly validate refresh tokens. |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-112310 docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112363 Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnera... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112303 GDevelop desktop app through 5.6.284 contains a credential leak vulnerability th... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112158 A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109433 Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorizatio... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-23 |
| CVE-2026-107566 Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107568 Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in t... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-86375 Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encry... |
medium | 6.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112328 The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control v... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112329 The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control v... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112147 A vulnerability was found in ai-genius-automations octoally up to 1.0.87. |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112293 BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorizatio... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112294 FlyCms through commit edfdf724 contains a missing authorization vulnerability in... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112295 FlyCms through commit edfdf724 contains a mass assignment vulnerability that all... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112289 Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112290 Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before... |
medium | 4.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112291 Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication a... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112280 libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnera... |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112281 libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulner... |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112282 VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112283 VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vuln... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112285 Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerabili... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112286 Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerabili... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::com... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112275 Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the... |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112276 Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rast... |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112277 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in proce... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in proce... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112279 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in proce... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112267 SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-si... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.