October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112268 sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass... |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112269 SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthent... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112270 SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncon... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112271 libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability i... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112272 Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the Di... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112265 LangBot through 4.11.0 contains a missing authenticity verification vulnerabilit... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112266 SGLang through 0.5.22 contains a denial of service vulnerability that allows API... |
medium | 5.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112222 Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerab... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111937 Frappe CRM before 1.81.2 contains a missing authorization vulnerability that all... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111938 Frappe CRM before 1.74.0 contains a missing authorization vulnerability that all... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111939 Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability tha... |
medium | 4.6 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112144 A weakness has been identified in satya-vinay Events-Management-System up to 437... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111828 Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rash... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111829 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111883 Locust through 2.46.7 contains a cross-site request forgery vulnerability that a... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111899 KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability i... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111915 Yank Note before 3.93.1 contains a path traversal vulnerability that allows unau... |
medium | 5.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111925 Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthen... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110008 @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. |
medium | 4.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110902 Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / S... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-38671 Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-... |
medium | 6.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112199 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112214 A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111831 Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111836 Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111839 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111845 Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yit... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110363 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111410 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111414 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112138 A flaw has been found in diem-project diem up to 5.1.3. |
medium | 4.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112140 A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a7... |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112210 A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rh... |
medium | 6.0 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112107 A flaw has been found in ztxz16 fastllm up to 1.8.2. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85317 Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP... |
medium | 4.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-91858 FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85296 Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 comp... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85300 Incorrect Default Permissions vulnerability in Apache Camel PQC component. |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.