October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112033 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112032 A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. |
medium | 4.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112030 A vulnerability was found in diem-project diem up to 5.1.3. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112027 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112028 A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-109844 `GET /api/v1/user/subscriptions` returned the metadata of every repository a use... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110311 Creating a draft release through the API returned an `assets` list that was buil... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110324 The visibility check of Gitea user profiles was applied to GET requests only, wh... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110494 Adding attachments to a release checked the repository and release of an attachm... |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-97859 Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, f... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-104627 The Gitea OpenID association callback in the security settings accepted a positi... |
medium | 5.4 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-105661 Requesting `/{username}/-/repositories` for an individual user instead of an org... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-105964 The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-107686 The Gitea web handlers for adding and removing reactions on issues and comments... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-29 |
| CVE-2026-111992 A vulnerability was detected in itsmeravitejak Online-Examination-System up to e... |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111988 A security flaw has been discovered in dyad-sh dyad up to 1.16.0. |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111991 A security vulnerability has been detected in WongKinYiu yolov9 0.1. |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-110024 @fastify/jwt is a JWT utility plugin for Fastify. |
medium | 6.8 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-111987 A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.1... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112057 libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdna... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112058 VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the po... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112060 librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-b... |
medium | 6.4 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112061 librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112062 lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_ha... |
medium | 5.9 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112063 libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability i... |
medium | 5.9 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112051 Xinference through 4.0.1 contains a path traversal vulnerability on Windows that... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112052 libspatialite through 5.1.0 contains an integer overflow vulnerability in the WK... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112053 Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulne... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112054 Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerabil... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112055 wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112056 wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability i... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112046 OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.reso... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerabilit... |
medium | 5.4 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112048 libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkb... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in i... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111986 A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.1... |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112020 LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lod... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112013 libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_g... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112014 LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that all... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.