October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111717 Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111718 AipexBase through commit 690adb9 contains a sql injection vulnerability that all... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111719 Roncoo-pay through commit 9428382 contains a missing authorization vulnerability... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111720 fish-island-backend through commit 7c61b78 contains an unauthenticated server-si... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111721 Open WES through 1.0.0 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111709 WhaTicket Community through commit cf04795 contains an insecure direct object re... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111712 Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerabili... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111713 tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability bec... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111715 Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/w... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111716 Arkon through 0.9.2 contains a broken access control vulnerability that allows a... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111703 yshop-crm through 2.1.3 contains an insecure direct object reference vulnerabili... |
medium | 6.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111705 Fuint through commit 57ec018 contains an insecure direct object reference vulner... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111707 99AI through 4.3.0 contains an insecure direct object reference vulnerability th... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111696 data-platform-open through commit efeacd3 uses a hardcoded, publicly known defau... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerabili... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111699 Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111688 Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that a... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111689 Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that a... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111694 qKnow through 2.4.3 contains a missing authentication vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111682 EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that all... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111683 Allegro Ralph through 20260902.1 contains a missing authorization vulnerability... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111674 Tbed through 20240319 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111676 Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111677 Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8L... |
medium | 5.5 | — | Antiword Project / antiword | 2026-10-16 | 2026-10-20 |
| CVE-2026-111679 Ekko Studio through 0.7.36 contains a missing authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111669 ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows a... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111670 ClickVisual through 1.1.2 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111672 Cube-studio through 2026.09.01 contains a missing authorization vulnerability in... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111664 Safing Portmaster before 2.2.5 contains a missing authorization vulnerability th... |
medium | 4.4 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111665 Piranha CMS through 12.2 contains a missing authorization vulnerability in the P... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111666 Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnera... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111667 REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskComm... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111668 AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/ap... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111657 BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerab... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111659 Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111660 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111661 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111662 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that... |
medium | 5.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111651 Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.