October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111652 Engineercms through 2.0.5 contains a missing authorization vulnerability in Atta... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111653 53AIHub through 0.5.3 contains a missing authentication vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111654 FastBee through 2.1.0 contains an insecure direct object reference vulnerability... |
medium | 6.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111656 ChatWiki through 2.9.6 contains an insecure direct object reference vulnerabilit... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111645 MrDoc through 1.1.1 contains a missing object-level authorization vulnerability... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111646 SurveyKing before 1.13.0 contains a missing authorization vulnerability that all... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111647 PickMall lilishop through 5.0.0 contains an insecure direct object reference vul... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111649 Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object refer... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111637 NexoPOS through 6.2.4 contains a missing authentication vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111640 DooTask through 1.9.66 contains a missing authorization vulnerability in WebSock... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111629 IoTSharp through 3.6.1 contains an insecure direct object reference vulnerabilit... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object referenc... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111631 Distributor before 2.3.2 contains a missing authorization vulnerability that all... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111632 Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that all... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111635 Helical Insight through 7.0.0 contains a path traversal vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulner... |
medium | 5.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111625 10up Distributor before 2.3.2 contains a missing authorization vulnerability in... |
medium | 5.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111628 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that... |
medium | 5.0 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111616 Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability i... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111617 WHartTest through 2.8.1 contains a missing authentication vulnerability that all... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111618 CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnera... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111619 FilePress through 3.0.1 contains an sql injection vulnerability that allows auth... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111620 O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_proce... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111621 TDuck Survey Form through 5.3 contains a missing authorization vulnerability tha... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111622 smart-sso through 2.1.1 contains an open redirect vulnerability in the /login ha... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111610 B3log Solo through 4.4.0 contains a missing authorization vulnerability in Artic... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111611 roncoo-education through 25.0.0-RELEASE contains an insecure direct object refer... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111614 DataCap through 2025.1.1 contains an insecure direct object reference vulnerabil... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111615 Mall4cloud through 4.0 contains an insecure direct object reference vulnerabilit... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111603 PlayEdu through 2.3 contains a missing authorization vulnerability in the Course... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111608 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability... |
medium | 4.2 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111392 SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109461 Origin validation error in Microsoft Authentication Library (MSAL) for Node.js a... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-109838 IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive informat... |
medium | 5.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102552 Improper verification of the source of a communication channel in the DNS resolv... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-85745 MariaDB server is a community developed fork of MySQL server. |
medium | 4.3 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-85985 MariaDB server is a community developed fork of MySQL server. |
medium | 5.4 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-59962 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-59967 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-62362 PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent p... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.