October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89062 A potential out-of-bounds write vulnerability was reported in the Lenovo Energy... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92777 A potential vulnerability was reported in some Lenovo Tablets that could allow a... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89057 A potential authentication bypass vulnerability was reported in some Lenovo tabl... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16754 A potential improper certificate validation vulnerability was reported in Lenovo... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16755 A potential vulnerability was reported in Lenovo Smart Camera C33, distributed e... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96806 The Apache Airflow Keycloak auth manager did not end the session on logout: the... |
medium | 5.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-94135 The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHo... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-92228 The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_pe... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111363 BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnera... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111364 MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerabi... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111365 cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability t... |
medium | 6.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111367 BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability th... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111368 ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerabi... |
medium | 6.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111353 Peppermint through 0.5.5 contains a missing authorization vulnerability that all... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111355 zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111358 SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulner... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111346 ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111347 go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in th... |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111348 Likeshop through 3.5.1 contains an insecure direct object reference vulnerabilit... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111349 Craftplan through 0.7.5 contains a missing authorization vulnerability in the CR... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111350 Papermark through 0.22.0 contains a missing authorization vulnerability in the d... |
medium | 5.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111351 metasfresh through 5.175 contains a missing record-level authorization vulnerabi... |
medium | 4.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111330 JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability... |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111331 Dokploy through 0.30.8 contains a cross-organization authorization bypass in the... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111343 pig through 4.1.1 contains a missing authorization vulnerability in SysUserContr... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111344 APITable through 1.14.0-beta contains an authorization bypass vulnerability that... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111345 Trudesk through 1.2.11 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111313 JobOps through 0.13.1 contains a server-side request forgery vulnerability in th... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111320 ValueCell through 0.1.20 contains an unauthenticated server-side request forgery... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111321 TaskingAI through 0.3.0 contains a server-side request forgery vulnerability tha... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111323 RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vu... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111324 rustdesk-api through 2.7 contains an authorization bypass vulnerability that all... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111284 Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111272 LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseN... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111273 unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111274 unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111275 nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vul... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111278 NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unaut... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110917 Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110918 Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remo... |
medium | 4.3 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.