October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111269 libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_deco... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111270 libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFi... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111271 libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerabilit... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2024-58397 MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChap... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-27 |
| CVE-2026-108453 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108454 Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108455 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108436 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108438 Use after free in Microsoft Office Word allows an unauthorized attacker to discl... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108434 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108435 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-104198 ZoneMinder is a free, open source closed-circuit television software application... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-94621 AliasVault is a privacy-first password manager with built-in email aliasing. |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-96449 Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows E... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-92707 MessagePack for C# is a MessagePack serializer for C#. |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-62322 Python Social Auth is a social authentication/registration mechanism. |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-55871 GYM One is open-source gym management software for fitness centers, personal tra... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-57183 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-55840 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-55842 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111232 Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vu... |
medium | 4.8 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-21 |
| CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting... |
medium | 6.1 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111234 SimplePie through 1.9.0 contains a local file read vulnerability that allows mal... |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111252 A denial of service vulnerability exists in the XML parsing of multiple versions... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111227 Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in serv... |
medium | 5.5 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-21 |
| CVE-2026-111228 Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerabil... |
medium | 5.5 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111230 Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that a... |
medium | 4.9 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111170 kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111171 Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side r... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111165 libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in t... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111166 libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111167 GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerabilit... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111168 LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111161 libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds writ... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111162 WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the H... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111163 WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_P... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111164 UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111153 Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulne... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111154 libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.