October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111155 libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in th... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111156 libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111157 SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_a... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111158 EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerabili... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111159 libewf through 20260924 contains a heap out-of-bounds read vulnerability in libe... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111146 ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrin... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111147 Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerabilit... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-27 |
| CVE-2026-111148 libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111149 FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vuln... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111150 ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vul... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111151 OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111152 Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnera... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111140 libregf through 20260526 contains a heap out-of-bounds read in libregf_value_ite... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111141 zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_p... |
medium | 4.7 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111142 Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mma... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111143 Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111144 libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerabilit... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111145 ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in Decompre... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111134 libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in lib... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111135 libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in lib... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111136 libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111137 libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAs... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111138 NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in b... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111139 NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in b... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111127 catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111128 Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Og... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111129 Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer derefer... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111130 OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111131 libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerabili... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111132 GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111133 libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encryp... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111123 FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allo... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111126 catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK re... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110874 Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUn... |
medium | 6.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110875 AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update()... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-110876 AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp t... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-110877 AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoade... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110878 Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110374 Missing Authorization vulnerability in Hamid Alinia Login with phone number logi... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110375 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.