October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110630 VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulner... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110619 frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that a... |
medium | 4.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110620 Formbricks before 4.9.0 contains an authorization bypass vulnerability in server... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110611 REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Co... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110613 youlai-mall through commit 9f62de8 contains a missing authorization vulnerabilit... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-27 |
| CVE-2026-110614 Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110617 we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /a... |
medium | 4.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110605 libschrift through 0.10.2 contains a divide by zero vulnerability that allows at... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypas... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110608 BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object re... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerabili... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110610 ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerabili... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110598 Libyal libpff through 20260926 contains an integer underflow in libpff_record_en... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110600 xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110601 libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds... |
medium | 6.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110602 libmspack through 0.11alpha contains an uninitialized pointer free vulnerability... |
medium | 6.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110603 LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_heade... |
medium | 6.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110593 BottleCRM through 1.14.5 contains a server-side template injection vulnerability... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110594 BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vu... |
medium | 4.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110595 BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnera... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110596 quirc through 1.2 contains an excessive-iteration vulnerability in find_alignmen... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110597 Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseE... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110591 OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerabili... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110263 OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in Sign... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110270 OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110257 OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110258 OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110259 OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in Clas... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110260 OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110261 OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows a... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107381 svg-sanitizer is a PHP SVG/XML sanitizer. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101019 Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101025 Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs e... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2016-20099 L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_p... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-94348 Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Ne... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-35161 Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Rest... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side... |
medium | 4.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104086 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-101215 Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neu... |
medium | 6.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101216 Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neu... |
medium | 6.6 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.