October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,478
Critical
1,340
High
5,869
Medium
6,255
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109351 Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulne... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109352 LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in i... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109354 LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109355 LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in g... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109356 LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsCo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerabilit... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109345 DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability th... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109349 gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntries... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109350 Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109338 SurrealDB before 3.3.0 contains a denial of service vulnerability that allows qu... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109339 SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory becau... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109340 SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109342 SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerabilit... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109333 SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109335 SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerabili... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109336 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109337 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109328 Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site script... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109329 Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access co... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109330 Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnera... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109320 The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109322 Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulner... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerabi... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109324 Grav before 2.1.7 contains a denial of service vulnerability that allows authent... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109315 Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability t... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109316 Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vu... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109319 Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-s... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnera... |
medium | 4.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map i... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109311 vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback w... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce ide... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109304 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary fil... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109306 Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerabili... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109296 Open WebUI before 0.11.4 contains a missing authorization vulnerability that all... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109297 Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in th... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109298 Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowl... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109299 Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability t... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.