October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,478
Critical
1,340
High
5,869
Medium
6,255
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109300 Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vuln... |
medium | 4.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109289 Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerabi... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109292 Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerab... |
medium | 6.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109293 Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerab... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109294 Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumpti... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109295 Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of ser... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109283 Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAu... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109284 Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerab... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109285 Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerab... |
medium | 5.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109287 Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the kno... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109288 Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in... |
medium | 6.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete clea... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109281 ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its han... |
medium | 4.4 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109269 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information dis... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109273 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information dis... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109275 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection v... |
medium | 4.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109262 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109265 ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerabili... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109266 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection v... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow i... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
| CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized m... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109249 FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assist... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109250 FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in col... |
medium | 6.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109251 FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origi... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109252 FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerabili... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109253 FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109254 FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the stati... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in lice... |
medium | 6.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109243 FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vul... |
medium | 4.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109244 FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability i... |
medium | 6.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109245 FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerab... |
medium | 6.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109246 FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-sha... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109248 FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clip... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109239 Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108477 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108478 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108909 A security flaw has been discovered in Netcore NR268 1.7.121109. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108475 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.