October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116508 A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116506 A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116504 A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116505 A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authori... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-115915 vLLM is an inference and serving engine for large language models. |
critical | 9.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-10757 There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and e... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-102649 Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes oper... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112346 OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65184 The root-privileged `wsserver` terminal-bridge daemon builds a shell command fro... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-59106 A security vulnerability has been identified in the WolfProt interface implement... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-59107 A security vulnerability has been identified in the vSolution Matrix file sharin... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116485 danmu_api before 1.21.7 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116214 MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability... |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115188 An unrestricted file upload vulnerability exists in the campaign import feature... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in For... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116235 A flaw has been found in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116233 A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116234 A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116230 A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24... |
critical | 9.8 | — | Ndemiccreations / plague inc | 2026-10-26 | 2026-10-28 |
| CVE-2026-116231 A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116232 A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116099 A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplay... |
critical | 9.8 | — | Fcs-ex / scp\ | 2026-10-26 | 2026-10-28 |
| CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unau... |
critical | 9.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115214 The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify tha... |
critical | 9.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115995 A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to... |
critical | 9.6 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared s... |
critical | 9.9 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115932 When a post is published, Postiz treats a media path that is not a web address a... |
critical | 9.6 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-94075 Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112866 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114196 Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-110956 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115806 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their c... |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115889 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115893 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services M... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.