October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,390
Critical
1,328
High
5,808
Medium
6,216
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118681 go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressN... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118258 i18next-http-backend is a backend layer for i18next that loads translation resou... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105615 PostgreSQL's optimized statistics on a table are visible as long as you have SEL... |
low | 3.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105612 PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypas... |
low | 3.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118608 Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read I... |
low | 3.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103394 An Improper Initialization vulnerability in the SSR software in Juniper Networks... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-21830 HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. |
low | 3.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87098 Sensitive information disclosure due to improper authorization. |
low | 3.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87100 Protection mechanism failure due to missing binary hardening in Linux executable... |
low | 3.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86401 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
low | 2.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-90719 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
low | 2.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-90721 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
low | 3.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-90723 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
low | 2.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-90724 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
low | 2.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113494 The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or... |
low | 2.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111032 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify a... |
low | 3.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111961 The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level pe... |
low | 3.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110507 The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict... |
low | 2.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106647 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a... |
low | 3.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118276 A vulnerability was determined in a2ui-project a2ui up to 0.10.6. |
low | 3.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118371 LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that al... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116696 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
low | 3.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116687 CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. |
low | 3.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108333 Tanium addressed a use-after-free vulnerability in Threat Response Client Extens... |
low | 2.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108330 Tanium addressed an information disclosure vulnerability in Threat Response Clie... |
low | 3.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108331 Tanium addressed an infinite loop vulnerability in Threat Response Client Extens... |
low | 3.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108311 Tanium addressed an insufficient logging vulnerability in Tanium Server. |
low | 2.7 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82983 The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId})... |
low | 3.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-67400 A missing token type check allowed to retrieve more additional information about... |
low | 3.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-77171 A public shared collective always allowed recipients of the link to create pages... |
low | 3.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116673 systeminformation is a System and OS information library for node.js. |
low | 3.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-90727 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
low | 3.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117499 @fastify/session is a session plugin for Fastify. |
low | 3.7 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-18451 The HTML5 KVM-over-IP console authenticates with a token returned by the web int... |
low | 3.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-110910 ### Summary
`qs.stringify` with `allowEmptyArrays: true` writes the key of an e... |
low | 3.7 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-103325 The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correc... |
low | 3.7 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116639 A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-Syste... |
low | 3.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116640 A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001af... |
low | 3.5 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.