October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains... |
low | 2.6 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115366 OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability... |
low | 2.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115369 OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_ci... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115359 OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit qu... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115362 OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclo... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attacker... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115357 OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entrie... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115358 OpenBao before 2.6.3 contains an information disclosure vulnerability that allow... |
low | 2.0 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-113875 On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user i... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-54238 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSock... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115246 A weakness has been identified in subhajitkhan online-clinic-management-system u... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115319 fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnera... |
low | 2.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-21811 HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclo... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-21812 HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensi... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114457 A flaw was found in mod_qos. |
low | 3.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114459 A flaw was found in mod_qos. |
low | 3.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-88849 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not ver... |
low | 2.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110011 The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does... |
low | 2.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109931 The Infility Global WordPress plugin before 2.16.25 does not perform any authori... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows For... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96369 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Pr... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87948 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87949 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Ser... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Servi... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84916 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monoban... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-16648 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84911 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick re... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114721 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actio... |
low | 3.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114641 Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in... |
low | 3.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.