October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101372 Vulnerability in Oracle REST Data Services (component: Core). |
low | 3.7 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101373 Vulnerability in Oracle REST Data Services (component: Core). |
low | 2.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113665 ApostropheCMS is an open-source Node.js content management system. |
low | 3.7 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113657 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113648 ApostropheCMS is an open-source Node.js content management system. |
low | 3.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113651 ApostropheCMS is an open-source Node.js content management system, and uploadfs... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113609 Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113596 Webstudio before 0.256.0 contains a missing authorization vulnerability that all... |
low | 3.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112941 filelock is a platform-independent file lock for Python. |
low | 3.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2026-112912 filelock is a platform-independent file lock for Python. |
low | 2.5 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-113357 @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability th... |
low | 3.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-110095 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. |
low | 3.7 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-110725 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. |
low | 3.7 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86933 A permissions issue was addressed with additional sandbox restrictions. |
low | 3.3 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86874 An out-of-bounds read was addressed with improved input validation. |
low | 3.3 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-84547 A memory corruption issue was addressed with improved input validation. |
low | 3.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-84490 This issue was addressed through improved state management. |
low | 2.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111766 markdown-it is a Markdown parser. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-26 |
| CVE-2026-112249 A vulnerability was detected in grandnode grandnode2 up to 2.3.0. |
low | 2.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-3303 IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which co... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-1501 IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-6930 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-12660 IBM MQ Web Console could allow an authenticated administrator to write files out... |
low | 2.7 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-112193 A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2024-4412 The software accepts user-supplied data without sufficient validation, allowing... |
low | 2.7 | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2026-112157 A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. |
low | 3.1 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypa... |
low | 3.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112284 libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in Decod... |
low | 3.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112274 libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_rec... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111935 NoteGen through 0.38.3 contains an external control of file path vulnerability i... |
low | 2.6 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112105 A vulnerability has been found in GlitterWare Passy up to 1.10.1. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112106 A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112103 A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112096 A vulnerability has been found in SourceCodester Inventory System 1.0. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112097 A vulnerability was found in SourceCodester Inventory System 1.0. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-91831 The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newlin... |
low | 3.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110034 The Salon Booking System WordPress plugin before 10.31.11 does not enforce a min... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112042 A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd... |
low | 3.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112037 A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62b... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.