October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,370
Critical
1,327
High
5,803
Medium
6,212
Low
648
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61586 Copernik XML Factory provides secure-by-default JAXP factory creation for Java. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109213 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61805 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61806 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61789 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB,... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61803 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-37468 Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39375 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112816 Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-49602 An issue was discovered in Keyfactor EJBCA 9. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117182 An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddab... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117183 A path traversal vulnerability in the FeaturedImage component of astro-notion-bl... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117184 An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cau... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105455 RTIR's ticket creation forms show the subject of the related
ticket when splitt... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105456 RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105454 RT's automatic link creation for URLs in HTML ticket content does
not HTML-esca... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-93327 A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Goo... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61626 libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alph... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Al... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119680 A stored cross-site scripting (XSS) vulnerability exists in the chart feature of... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119682 An improper access control vulnerability exists in the multi-factor authenticati... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117346 Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files havi... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117349 Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111487 An out-of-bounds write vulnerability in the Qt Framework assimp scene import plu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-49115 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-49116 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118986 CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a s... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118987 CallBackery versions before 0.62.0 for Perl accept session cookies of any age se... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117028 Skuul School Management System through version 2.6.5 is vulnerable to incorrect... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117350 Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-87768 DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-75882 An improper access control vulnerability in ESET Endpoint Encryption and ESET Fu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-64860 Rejected reason: Further research determined the issue is not a vulnerability. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the requ... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118994 CallBackery versions before 0.62.0 for Perl allow log injection via newlines in... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118995 CallBackery versions before 0.62.0 for Perl accept unintended values in form fie... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118996 CallBackery versions before 0.62.0 for Perl send users their own password hash a... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by fl... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119037 Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119038 Business::GoCardless versions before 1.01 for Perl complete redirect flows witho... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.