October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,369
Critical
1,327
High
5,803
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests,... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116128 Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbo... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118988 CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118990 CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the c... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118991 CallBackery versions before 0.62.0 for Perl encrypt configuration backups with t... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115865 Starlet versions before 0.33 for Perl allow a request declaring a large Content-... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105924 A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110970 Płatnik uses HTTP protocol to download updates, libraries and support files. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110971 Use of a weak password encoding algorithm in Płatnik software allows a user who... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110972 Płatnik performs client-side authentication. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-68392 ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to us... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-68393 ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-68394 ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-68395 ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vul... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-68391 ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22110 The web server does not check authentication on POST or PUT. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22114 HTTP basic auth enforces no retry limit or backoff. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-85268 A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Googl... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116366 An issue has been discovered in ClickHouse Server that, under certain conditions... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22105 Delta UFC500 charging stations derive the default credentials of the Service acc... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-22109 The shipped WebUI template database retains the factory default passwords for al... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-14467 An information disclosure vulnerability in the Forocoches comments editor that a... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-64618 Improper Neutralization of Special Elements used in an SQL Command ("SQL Injecti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-65874 This issue affects Apache Fineract versions up to and including 1.15.0. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97209 Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a l... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115274 Improper Validation of Specified Quantity in Input vulnerability in the Elixir s... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109821 Improper Validation of Specified Quantity in Input vulnerability in the Elixir s... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-82104 In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 an... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118583 Incorrect Authorization vulnerability in Drupal Field Permissions allows Forcefu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118584 Incorrect Authorization vulnerability in Drupal Field Permissions allows Forcefu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118571 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118572 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118573 Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forcef... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118574 Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118575 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118576 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118582 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118563 Vulnerability in Drupal CacheFlush. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.