October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,369
Critical
1,327
High
5,803
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118564 Vulnerability in Drupal PayUmoney for Drupal Commerce. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118565 Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118567 Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Fo... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118568 Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118569 Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Brows... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118570 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cros... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118556 Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forcefu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118557 Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forcefu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118558 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118559 Improper Verification of Cryptographic Signature vulnerability in Drupal Commerc... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118560 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118561 External Control of File Name or Path vulnerability in Drupal Single Content Syn... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118562 Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync al... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118549 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118550 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118551 Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118552 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118553 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118554 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118555 Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118541 Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Br... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118542 Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Br... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118543 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows C... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118544 Exposure of Sensitive Information Through Data Queries vulnerability in Drupal C... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118545 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118546 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118548 Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) all... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118540 Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Br... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114571 Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Brow... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114573 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114554 Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114548 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114553 Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114544 Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forcefu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114545 Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forcefu... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114546 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114547 Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114541 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allow... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114542 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114543 Incorrect Authorization vulnerability in Drupal Simple User Management allows Fo... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.