October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,369
Critical
1,327
High
5,803
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114533 Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Fo... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114534 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114535 Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful B... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114536 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114537 Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114538 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114539 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114540 Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114525 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114526 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114527 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114528 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114529 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114530 Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114531 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114532 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114523 Improper Neutralization of Special Elements used in an OS Command ("OS Command I... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114524 Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110738 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108515 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108514 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-108099 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107266 Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsi... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107260 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107256 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupa... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107255 Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forc... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-18629 A web page that contains unusual GPU shader code is loaded into the GPU compiler... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-19199 Software installed and run as a non-privileged user may conduct improper system... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-65584 Software installed and run as a non-privileged user may conduct improper GPU sys... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-65586 Software installed and run as a non-privileged user may conduct improper GPU sys... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-65587 A web page that contains unusual WebGPU content loaded into the GPU GLES render... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-74912 On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, t... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-74915 A web page that contains unusual WebGPU content loaded into the GPU GLES render... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-15466 Software installed and run as a non-privileged user may conduct improper GPU sys... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112605 This issue was addressed with improved handling of symlinks. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112602 An authorization issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-92744 Under certain conditions, privilege manager agent allows a remote unauthenticate... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-112211 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2023-22793 A vulnerability allowing an unauthenticated attacker to perform remote code exec... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.