October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,367
Critical
1,327
High
5,803
Medium
6,210
Low
649
Severity not reported
3,378
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107046 A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107048 An issue in the WebView rendering path component of MotionCreative Motion UI ver... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107050 An issue in libretro RetroArch v1.22.2 allows attackers to force another user in... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107051 Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified bui... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107043 Insecure permissions in Code Catcher versionCode 131 allow unauthorized attacker... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107045 Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publis... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93570 Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injec... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93571 Szafir is vulnerable to Path Traversal in the uploaded filename. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66911 Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Locati... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66912 Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email hea... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118673 KeePassXC is a cross-platform community-driven port of the Windows application K... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115795 P-Net before 1.0.3 does not check that a complete block header is present in the... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RP... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112255 Initialization of a resource with an insecure default vulnerability in OpenText... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112256 Acceptance of extraneous untrusted data with trusted data vulnerability in OpenT... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived f... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111730 P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckP... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111731 P-Net before 1.0.3 enters an infinite loop when handling a read request for the... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111732 P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111733 P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111734 P-Net before 1.0.3 does not validate the length of a received Ethernet frame in... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111735 P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111736 P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107033 Insecure permissions in the MirakelInternalContentProvider component of Mirakel... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107035 Insecure permissions in the object/Page.java component of MBasov OMN Outline not... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107036 Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107038 Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows una... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107040 Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107041 Insecure permissions in the FeatureActionActivity component of Oasis Feng Island... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107025 Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107027 Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unau... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107029 Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107030 Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-106036 Szafir accepts any client or server certificate without performing certificate a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107024 Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107014 Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow una... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107016 Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107018 Insecure permissions in Ghost Commander File Manager versionCode 479 allows unau... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.