October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,367
Critical
1,327
High
5,803
Medium
6,210
Low
649
Severity not reported
3,378
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107019 Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterf... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107021 Insecure permissions in the CardProvider content provider component of helloworl... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-79589 The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure acc... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113695 Reflected cross-site scripting in the SmartIT inline-image attachment feature of... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113696 Improper authorization in the SmartIT change approval feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113697 Reflected cross-site scripting in the agent query feature of BMC Helix Operation... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113691 Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT S... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113692 Path traversal in the SmartIT file-management feature of BMC IT Service Manageme... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113693 Exposure of sensitive information in the SmartIT system-account settings of BMC... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113694 Improper authorization in the SmartIT user attachment feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113688 Server-side request forgery in the SmartIT URL-based attachment feature of BMC I... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113689 Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113690 Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5699 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5700 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5697 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-5698 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that all... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115942 A misconfigured wildcard TLS certificate causes a stack read overflow. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114230 When dispatching SASL frames to authenticate the peer, Proton will also dispatch... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105031 When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105042 A message body that is deeply nested and decoded by pn_message_body() could over... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117611 Improper certificate validation in Checkmk |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-7190 A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114358 This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient v... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2025-62841 An use of hard-coded cryptographic key vulnerability has been reported to affect... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117174 Rejected reason: VUL-2026-008368 為先回報之相同問題 |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2025-62839 An use of hard-coded cryptographic key vulnerability has been reported to affect... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118426 In affected versions of Octopus Server with the LDAP authentication provider ena... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66092 In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendere... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66088 In openEQUELLA before 2026.1, the system.execute() function available to the scr... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66089 In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit o... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66090 In openEQUELLA before 2026.1, the XML parser used for item metadata does not dis... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66091 In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint per... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-16889 In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-21157 Improper input validation in Bixby prior to version 4.0.85.6 allows privileged l... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-113957 An attacker who controls the registry, a mirror, or the network path to it may b... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86983 A remote attacker may be able to terminate a process that passes attacker-contro... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-55561 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111478 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.