October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,027
Low
637
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (145), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118683 MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118686 EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulner... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118688 wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 befor... |
high | 7.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118679 n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery v... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118648 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stor... |
high | 7.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118649 n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118675 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulne... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118676 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118678 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulner... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118643 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credenti... |
high | 8.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118644 n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execu... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118645 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filt... |
high | 8.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118647 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTa... |
high | 8.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118633 A path traversal vulnerability allows a remote unauthenticated attacker to execu... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118641 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an ODa... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118257 Vue I18n is the internationalization plugin for Vue.js. |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplie... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116795 RE2JS is the JavaScript port of RE2, a regular expression engine that provides l... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93523 A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88967 A user with query access to an Azure Monitor data source in Grafana can cause se... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-82961 The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the p... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118619 Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerabi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118610 Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Exe... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118613 Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution V... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118614 Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118615 Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerabilit... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118616 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118617 Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Cod... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118618 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118602 Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation V... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118603 Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118605 Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118606 Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Executi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118510 A type-handling flaw in the relationship query building of this MongoDB integrat... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-106079 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103410 An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Netw... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Ses... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103407 An Improper Limitation of a Pathname to a Restricted Directory vulnerability in... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103408 A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Ses... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.