October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,028
Low
636
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (150), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103401 An Improper Link Resolution Before File Access ('Link Following') vulnerability... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Junip... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103403 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-100105 A user with permission to edit contact points but not their protected fields can... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93521 A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server bef... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93522 A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO pa... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-56828 Shopper is a Headless e-commerce Admin Panel. |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59979 YosemiteCrew provides organization-based service and task management. |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-67187 Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-sid... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116778 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', be... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93518 An integer truncation issue in XkbResizeKeyType() that could lead to a heap buff... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93519 A buffer overflow when handling pointer barriers in the XFIXES extension in X.Or... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93520 A heap buffer overflow caused by mismatching size calculations between XkbAllocN... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59185 identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kube... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-52729 Xibo is an open source digital signage platform with a web content management sy... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59164 NORA is a self-hosted artifact registry and pull-through cache. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59177 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59179 OpenHop is a tool for creating interactive data-flow diagrams. |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116389 Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116390 Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything —... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115590 Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allow... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115603 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Co... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118035 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118036 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118038 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118039 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118040 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115612 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116391 Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116392 Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordi... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116393 Missing Authorization vulnerability in iHomefinder, Inc. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111850 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115591 Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Con... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.