October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (744), oracle (154), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87086 Tanium addressed a denial of service vulnerability in Provision. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-88812 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland b... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116682 FileBrowser Quantum is a free, self-hosted, web-based file manager. |
high | 8.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117515 A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117516 A weakness has been identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116676 Atlantis is a self-hosted golang application that listens for Terraform pull req... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply. |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce. |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116656 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108329 Tanium addressed an unauthorized code execution vulnerability in Threat Response... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108305 Tanium addressed a local privilege escalation vulnerability in End-User Notifica... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108306 Tanium addressed a local privilege escalation vulnerability in End-User Notifica... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108307 Tanium addressed a heap-based buffer overflow vulnerability in Index. |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108303 Tanium addressed an unauthorized code execution vulnerability in Certificate Man... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108304 Tanium addressed a local privilege escalation vulnerability in End-User Notifica... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57201 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-77167 Abusing the federated share endpoint, an attacker can write arbitrary rows into... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117514 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-48379 Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-114598 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117512 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117513 A vulnerability was determined in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112353 GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-s... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path throug... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-114596 In EPICS Base release 7.0.10 and prior, an improper validation of message length... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-109089 A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could ov... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-109090 A malicious X server could cause a heap overflow by injecting a large DEVICE_ENA... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102637 A maliciously crafted HTML payload in the documentName parameter of a Fusion pro... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102638 A maliciously crafted HTML payload in the description of an electronic library (... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-104349 Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulner... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102636 A maliciously crafted HTML payload in a design name, when displayed after anothe... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-92376 Improper authentication in the
inter-process communication (IPC) mechanism of Te... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-92377 Improper access control in the Patch
Management update mechanism of TeamViewer F... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117511 A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-92372 An out-of-bounds write vulnerability in the
screen-image decoder of TeamViewer F... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-92374 A time-of-check time-of-use (TOCTOU) race condition combined with improper symbo... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.