October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116871 Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnera... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116872 Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vu... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82121 Origin Validation Error Vulnerability in HiRDB. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65211 This issue may allow an authenticated IPMI Administrator to read and write arbit... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65219 A flaw in the BMC RAKP+ implementation may allow an attacker to send a request f... |
high | 7.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65220 A logic flaw in the BMC IPMI implementation may allow an attacker to send specia... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-16521 An OS command injection vulnerability exists because of insufficient input filte... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-18449 The BMC does not correctly enforce integrity and encryption requirements for IPM... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 throug... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-75891 The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Obj... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-111820 The Analytics Insights – Google Analytics Dashboard for WordPress plugin for Wor... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116839 A malicious actor who lures an authenticated user to a malicious page could expl... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116843 Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that al... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116620 A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116623 A vulnerability was detected in code-projects Simple Content Management System 1... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116816 llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116836 A malicious actor with access to the adjacent network and under certain conditio... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116837 A malicious actor with access to the adjacent network could exploit a Heap-based... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116838 A malicious actor who lures an authenticated user to a malicious page could expl... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2024-58400 llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_dec... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116818 OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vuln... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116819 OpenPanel before 3.0.0 contains an information disclosure vulnerability that all... |
high | 8.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116811 OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116808 OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authe... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111422 In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the va... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116747 Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that a... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116748 Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in hand... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116738 VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode funct... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116724 FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::l... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116587 Go JOSE provides an implementation of the Javascript Object Signing and Encrypti... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116723 FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BM... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86929 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-86916 A use after free issue was addressed with improved memory management. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65327 A logic issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-64759 An integer overflow was addressed with improved input validation. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116584 Seroval facilitates JavaScript value stringification, including complex structur... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116580 Seroval facilitates JavaScript value stringification, including complex structur... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116581 Seroval facilitates JavaScript value stringification, including complex structur... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116576 systeminformation is a System and OS information library for node.js. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113947 This issue was addressed with improved access restrictions. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.