October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113912 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.1 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112688 A memory corruption issue was addressed with improved memory handling. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112655 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112659 A type confusion issue was addressed with improved memory handling. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112651 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112637 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112623 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112626 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112484 This issue was addressed with improved file handling. |
high | 7.8 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112457 A double free issue was addressed with improved memory management. |
high | 7.1 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112438 A logic issue was addressed with improved state management. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112427 An authentication issue was addressed with improved state management. |
high | 8.1 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-115924 Rembg is a tool to remove images background. |
high | 8.6 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104596 libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplem... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2014-125135 A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-104591 libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_paylo... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is sma... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72754 When Routinator encounters a CRL with many entries, it may hang or run out of me... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72753 When Routinator encounters an RRDP notification file with gaps in the delta entr... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33521 There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105765 HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an a... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105626 HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105608 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-81038 The Object Transfer Service server builds its Object Action Control Point (OACP)... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116612 A flaw was found in GStreamer Editing Services (gst-editing-services). |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-115907 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-115908 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115909 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115912 vLLM is an inference and serving engine for large language models. |
high | 8.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-115418 SQL injection in the database-query custom resource handlers in the Amazon Web S... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107091 An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a loc... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116368 A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116489 Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability tha... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115721 **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysp... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115748 **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all version... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112343 Syncplify Server! |
high | 8.1 | — | — | 2026-10-26 | 2026-10-28 |
| CVE-2026-90885 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116339 A vulnerability was determined in iFlytek astron-agent up to 1.1.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.