October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112345 TTLock Android application before v9.8.260718 and associated smart-lock firmware... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in... |
high | 7.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability th... |
high | 7.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115189 A server-side template injection vulnerability exists in the Twig theme renderin... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115190 An insecure deserialization (PHP object injection) vulnerability exists in Mauti... |
high | 8.0 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115191 A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Ma... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115192 An SQL Injection vulnerability exists in the dashboard widget data API endpoint... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115193 A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail v... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-94380 Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSA... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116260 A weakness has been identified in libimobiledevice up to 1.4.0. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115717 Frappe Builder versions before 1.36.1 contain a server-side request forgery vuln... |
high | 7.7 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116256 A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116257 A vulnerability was determined in BillaBear up to 2025.01.03. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115608 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115948 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116237 A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. |
high | 8.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116253 A vulnerability was determined in DedeCMS 5.7.118. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82944 SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data tr... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82947 SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame proces... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116236 A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. |
high | 7.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-70388 SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device... |
high | 8.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111841 Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116230 A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24... |
high | 7.8 | — | Ndemiccreations / plague inc | 2026-10-26 | 2026-10-29 |
| CVE-2026-107899 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107900 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107894 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107895 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107896 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107897 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107898 V-SFT provided by FUJI ELECTRIC CO., LTD. |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113345 Electronic delivery item Inspection Support System provided by Japan's Ministry... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116117 A flaw has been found in halo-dev halo up to 2.27.0-beta.1. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116116 A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116110 A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116112 A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116098 A vulnerability was detected in SteelRaven7 Ravenfield 25407073. |
high | 7.8 | — | Steelraven7 / ravenfield | 2026-10-26 | 2026-10-29 |
| CVE-2026-116099 A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplay... |
high | 8.8 | — | Fcs-ex / scp\ | 2026-10-26 | 2026-10-29 |
| CVE-2026-116094 A vulnerability was determined in EyouCMS up to 1.8.3. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116061 A vulnerability was identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.