October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114221 NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerabili... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114219 NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a s... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a den... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denia... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Web... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object inject... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe... |
high | 8.3 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114716 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
high | 8.5 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP co... |
high | 7.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI lo... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted defau... |
high | 8.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114715 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorre... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos b... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vuln... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerabil... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernet... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1... |
high | 8.2 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-27 |
| CVE-2026-16255 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 bef... |
high | 7.1 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3... |
high | 7.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76526 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76300 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76306 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could u... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76307 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76293 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user... |
high | 7.2 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76298 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold... |
high | 8.8 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76288 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unau... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76290 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76291 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
high | 8.8 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114439 A vulnerability was determined in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114440 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114441 A weakness has been identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.