October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2021-48014 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportS... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2021-48016 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMs... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-112241 Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart sur... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114220 NT OneAPP developed by NewType Infortech has an Improper Certificate Validation... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef... |
critical | 10.0 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-27 |
| CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76301 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-76302 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76299 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-24 |
| CVE-2026-114383 A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114382 A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-96639 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-21 | 2026-10-27 |
| CVE-2026-111812 Apache Traffic Server's origin_server_auth plugin lets a client force signing of... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111814 Apache Traffic Server's default outbound session-sharing policy can reuse a pool... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111815 Apache Traffic Server can resume a TLS session across SNI virtual hosts without... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111809 Apache Traffic Server allows request smuggling via HEAD requests that carry Cont... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111811 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated ne... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-114268 A flaw has been found in Tenda BE3L Pro 16.03.60.62. |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated clien... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111816 Apache Traffic Server forwarded a malformed 302 response that should have been r... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabi... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76474 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76475 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76466 A vulnerability in the database service feature of Cisco Expressway Series could... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76473 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-20043 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111852 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111832 Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111834 Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109618 PHP Memory Corruption Vulnerability |
critical | 9.8 | Listed | PHP Group / PHP | 2026-10-21 | 2026-10-29 |
| CVE-2026-87095 Sensitive information disclosure and manipulation due to improper authorization... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shar... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-113744 A security vulnerability has been detected in Tenda AC19 16.03.10.07. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114119 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114108 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vul... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-113736 A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.