October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as im... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-96778 Pillow is a Python imaging library. |
high | 8.8 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-96640 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-96644 Pillow is a Python imaging library. |
high | 8.1 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-82987 There exists a screen capture endpoint in vCast media streaming service in ViewS... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-29001 TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that all... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114144 toml-node is a TOML parser for Node.js and the browser. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114145 GitPython is a python library used to interact with Git repositories. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114137 Django REST framework is a toolkit for building Web APIs. |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114138 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114135 Jupyter Server is the backend for Jupyter web applications. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114136 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-112408 Missing verification of source of a communication channel in the default_bucket(... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-111805 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111808 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111810 Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-79976 The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78118 The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a t... |
high | 7.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-19676 The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-113870 MongoDB Compass improperly escapes certain BSON values when converting a stored... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114267 A vulnerability was detected in SourceCodester Food Order Management System 1.0. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111804 Apache Traffic Server's experimental wasm plugin has a use-after-free in its tra... |
high | 8.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2025-55702 When a client sends a POST with Expect: 100-continue and the origin answers befo... |
high | 8.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-31699 Apache Traffic Server can return an origin connection to the shared pool while t... |
high | 8.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-92206 CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vu... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92207 MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92208 NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92209 NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92210 NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-89035 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability i... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-92183 GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnera... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92202 Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Exe... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92203 Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forger... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92204 Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerabil... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114262 A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114263 A vulnerability was identified in ProjectWorlds Advanced Library Management Syst... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-110744 A flaw was found in multicluster-global-hub-operator-bundle. |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111184 NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.