October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,300
Critical
1,323
High
5,783
Medium
6,188
Low
643
Severity not reported
3,363
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114123 D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114258 A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114489 Missing authorization in the REST and COM administration APIs of Progressive Rob... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114490 Incorrect authorization in the COM administration API of Progressive Robot hMail... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114463 The webhook platform gateway in Nous Research Hermes Agent versions builds the s... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114476 Incorrect authorization in the REST administration API of Progressive Robot hMai... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114257 A security vulnerability has been detected in oretnom23 file-management-system-p... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114254 A vulnerability was identified in oretnom23 file-management-system-php up to 2e3... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114255 A security flaw has been discovered in oretnom23 file-management-system-php up t... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114256 A weakness has been identified in oretnom23 file-management-system-php up to 2e3... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-102486 Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-102483 Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to te... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-98869 In the Linux kernel, the following vulnerability has been resolved:
bpf: Infer... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-24 |
| CVE-2026-111848 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-112221 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113779 The pfSense REST API package is an unofficial, open-source REST and GraphQL API... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-111833 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2023-7356 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-114249 A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5ed... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-109619 PHP Stale Internal Request-State Vulnerability |
high | 8.1 | Listed | PHP Group / PHP | 2026-10-21 | 2026-10-30 |
| CVE-2025-0326 The system fails to invalidate existing access tokens associated with sub-organi... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-97313 A recursive BIND server that receives a query with recursion desired (RD=1) foll... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-94300 Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`name... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-96888 A BIND resolver that is configured with both a "redirect" zone and "qname-minimi... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-86146 Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) i... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-86147 External control of file name or path and uncontrolled resource consumption in A... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-82231 A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which i... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-82425 A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-82942 A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a re... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-84747 Interpretation conflict in the HTTP protocol implementation in Apache bRPC (vers... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-84748 Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allow... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-82210 Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0)... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-82230 Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure wi... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allo... |
high | 7.5 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114396 Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability... |
high | 7.1 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114397 Trudesk through 1.2.11 contains a missing authentication vulnerability in debug... |
high | 7.4 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.