October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86409 Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
c... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host
verifica... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86412 A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113808 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113810 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol ser... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-100134 Acrobat for Edge is affected by an out-of-bounds write vulnerability that could... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-28328 SolarWinds Observability Self-Hosted was found to be affected by a broken author... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113658 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113682 Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vul... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in t... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113613 FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113605 Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in Databa... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112836 Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentca... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111764 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111765 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2025-71436 Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-95168 An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary cod... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113397 A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112940 filelock is a platform-independent file lock for Python. |
high | 7.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-22 |
| CVE-2026-88041 Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91041 Mounting an attacker-controlled FAT image with fault tolerance enabled causes an... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connection... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-80353 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113394 A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113395 A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113396 A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-34485 Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability w... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113619 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH b... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113392 A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105941 The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105311 The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant w... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-105949 Cruise Control's Jetty ConstraintSecurityHandler registers security constraints... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113356 DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Dra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113358 LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in t... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.