October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string ke... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encodi... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecti... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffer... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110680 Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds whe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scal... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking chan... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110684 Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retai... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110673 Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-6719 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111759 markdown-it is a Markdown parser. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-107084 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site requ... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-26 |
| CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-12148 IBM MQ Operator could allow an authenticated attacker to cause a denial of servi... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10743 IBM MQ could allow an authenticated attacker to cause a denial of service or cor... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10572 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10574 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-107082 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticate... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107186 An unauthenticated user can send a DWR request with isPasswordUppercase as one c... |
high | 8.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107187 A user can access any database details, such as usernames and passwords by sendi... |
high | 8.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2025-10149 The SCIM endpoint does not sufficiently validate authorization for federated use... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112309 @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPat... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112366 Picomatch through 4.0.7 contains a regular expression denial of service vulnerab... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112368 An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112304 docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pre... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112305 Semaphore UI through 2.19.16 contains a remote code execution vulnerability that... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112306 NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injectio... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112307 sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows a... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112308 crewai-tools through 1.15.28 contains a server-side request forgery vulnerabilit... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112152 A security vulnerability has been detected in vraj404 Criminal-Management-System... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112153 A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d05... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111045 CLI Bridge provides filesystem access within a workspace root. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109431 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing autho... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.