October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107571 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112151 A weakness has been identified in vraj404 Criminal Management System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112149 A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112287 Krayin CRM before 2.2.7 contains a broken object level authorization vulnerabili... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112264 BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-r... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112146 A vulnerability was detected in D-Link E15, M32, R15 and R32. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112262 RisingWave before 3.1.0 contains a missing authorization vulnerability that allo... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112263 Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerabi... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112143 A security flaw has been discovered in satya-vinay Events-Management-System up t... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112142 A vulnerability was identified in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-103314 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). |
high | 7.4 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-88900 Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups co... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112139 A vulnerability has been found in subhajitkhan online-clinic-management-system u... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-88901 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85250 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85251 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80312 Improper Authentication vulnerability in Apache Camel OAuth component. |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80343 Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP c... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80344 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-83531 Improper Control of Generation of Code ('Code Injection'), Improper Neutralizati... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79983 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79984 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79985 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79986 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-78164 Improper Neutralization of Special Elements Used in a Template Engine and Exposu... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-78165 Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis com... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-64943 Insertion of Sensitive Information into Log File vulnerability in Apache Answer. |
high | 8.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111408 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey M... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111398 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108762 Path-confinement bypass during metadata backup deletion in Apache Kylin. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-104679 VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML externa... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-16460 A flaw was found in bootc and ostree. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-21 |
| CVE-2026-76740 A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms,... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-21 |
| CVE-2026-112082 A vulnerability was identified in sgl-project SGLang up to 0.5.19. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111440 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactor... |
high | 7.0 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.