October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,390
Critical
1,328
High
5,808
Medium
6,216
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111702 ChatOllama through commit 96c3ce5 contains an insecure direct object reference v... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111706 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 contains an insecure direct obj... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows a... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111701 OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability t... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111691 WIMOOR through commit ec86736 contains an authentication bypass vulnerability th... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111681 EFAK through 5.1.0 contains a missing authorization vulnerability that allows au... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111684 Magistrala through 1.0.0 contains an authorization bypass vulnerability that all... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111685 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111686 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentic... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111680 APIPark through 1.9.7-beta contains an authorization bypass vulnerability that a... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111671 Cube-studio through 2026.09.01 contains an insecure direct object reference vuln... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111663 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111650 ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111644 Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerabilit... |
high | 7.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111638 sshportal through 1.19.5 contains a missing authorization vulnerability in the m... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111639 bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111642 FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111633 ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111634 Helical Insight through 7.0.0 contains an sql injection vulnerability that allow... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111627 HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allow... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111612 netdisk-fast-download through 0.4.8 contains an information disclosure vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111613 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability t... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111605 Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileCo... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111606 Huly Platform through 0.7.432 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111607 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in Free... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-109588 Numeric truncation of the buffer length in the MPU buffer authorization check in... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-102551 Improper verification of the source of a communication channel in the IPv6 Route... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. |
high | 8.8 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-28 |
| CVE-2026-86047 MariaDB server is a community developed fork of MySQL server. |
high | 7.7 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-86008 Mailu is a mail server distributed as a set of Docker images. |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-77474 destructive_command_guard (dcg) is a command-line safety tool that blocks destru... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-96424 Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-92263 SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-77630 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-57486 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-57487 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.