October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,432
Critical
1,333
High
5,825
Medium
6,236
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76661 A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can cor... |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77931 MoviePilot through 3.1.5 contains a command injection vulnerability that allows... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-73799 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76066 IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypa... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-76659 A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109430 Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) in... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-0993 SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vuln... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110873 Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability th... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110865 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110867 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110868 Renovate before 44.79.0 contains a server-side request forgery vulnerability tha... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SM... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110858 GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerabilit... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110859 GitPython before 3.2.0 contains an argument injection vulnerability in Head.chec... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110863 Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentica... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110864 Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vu... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110856 GitPython before 3.2.0 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110857 GitPython before 3.2.0 contains a remote code execution vulnerability that allow... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a he... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OF... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110830 FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-71854 OpenAEV is an open source platform allowing organizations to plan, schedule and... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-96540 An improper access control vulnerability has been identified in the SonicWall Ne... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-61844 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57489 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-57490 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57492 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-61843 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110670 A vulnerability was found in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110679 A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104108 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103977 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Co... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55681 WeGIA is a web manager for charitable institutions. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55682 WeGIA is a web manager for charitable institutions. |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55381 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55382 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55383 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.