October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-6942 radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerabi... |
high | 8.8 | — | Radare / radare2 mcp server | 2026-04-23 | 2026-10-29 |
| CVE-2026-70638 llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability i... |
high | 7.8 | — | Ggml / llama.cpp | 2026-08-06 | 2026-10-29 |
| CVE-2026-67214 nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the custo... |
high | 7.5 | — | Nanoid Project / nanoid | 2026-07-29 | 2026-10-29 |
| CVE-2026-61861 ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the Forma... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-29 |
| CVE-2026-61870 ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF enc... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-29 |
| CVE-2026-61863 ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-07-15 | 2026-10-29 |
| CVE-2026-61857 ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-29 |
| CVE-2026-61520 Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior... |
high | 7.7 | — | — | 2026-07-14 | 2026-10-29 |
| CVE-2026-56379 ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerabi... |
high | 8.1 | — | Imagemagick / imagemagick | 2026-06-23 | 2026-10-29 |
| CVE-2026-58652 luci-app-travelmate (and the travelmate package) contain a privilege-escalation... |
high | 7.5 | — | — | 2026-07-02 | 2026-10-29 |
| CVE-2026-58660 Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() meth... |
high | 8.1 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-56378 ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bo... |
high | 8.2 | — | Imagemagick / imagemagick | 2026-06-21 | 2026-10-29 |
| CVE-2026-56368 ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple cod... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-06-24 | 2026-10-29 |
| CVE-2026-56370 ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in Co... |
high | 7.8 | — | Imagemagick / imagemagick | 2026-06-24 | 2026-10-29 |
| CVE-2026-55202 Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate th... |
high | 8.2 | — | — | 2026-06-17 | 2026-10-29 |
| CVE-2026-56361 ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validatio... |
high | 7.1 | — | Imagemagick / imagemagick | 2026-06-30 | 2026-10-29 |
| CVE-2026-43622 llama.cpp builds b1886 through b7445 contain a double free vulnerability in the... |
high | 7.8 | — | Ggml / llama.cpp | 2026-08-06 | 2026-10-29 |
| CVE-2026-43627 llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability i... |
high | 7.8 | — | Ggml / llama.cpp | 2026-08-06 | 2026-10-29 |
| CVE-2026-43628 llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bou... |
high | 7.8 | — | Ggml / llama.cpp | 2026-08-06 | 2026-10-29 |
| CVE-2026-43629 llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerabilit... |
high | 8.1 | — | Ggml / llama.cpp | 2026-08-06 | 2026-10-29 |
| CVE-2026-35632 OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.c... |
high | 7.8 | — | Openclaw / openclaw | 2026-04-09 | 2026-10-29 |
| CVE-2026-13717 A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. |
high | 8.8 | — | — | 2026-08-10 | 2026-10-29 |
| CVE-2026-118645 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filt... |
high | 8.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118649 n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118678 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulner... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118683 MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118257 Vue I18n is the internationalization plugin for Vue.js. |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118641 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an ODa... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116201 Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows... |
high | 8.8 | — | Snipeitapp / snipe-it | 2026-10-25 | 2026-10-29 |
| CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManage... |
high | 8.2 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116094 A vulnerability was determined in EyouCMS up to 1.8.3. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116112 A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-114476 Incorrect authorization in the REST administration API of Progressive Robot hMai... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114489 Missing authorization in the REST and COM administration APIs of Progressive Rob... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114490 Incorrect authorization in the COM administration API of Progressive Robot hMail... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-116061 A vulnerability was identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-107091 An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a loc... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107026 Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unaut... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.