October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,378
Critical
3,097
High
6,948
Medium
6,667
Low
597
Severity not reported
4,069
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (671), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-0234 An improper verification of cryptographic signature vulnerability exists in Cort... |
critical | 9.1 | — | Paloaltonetworks / cortex xsiam | 2026-04-13 | 2026-10-26 |
| CVE-2026-2332 In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when ch... |
critical | 9.1 | — | Eclipse / jetty | 2026-04-14 | 2026-10-26 |
| CVE-2026-27243 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cro... |
critical | 9.3 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-27245 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cro... |
critical | 9.3 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-27303 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserializati... |
critical | 9.6 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-5189 CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager vers... |
critical | 9.8 | — | Sonatype / nexus repository manager | 2026-04-15 | 2026-10-26 |
| CVE-2026-27820 zlib is a Ruby interface for the zlib compression/decompression library. |
critical | 9.8 | — | Ruby-lang / zlib | 2026-04-16 | 2026-10-26 |
| CVE-2026-40518 ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary... |
critical | 9.1 | — | Bytedance / deerflow | 2026-04-17 | 2026-10-26 |
| CVE-2026-33516 xrdp is an open source RDP server. |
critical | 9.1 | — | Neutrinolabs / xrdp | 2026-04-17 | 2026-10-26 |
| CVE-2026-33689 xrdp is an open source RDP server. |
critical | 9.1 | — | Neutrinolabs / xrdp | 2026-04-17 | 2026-10-26 |
| CVE-2026-5720 miniupnpd contains an integer underflow vulnerability in SOAPAction header parsi... |
critical | 9.1 | — | Miniupnp Project / miniupnpd | 2026-04-17 | 2026-10-26 |
| CVE-2026-40487 Postiz is an AI social media scheduling tool. |
critical | 9.0 | — | Gitroom / postiz | 2026-04-18 | 2026-10-26 |
| CVE-2026-6643 A stack-based buffer overflow vulnerability was found in the VPN Clients on the... |
critical | 9.9 | — | Asustor / data master | 2026-04-20 | 2026-10-26 |
| CVE-2026-6644 A command injection vulnerability was found in the PPTP VPN Clients on the ADM. |
critical | 9.1 | — | Asustor / data master | 2026-04-20 | 2026-10-26 |
| CVE-2026-40892 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.8 | — | Pjsip / pjsip | 2026-04-21 | 2026-10-26 |
| CVE-2026-40910 frp is a fast reverse proxy. |
critical | 9.1 | — | Fatedier / frp | 2026-04-21 | 2026-10-26 |
| CVE-2026-5845 An improper authorization vulnerability in scoped user-to-server (ghu_) token au... |
critical | 9.6 | — | Github / enterprise server | 2026-04-21 | 2026-10-26 |
| CVE-2026-41144 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
critical | 9.8 | — | Nasa / fprime | 2026-04-22 | 2026-10-26 |
| CVE-2026-6023 In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the R... |
critical | 9.8 | — | Progress / telerik ui for asp.net ajax | 2026-04-22 | 2026-10-26 |
| CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code cal... |
critical | 9.1 | — | Powerdns / dnsdist | 2026-04-22 | 2026-10-26 |
| CVE-2026-33608 An attacker can send a notify request that causes a new secondary domain to be a... |
critical | 9.8 | — | Powerdns / authoritative | 2026-04-22 | 2026-10-26 |
| CVE-2026-26354 Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Re... |
critical | 9.8 | — | Dell / powerprotect dp series appliance | 2026-04-22 | 2026-10-26 |
| CVE-2026-41211 Vite+ is a unified toolchain and entry point for web development. |
critical | 10.0 | — | Voidzero / vite\+ | 2026-04-23 | 2026-10-26 |
| CVE-2026-41247 elFinder is an open-source file manager for web, written in JavaScript using jQu... |
critical | 9.8 | — | Std42 / elfinder | 2026-04-23 | 2026-10-26 |
| CVE-2026-41264 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41267 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-26150 Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized a... |
critical | 10.0 | — | Microsoft / purview ediscovery | 2026-04-23 | 2026-10-26 |
| CVE-2026-33819 Deserialization of untrusted data in Microsoft Bing allows an unauthorized attac... |
critical | 9.8 | — | Microsoft / bing | 2026-04-23 | 2026-10-26 |
| CVE-2026-41274 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41415 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-04-24 | 2026-10-26 |
| CVE-2026-41473 CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerabilit... |
critical | 9.1 | — | Cyberpanel / cyberpanel | 2026-04-24 | 2026-10-26 |
| CVE-2026-7248 A vulnerability was found in D-Link DI-8100 16.07.26A1. |
critical | 9.4 | — | Dlink / di-8100 firmware | 2026-04-28 | 2026-10-26 |
| CVE-2026-22070 ColorOS Assistant has an unauthenticated start-download channel, leading to file... |
critical | 9.8 | — | Oppo / coloros assistant | 2026-04-30 | 2026-10-26 |
| CVE-2026-42799 Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow... |
critical | 9.8 | — | Asrmicro / asr1803 firmware | 2026-04-30 | 2026-10-26 |
| CVE-2026-33447 CVE-2026-33447 is a buffer overflow in a message parsing function of the
Secure... |
critical | 9.8 | — | Absolute / secure access | 2026-04-30 | 2026-10-26 |
| CVE-2026-2311 IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by... |
critical | 9.8 | — | Ibm / i | 2026-04-30 | 2026-10-26 |
| CVE-2026-42994 Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtaine... |
critical | 9.8 | — | Bitwarden / cli | 2026-05-01 | 2026-10-26 |
| CVE-2026-44603 Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN c... |
critical | 9.1 | — | Torproject / tor | 2026-05-07 | 2026-10-26 |
| CVE-2026-41586 Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framew... |
critical | 9.8 | — | Hyperledger / fabric | 2026-05-07 | 2026-10-26 |
| CVE-2026-112393 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.