October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112368 An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107571 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107186 An unauthenticated user can send a DWR request with isPasswordUppercase as one c... |
high | 8.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107187 A user can access any database details, such as usernames and passwords by sendi... |
high | 8.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-105299 Summary
Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105941 The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105297 Summary
Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's defau... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-109443 JoySafeter through 1.0.0 contains a remote code execution vulnerability that all... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77926 Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenti... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77937 Letta through 0.16.8 contains an authentication bypass vulnerability that allows... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113352 uTox through 0.18.1 contains a path traversal vulnerability that allows Tox frie... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113358 LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in t... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77934 Coze Studio before 0.5.0 contains an insecure default configuration that allows... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77935 Coze Studio through 0.5.1 contains an insecure direct object reference vulnerabi... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113356 DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Dra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113605 Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in Databa... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in t... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery... |
high | 8.8 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-20 |
| CVE-2026-111764 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol ser... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-84975 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.4 | — | Teluu / pjsip | 2026-09-18 | 2026-10-20 |
| CVE-2026-113619 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH b... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-91041 Mounting an attacker-controlled FAT image with fault tolerance enabled causes an... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-61411 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertio... |
high | 7.7 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-76105 Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of In... |
high | 7.1 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-108116 In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter... |
high | 7.5 | — | Progress / kendo ui | 2026-10-15 | 2026-10-20 |
| CVE-2026-57488 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.1 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-77630 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111090 A logic error exists in the signature verification routine resulting in acceptan... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113469 A failure has been identified in the SNS during dynamic data files signature che... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113808 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113810 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-108089 ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an u... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75996 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability tha... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-113404 WebITR developed by Uniong has a Insecure Deserialization vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113407 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.