October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111923 Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM e... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112021 snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_jso... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112262 RisingWave before 3.1.0 contains a missing authorization vulnerability that allo... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112287 Krayin CRM before 2.2.7 contains a broken object level authorization vulnerabili... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111045 CLI Bridge provides filesystem access within a workspace root. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112264 BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112308 crewai-tools through 1.15.28 contains a server-side request forgery vulnerabilit... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112366 Picomatch through 4.0.7 contains a regular expression denial of service vulnerab... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111759 markdown-it is a Markdown parser. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-58098 When semop(2) blocks waiting for a semaphore condition, it releases the per-set... |
high | 8.4 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-110031 The Salon Booking System WordPress plugin before 10.31.11 does not prevent users... |
high | 7.2 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110981 The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly esc... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-96534 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Cal... |
high | 7.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-58099 When copying knotes from a parent kqueue to a child, the copy code did not corre... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-58100 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-103839 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103838 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103837 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103836 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103835 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103834 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103833 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103832 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103830 Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-111441 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObj... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111440 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactor... |
high | 7.0 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109855 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-78164 Improper Neutralization of Special Elements Used in a Template Engine and Exposu... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80312 Improper Authentication vulnerability in Apache Camel OAuth component. |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-88901 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109841 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109869 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109924 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109932 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111215 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulner... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-112149 A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.