October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115889 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-45321 TanStack Unspecified Vulnerability |
critical | 9.6 | Listed | TanStack / TanStack | 2026-05-12 | 2026-10-26 |
| CVE-2026-44335 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | Praison / praisonaiagents | 2026-05-08 | 2026-10-26 |
| CVE-2026-41583 ZEBRA is a Zcash node written entirely in Rust. |
critical | 9.1 | — | Zfnd / zebra-script | 2026-05-08 | 2026-10-26 |
| CVE-2026-41889 pgx is a PostgreSQL driver and toolkit for Go. |
critical | 9.8 | — | Jackc / pgx | 2026-05-08 | 2026-10-26 |
| CVE-2026-44694 n8n-MCP is an MCP server that provides AI assistants access to n8n node document... |
critical | 9.1 | — | N8n-mcp / n8n-mcp | 2026-05-08 | 2026-10-26 |
| CVE-2026-44400 MailEnable Enterprise Premium 10.55 and earlier contains an improper authorizati... |
critical | 9.8 | — | Mailenable / mailenable | 2026-05-08 | 2026-10-26 |
| CVE-2026-35157 Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to... |
critical | 9.8 | — | Dell / elastic cloud storage | 2026-05-11 | 2026-10-26 |
| CVE-2026-42608 Grav is a file-based Web platform. |
critical | 9.1 | — | Getgrav / grav | 2026-05-11 | 2026-10-26 |
| CVE-2026-44643 Angular Expressions provides expressions for the Angular.JS web framework as a s... |
critical | 10.0 | — | Peerigon / angular-expressions | 2026-05-11 | 2026-10-26 |
| CVE-2026-42858 Open edX Platform enables the authoring and delivery of online learning at any s... |
critical | 9.9 | — | Openedx / openedx | 2026-05-11 | 2026-10-26 |
| CVE-2026-43639 Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili... |
critical | 9.1 | — | Bitwarden / server | 2026-05-11 | 2026-10-26 |
| CVE-2026-43995 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-05-11 | 2026-10-26 |
| CVE-2026-43914 Vaultwarden is a Bitwarden-compatible server written in Rust. |
critical | 9.8 | — | Dani-garcia / vaultwarden | 2026-05-11 | 2026-10-26 |
| CVE-2026-27851 When safe filter is used with variable expansion, all following pipelines on the... |
critical | 9.1 | — | Dovecot / dovecot | 2026-05-12 | 2026-10-26 |
| CVE-2026-33821 Improper privilege management in Microsoft Dynamics 365 Customer Insights allows... |
critical | 9.9 | — | Microsoft / dynamics 365 customer insights | 2026-05-12 | 2026-10-26 |
| CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability |
critical | 10.0 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
| CVE-2026-105723 Untrusted pointer dereference in Windows Distributed File System (DFS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unau... |
critical | 9.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116232 A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116235 A flaw has been found in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110635 webp-converter before 3.0.0 contains an OS command injection vulnerability in sr... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110640 Whisper-node through 1.1.1 contains an OS command injection vulnerability that a... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-109566 Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2025-2707 A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. |
critical | 9.1 | — | Iocoder / ruoyi-vue-pro | 2025-03-24 | 2026-10-26 |
| CVE-2025-2708 A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. |
critical | 9.1 | — | Iocoder / ruoyi-vue-pro | 2025-03-24 | 2026-10-26 |
| CVE-2020-37282 office-converter through 1.0.2 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-0263 A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PA... |
critical | 9.8 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-0264 A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo... |
critical | 9.8 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-42584 Netty is an asynchronous, event-driven network application framework. |
critical | 9.1 | — | Netty / netty | 2026-05-13 | 2026-10-26 |
| CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-59106 A security vulnerability has been identified in the WolfProt interface implement... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-69634 Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69639 Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-115188 An unrestricted file upload vulnerability exists in the campaign import feature... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105010 Use after free in Microsoft Windows Search Component allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105895 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
critical | 9.9 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106626 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
critical | 9.1 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106629 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106630 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.