October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54526 Argo Workflows is an open source container-native workflow engine for orchestrat... |
critical | 9.9 | — | Argoproj / argo workflows | 2026-07-16 | 2026-10-24 |
| CVE-2026-44181 Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr... |
critical | 10.0 | — | Jupyter / enterprise gateway | 2026-07-16 | 2026-10-24 |
| CVE-2026-44182 Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr... |
critical | 10.0 | — | Jupyter / enterprise gateway | 2026-07-16 | 2026-10-24 |
| CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. |
critical | 9.8 | — | — | 2026-07-17 | 2026-10-24 |
| CVE-2026-8297 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-07-17 | 2026-10-24 |
| CVE-2026-13448 IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated re... |
critical | 9.8 | — | Langflow / langflow | 2026-07-17 | 2026-10-24 |
| CVE-2026-13473 IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 throu... |
critical | 9.8 | — | Ibm / storage protect | 2026-07-17 | 2026-10-24 |
| CVE-2026-46420 setup-php is a GitHub action to set up PHP with extensions, php.ini configuratio... |
critical | 9.8 | — | Shivammathur / setup php | 2026-07-17 | 2026-10-24 |
| CVE-2026-41521 xrdp is an open source RDP server. |
critical | 9.1 | — | Neutrinolabs / xrdp | 2026-07-20 | 2026-10-24 |
| CVE-2026-12341 This vulnerability
impacts all versions of IdentityIQ and allows an unauthentica... |
critical | 9.8 | — | Sailpoint / identityiq | 2026-07-20 | 2026-10-24 |
| CVE-2026-16439 In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments c... |
critical | 9.1 | — | Eclipse / openj9 | 2026-07-21 | 2026-10-24 |
| CVE-2026-16441 In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previo... |
critical | 9.6 | — | Eclipse / openj9 | 2026-07-21 | 2026-10-24 |
| CVE-2026-8983 Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authen... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-8984 Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remot... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-8985 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-8986 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command... |
critical | 9.8 | — | Autel / maxicharger single charger firmware | 2026-07-21 | 2026-10-24 |
| CVE-2026-65400 Apple macOS Improper Authentication Vulnerability |
critical | 9.8 | Listed | Apple / macOS | 2026-08-06 | 2026-10-24 |
| CVE-2026-69258 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.1 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-69263 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-69264 Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-64993 Dell RVTools versions prior to 4.8.1, contains an improper certificate validatio... |
critical | 9.1 | — | Dell / rvtools | 2026-08-06 | 2026-10-24 |
| CVE-2026-54489 Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.... |
critical | 9.8 | — | Dell / virtual storage integrator | 2026-08-06 | 2026-10-24 |
| CVE-2026-62836 Improper restriction of communication channel to intended endpoints in Azure SQL... |
critical | 10.0 | — | Microsoft / azure sql managed instance | 2026-08-07 | 2026-10-24 |
| CVE-2026-57104 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.6 | — | Microsoft / azure storage explorer | 2026-08-11 | 2026-10-24 |
| CVE-2026-65768 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / teams | 2026-08-11 | 2026-10-24 |
| CVE-2026-112859 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112858 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos all... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112856 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vaga... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112855 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112854 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center h... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112851 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotloc... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112848 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112847 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112846 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-61174 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
critical | 9.0 | — | Oracle / product lifecycle analytics | 2026-07-21 | 2026-10-24 |
| CVE-2026-70470 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-70477 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-70478 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 10.0 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-73032 PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a... |
critical | 9.6 | — | — | 2026-08-11 | 2026-10-24 |
| CVE-2026-73487 Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-13 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.