October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65689 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa... |
critical | 9.8 | — | Syncfusion / standalone report designer | 2026-07-23 | 2026-10-29 |
| CVE-2026-61451 The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin... |
critical | 9.6 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-54390 JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection... |
critical | 9.8 | — | — | 2026-06-18 | 2026-10-29 |
| CVE-2026-31158 SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 a... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-105215 ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in... |
critical | 9.1 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-107032 Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allo... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105207 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user... |
critical | 9.8 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105209 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorizati... |
critical | 9.6 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2025-71334 Flowise before 3.0.6 contains an arbitrary file access vulnerability due to miss... |
critical | 9.8 | — | Flowiseai / flowise | 2026-06-25 | 2026-10-29 |
| CVE-2024-8517 SPIP before 4.3.2, 4.2.16, and
4.1.18 is vulnerable to a command injection issu... |
critical | 9.8 | — | Spip / spip | 2024-09-06 | 2026-10-29 |
| CVE-2026-83693 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-72765 n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in ex... |
critical | 9.9 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-62008 Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62013 Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62018 Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54859 Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62002 Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107015 Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized a... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-83517 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83519 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83578 Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthori... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-90532 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-91222 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86411 An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
co... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-87866 When built with wolfSSL, curl can successfully validate a pinned public key
hash... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-65590 n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restri... |
critical | 9.8 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-63190 FearlessCMS is a flat-file `content` management system centered on simplicity an... |
critical | 9.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115893 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-112380 Missing authorization in the WhatsApp group channel in Kiro Crew might allow a r... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113867 Thunderbird did not escape attribute values when serializing outgoing XMPP stanz... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83748 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-90531 Adobe Experience Manager is affected by an Improper Restriction of XML External... |
critical | 9.6 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-83523 Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83910 Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-97406 XERJ Console API bearer tokens can bypass the passkey‑only authentication requir... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-89009 WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 cont... |
critical | 9.1 | — | — | 2026-09-11 | 2026-10-29 |
| CVE-2026-89010 WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 cont... |
critical | 9.8 | — | — | 2026-09-11 | 2026-10-29 |
| CVE-2026-76527 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-62001 Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62006 Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.