October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104594 libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-104324 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-101288 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2025-0326 The system fails to invalidate existing access tokens associated with sub-organi... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-63913 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
high | 8.2 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-114422 The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the cla... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114443 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plug... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117571 The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does n... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63914 In the Linux kernel, the following vulnerability has been resolved:
xfrm: route... |
high | 7.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63915 In the Linux kernel, the following vulnerability has been resolved:
nfc: hci: f... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63916 In the Linux kernel, the following vulnerability has been resolved:
HID: wacom:... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-104615 A security vulnerability was discovered in SUSE Rancher Fleet's cluster registra... |
high | 7.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63917 In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: U... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63967 In the Linux kernel, the following vulnerability has been resolved:
iio: imu: s... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63968 In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix p... |
high | 7.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-118758 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93289 The affected products are vulnerable to command injection attack that could allo... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-92390 When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
docu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92391 A deeply nested multipart MIME structure constructed via the public API causes
a... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s
`CURLINFO_EF... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92092 A flaw was found in openshift-ansible. |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-78066 Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-79704 An out-of-bounds read vulnerability exists in the streaming RPC client of Apache... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-74758 A heap use-after-free in the RTMP protocol component of Apache bRPC (versions <... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78048 A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78058 Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56836 PraisonAI is a multi-agent teams system. |
high | 8.2 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-57146 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-61671 WeGIA is a web manager for charitable institutions. |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-56832 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-39910 STACKIT IaaS API contains a missing authorization check in the PUT servers servi... |
high | 8.8 | — | — | 2026-06-08 | 2026-10-30 |
| CVE-2026-119654 DataCap through 2025.1.1 contains a missing authorization vulnerability that all... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119283 joserfc is a Python library that provides an implementation of several JSON Obje... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119290 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.