October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111605 Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileCo... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111606 Huly Platform through 0.7.432 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111607 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in Free... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-109588 Numeric truncation of the buffer length in the MPU buffer authorization check in... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-102551 Improper verification of the source of a communication channel in the IPv6 Route... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. |
high | 8.8 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-28 |
| CVE-2026-86047 MariaDB server is a community developed fork of MySQL server. |
high | 7.7 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-86008 Mailu is a mail server distributed as a set of Docker images. |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-77474 destructive_command_guard (dcg) is a command-line safety tool that blocks destru... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-96424 Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-92263 SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-77630 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-57486 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-57487 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-57488 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.1 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-46472 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-48503 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-48741 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-41582 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-42269 countly-server is the server-side part of Countly, a product analytics solution. |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-42270 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102941 The package github.com/gomarkdown/markdown is a Go library for parsing Markdown... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-26 |
| CVE-2026-95183 An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-88755 Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections wi... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107621 JPEGParser can enter an infinite loop while parsing a specially crafted or trunc... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105667 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge mes... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-106705 ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105273 MP4Parser does not adequately validate MP4 box sizes. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-101021 MultipartInputStream performs inefficient boundary matching and unnecessary buff... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111413 Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Hel... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-63618 Exposure of Sensitive Information (system level configuration info) to an Unauth... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-68571 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111396 Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Mana... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111399 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107564 An unauthenticated remote attacker may use an allocation of resources without li... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105958 A flaw was found in spice-server. |
high | 7.5 | — | — | 2026-10-16 | 2026-11-04 |
| CVE-2026-111391 SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluat... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107648 The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105959 A flaw was found in spice-server. |
high | 7.5 | — | — | 2026-10-16 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.