October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110873 Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability th... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110865 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110867 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110868 Renovate before 44.79.0 contains a server-side request forgery vulnerability tha... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SM... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110858 GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerabilit... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110859 GitPython before 3.2.0 contains an argument injection vulnerability in Head.chec... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110863 Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentica... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110864 Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vu... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110856 GitPython before 3.2.0 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110857 GitPython before 3.2.0 contains a remote code execution vulnerability that allow... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a he... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OF... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110830 FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-71854 OpenAEV is an open source platform allowing organizations to plan, schedule and... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-96540 An improper access control vulnerability has been identified in the SonicWall Ne... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-61844 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57489 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-57490 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57492 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-61843 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110670 A vulnerability was found in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110679 A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104108 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103977 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Co... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55681 WeGIA is a web manager for charitable institutions. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55682 WeGIA is a web manager for charitable institutions. |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55381 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55382 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55383 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110668 A weakness has been identified in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-102986 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-73252 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-73260 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-73261 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-63626 Mongoose is an embedded web server and network library. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53999 Radius is a cloud-native, portable application platform that makes app developme... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.