October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103030 Dio is a powerful HTTP client for Dart and Flutter. |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-79609 XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-57... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-79610 XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-55376 Heym builds and runs agentic systems and business-process automations on self-ho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110025 A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109525 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109605 A security vulnerability has been detected in SourceCodester Simple Cafe Billing... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability |
high | 8.6 | Listed | Ivanti / Connect Secure | 2026-10-13 | 2026-10-13 |
| CVE-2026-102699 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102702 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-95114 libwebsockets contains an out-of-bounds read vulnerability in the LEJP increment... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95115 Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote att... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95121 An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95122 mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::Genera... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95124 Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95127 An issue in libass v.0.17.5 allows a remote attacker to cause a denial of servic... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-65198 Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both au... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-53418 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for An... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53420 Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an u... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-11731 An authentication bypass vulnerability in the listed NETGEAR RAX series models a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11732 An insufficient input validation vulnerability in the website blocking feature (... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109521 A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109522 A vulnerability has been found in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109523 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108184 Improper certificate validation in certain Zoom Clients for Windows may allow an... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108185 Improper certificate validation in the My Notes feature of certain Zoom Clients... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-93907 IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to b... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-95680 IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attac... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-74045 Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74034 Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgra... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74035 Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnera... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-74036 Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability wh... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users wit... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch betwe... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109965 Serena before 2.0.0 contains an improper link resolution vulnerability that allo... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109967 yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that all... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109956 NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier th... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109676 FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability i... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-13 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.