October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77932 DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77933 DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-109442 piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-109444 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability th... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-109395 Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerabi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112371 A vulnerability was determined in H3C Magic NX15 NX15V100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112370 A vulnerability was found in H3C Magic NX15 100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112900 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112398 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112403 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112393 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
| CVE-2026-112779 Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t... |
critical | 9.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-109437 Cognition before 0.13.0 contains an unauthenticated remote code execution vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-12665 IBM MQ could allow a remote attacker to execute arbitrary code due to a stack bu... |
critical | 9.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-111862 Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a su... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107188 A user can upload export reports with any file contents and specify any contents... |
critical | 9.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107083 SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111057 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 10.0 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-111058 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109432 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression i... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST par... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112292 CheckCle through 1.6.0 contains a missing authorization vulnerability that allow... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-79983 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.1 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-79986 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.1 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-78162 Deserialization of Untrusted Data vulnerability in Apache Camel. |
critical | 9.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-71253 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79624 Insufficient session expiration vulnerability in Apache Answer. |
critical | 9.8 | — | — | 2026-10-19 | 2026-11-03 |
| CVE-2026-90910 Missing authentication for critical function vulnerability in Apache Answer. |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Ligh... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110887 Improper Control of Generation of Code ('Code Injection') vulnerability in HiveP... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108771 Missing authentication for in-house broadcast and polymorphic deserialization vu... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2024-4457 The Management Console fails to properly validate input related to the configura... |
critical | 9.1 | — | — | 2026-10-18 | 2026-10-27 |
| CVE-2026-98548 In the Linux kernel, the following vulnerability has been resolved:
sctp: disca... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-24 |
| CVE-2026-98549 In the Linux kernel, the following vulnerability has been resolved:
tcp: preven... |
critical | 9.1 | — | — | 2026-10-18 | 2026-10-30 |
| CVE-2026-98490 In the Linux kernel, the following vulnerability has been resolved:
net: openvs... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-30 |
| CVE-2026-98464 In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM... |
critical | 9.3 | — | — | 2026-10-18 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.