October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in t... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75888 A flaw was found in the OpenShift console. |
high | 7.7 | — | — | 2026-10-12 | 2026-10-30 |
| CVE-2026-85957 Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in t... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109372 ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypa... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109357 LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization a... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109359 Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109360 MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that all... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109361 MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in n... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109363 ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109353 LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unpri... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109346 better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109347 Adminer before 6.1.1 contains a remote code execution vulnerability that allows... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109341 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109343 SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE stat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109334 SurrealDB before 3.3.0 does not check the caller-selected namespace or database... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109326 Grav before 2.1.7 contains an information disclosure vulnerability because bundl... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109331 Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerab... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109325 Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109313 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109314 Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109317 Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability th... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates'... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109312 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in proces... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109305 Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109290 Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vuln... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109291 Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerabili... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109286 Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vul... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109262 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-12 | 2026-11-03 |
| CVE-2026-109263 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-12 | 2026-11-03 |
| CVE-2026-109268 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free v... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-12 | 2026-11-03 |
| CVE-2026-109257 FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initia... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
| CVE-2026-109258 ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerabili... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-12 | 2026-11-03 |
| CVE-2026-109260 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-12 | 2026-11-03 |
| CVE-2026-109261 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-12 | 2026-11-03 |
| CVE-2026-109242 FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory f... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-03 |
| CVE-2026-109237 Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that a... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.