October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111998 Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110886 Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational F... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-109894 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110372 Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretri... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability wher... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104736 The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in ver... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110653 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
critical | 9.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111823 Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon en... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110759 Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110757 Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing str... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-68573 Improper Authentication vulnerability in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-108709 Authentication bypass within in-house network in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-102608 ZoneMinder is a free, open source closed-circuit television software application... |
critical | 9.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111711 Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111704 LangChat through commit 2a6285a contains a missing authentication vulnerability... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111708 WhaTicket Community through commit cf04795 contains an authentication bypass vul... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111690 Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerabili... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vul... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability t... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111673 IceCMS through 4.1.5 contains a missing authentication vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111643 Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111641 FastapiAdmin through 3.0 contains an authentication bypass vulnerability that al... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111626 Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92262 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-21 |
| CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-85748 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-57169 Dockhand is a Docker management application. |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-49868 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-102693 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102692 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-44977 countly-server is the server-side part of Countly, a product analytics solution. |
critical | 9.0 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-26846 Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 a... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-97851 The storage status-change REST service allows location records still associated... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-95182 An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attack... |
critical | 10.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105279 In the default configuration, the archive accepts DICOM associations from an unr... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-18516 An output escaping vulnerability in the Audit Logs component of Crafty Controlle... |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-107617 An attacker can use a hard-coded credential to log in to EseeCloud devices. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.