October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63619 Missing Authorization vulnerability in Apache Kylin. |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-64610 Deserialization of Untrusted Data vulnerability in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-64959 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-94169 Improper Control of Generation of Code ('Code Injection') vulnerability in Theme... |
critical | 10.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-94388 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104730 The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographer... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89079 The Theme My Login plugin for WordPress is vulnerable to privilege escalation vi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103768 The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109219 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in ve... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-109515 The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, A... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104798 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111444 Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escapi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111375 FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in... |
critical | 9.1 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-94134 The Apache Airflow SSH provider hook disables SSH host-key verification by defau... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111329 JuggleIM im-server through 1.8.16 ships default administrator credentials admin/... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111322 Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability tha... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111281 Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a re... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111283 BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authenti... |
critical | 9.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-110916 Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 all... |
critical | 9.6 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-105037 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow... |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105038 The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services exp... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105039 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105032 The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability |
critical | 9.8 | Listed | BeyondTrust / Remote Support | 2026-10-15 | 2026-10-17 |
| CVE-2026-57496 NetLicensing MCP Server is a natural-language interface that enables agentic app... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-55240 Tianji is an open source analytics, uptime monitoring, and server status platfor... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-111235 An authorization bypass vulnerability exists in the REST API of multiple version... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109829 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109383 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-102946 joserfc is a Python library that provides an implementation of several JSON Obje... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-84731 An unauthenticated remote attacker can bypass authentication and gain full acces... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph data import component in... |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-57155 OPNsense is a FreeBSD based firewall and routing platform. |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110958 A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111094 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution... |
critical | 9.8 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-47168 EspoCRM is an open source customer relationship management application. |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-110957 A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-104586 AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Inject... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved:
ipv4: valid... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-98432 In the Linux kernel, the following vulnerability has been resolved:
ipv4: free... |
critical | 9.8 | — | — | 2026-10-15 | 2026-11-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.