October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,156
Medium
6,455
Low
659
Severity not reported
2,810
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (305), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65444 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-46499 Collabora Online is a collaborative online office suite based on LibreOffice tec... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-48164 Collabora Online is a collaborative online office suite based on LibreOffice tec... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119665 WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-44344 Chamilo LMS is an open-source learning management system. |
medium | 6.6 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-45141 Chamilo LMS is an open-source learning management system. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119659 Blossom through 1.17.1 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119661 ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119663 Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vul... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119664 Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vu... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119657 FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pi... |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119658 PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119647 RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in S... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119648 Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119650 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119651 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119652 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119653 Nging through 5.3.5 contains an information disclosure vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119368 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calenda... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119370 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119482 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119644 Blossom through 1.17.1 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119645 ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119646 Open Web Analytics before 1.14.1 contains an authorization vulnerability that al... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116860 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117349 Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2015-20130 Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site... |
medium | 6.1 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-91915 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows u... |
medium | 4.8 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119601 AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_ge... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that al... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119596 UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZ... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119598 Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119574 Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastPr... |
medium | 5.9 | — | Traefik / traefik | 2026-10-30 | 2026-11-03 |
| CVE-2026-119575 ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulne... |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119576 ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerabil... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan. |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119569 Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL ce... |
medium | 6.8 | — | — | 2026-10-30 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.