October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,157
Medium
6,455
Low
659
Severity not reported
2,809
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (310), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107263 Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107258 Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107257 Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsi... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107254 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107252 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107253 Vulnerability in Drupal Orphans Media. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107250 Vulnerability in Drupal ECA Helper. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107251 Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which... |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-03 |
| CVE-2026-76027 Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowe... |
medium | 4.3 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119272 Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-76024 Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-118947 A flaw was found in the UMA resource registration endpoint of the keycloak-servi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-118959 A flaw was found in the required action provider mechanism of Keycloak. |
medium | 5.4 | — | — | 2026-10-30 | 2026-11-03 |
| CVE-2026-110133 A flaw was found in Ghostscript. |
medium | 5.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119285 Fiber is an Express inspired web framework written in Go. |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119317 On Linux, an authenticated, low-privileged Nessus user with scan-creation rights... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119278 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119281 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119208 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-04 |
| CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-02 |
| CVE-2026-119210 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119201 Nuxt is an open-source web development framework for Vue.js. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119203 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-02 |
| CVE-2026-119204 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-04 |
| CVE-2026-119205 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-02 |
| CVE-2026-119206 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-03 |
| CVE-2026-119207 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Py-pdf / pypdf | 2026-10-29 | 2026-11-02 |
| CVE-2026-119198 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119199 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. |
medium | 6.5 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119186 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119251 A malicious actor with local access and high privileges could exploit an Imprope... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118775 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.3 | — | Digitalbazaar / forge | 2026-10-29 | 2026-11-04 |
| CVE-2026-118776 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.3 | — | Digitalbazaar / forge | 2026-10-29 | 2026-11-04 |
| CVE-2026-118777 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 6.5 | — | Digitalbazaar / forge | 2026-10-29 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.