October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119597 OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability t... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-31704 A vulnerability has been found in the Dahua Intelligent Connection Center. |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-64618 Improper Neutralization of Special Elements used in an SQL Command ("SQL Injecti... |
critical | 9.8 | — | Apache / fineract | 2026-10-30 | 2026-11-02 |
| CVE-2026-103039 The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107249 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119263 Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119261 Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowe... |
critical | 9.6 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61645 Docat is a tool for hosting versioned static documentation. |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-51863 DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packag... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-51912 OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_... |
critical | 9.8 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. |
critical | 9.3 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-107053 Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unaut... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107056 Insecure permissions in the io.file.importer.ImportActivity component of OpenTra... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-107057 An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code... |
critical | 9.8 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-107058 An issue in Shelter versionCode 445 allows attackers to register their own auth_... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107060 Insecure permissions in Tailscale versionCode 297862600 allows unauthorized atta... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107048 An issue in the WebView rendering path component of MotionCreative Motion UI ver... |
critical | 9.8 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107050 An issue in libretro RetroArch v1.22.2 allows attackers to force another user in... |
critical | 9.8 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-107043 Insecure permissions in Code Catcher versionCode 131 allow unauthorized attacker... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107045 Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-93680 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass se... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FT... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90864 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90866 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-84295 Improper authentication in Progress Software WS_FTP Server versions prior to 202... |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62013 Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62014 Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62015 Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62016 Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62017 Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62018 Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62131 Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62004 Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62005 Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62006 Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62008 Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62009 Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.