October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (322), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118657 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118658 Echo is a Go web framework. |
medium | 4.7 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-61529 Endatix is a self-hosted form and survey management platform with a headless API... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-54162 Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP suppor... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118651 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118652 Echo is a Go web framework. |
medium | 6.1 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118653 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-118654 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-118655 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-11854 The authentication endpoint generates an error message that includes reflected d... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118266 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-115415 Improper neutralization of input used for LLM prompting in the environment tool... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118684 MONAI before 1.6.1 contains an insufficient integrity verification vulnerability... |
medium | 5.9 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-118685 ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-118687 Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118680 SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespac... |
medium | 4.4 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-118677 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulne... |
medium | 5.9 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-118265 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-118640 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
medium | 5.4 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118259 opentelemetry-java is the Java implementation of the OpenTelemetry API for recor... |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-106484 Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-58458 Don't Starve Together (Steam AppID 322330) through build 747465 contains a memor... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shi... |
medium | 6.0 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-110181 PostgreSQL Anonymizer contains a vulnerability related to anonymization function... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-110182 PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and... |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-110183 PostgreSQL Anonymizer contains a vulnerability related to static masking and sta... |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105620 PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105613 PostgreSQL Anonymizer's range-based dummy functions dont constraint the range si... |
medium | 4.7 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105614 PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared... |
medium | 4.7 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105616 PostgreSQL restricts acces to the salt and shift via the `SHOW` command for user... |
medium | 5.7 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105617 PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added o... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105618 PostgreSQL Anonymizer's documentation recommends applying rules on partitions an... |
medium | 5.7 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-105619 PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. |
medium | 4.8 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-93536 A use after free caused by missing lifecycle management of gesture sprites in Ge... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88858 A user with the Viewer role in Grafana can crash the server by submitting a craf... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-82962 ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethe... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118609 Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remo... |
medium | 6.8 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118611 Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote... |
medium | 6.8 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118601 Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. |
medium | 6.3 | — | — | 2026-10-28 | 2026-11-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.