October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (322), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118604 Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execut... |
medium | 6.8 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118607 Alpine iLX-F511 diagapp Command Injection Vulnerability. |
medium | 6.8 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118581 A BSON encoding component of the MongoDB Java Driver does not verify that an ext... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-117621 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL... |
medium | 6.1 | — | Jenkins / jenkins | 2026-10-28 | 2026-11-02 |
| CVE-2026-117622 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send excepti... |
medium | 6.1 | — | Jenkins / jenkins | 2026-10-28 | 2026-11-02 |
| CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text show... |
medium | 5.4 | — | Jenkins / jenkins | 2026-10-28 | 2026-11-02 |
| CVE-2026-117613 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types... |
medium | 5.4 | — | Jenkins / jenkins | 2026-10-28 | 2026-11-05 |
| CVE-2026-117615 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when c... |
medium | 6.5 | — | Jenkins / jenkins | 2026-10-28 | 2026-11-02 |
| CVE-2026-114349 When a broker decodes a compressed record batch, the per-record decoder reads a... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-112375 An authenticated Kafka principal with no authorization grants (not even ALTER_CO... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-103404 An Incorrect Permission Assignment for Critical Resource vulnerability in Routin... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103405 An Improper Neutralization of Special Elements in Output Used by a Downstream Co... |
medium | 5.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103400 An Improper Neutralization of Special Elements in Output Used by a Downstream Co... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103391 An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in J... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103392 An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Net... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103393 An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networ... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103390 An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Netwo... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50543 Xibo is an open source digital signage platform with a web content management sy... |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-118029 Unverified ownership of the default query result location in the Athena module i... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50539 Xibo is an open source digital signage platform with a web content management sy... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-50542 Xibo is an open source digital signage platform with a web content management sy... |
medium | 5.4 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-112356 GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scr... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50541 Xibo is an open source digital signage platform with a web content management sy... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-93516 A use-after-free caused by lack of lifecycle management when adding / removing X... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-55369 Waline is a comment system with backend support. |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67079 HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to imp... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116404 Missing Authorization vulnerability in David Anderson Redux Framework redux-fram... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115957 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-81472 Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116855 Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-a... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87878 Linux binaries have executable stack attribute enabled. |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87879 Sensitive information disclosure due to improper token validation. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87880 Sensitive information disclosure due to missing SSL certificate verification aff... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87097 Sensitive information disclosure due to insufficiently protected credentials. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87099 Cross-site scripting (XSS) vulnerability due to improper input validation. |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87101 Sensitive information disclosure due to improper token validation. |
medium | 6.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115223 The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent temp... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106648 The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate su... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.