October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (325), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118174 When a message containing an OpenPGP key attachment was displayed, Thunderbird a... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118178 A remote RSS feed could use the itunes:new-feed-url or newLocation element to pe... |
medium | 5.7 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118171 The strapi/content-manager package is missing content-scope authorization in the... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118172 The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-16491 Grafana’s RBAC service ignored the requested folder when checking whether a user... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-87085 Tanium addressed a SQL injection vulnerability in Provision. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117526 A vulnerability was found in reduxjs redux-devtools 5.0.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-03 |
| CVE-2026-118132 NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulner... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116678 Vaultwarden is a Bitwarden-compatible server written in Rust. |
medium | 5.8 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116679 Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116680 HomeBox is a home inventory and organization system. |
medium | 6.4 | — | — | 2026-10-27 | 2026-11-03 |
| CVE-2026-116657 Tanium addressed a denial of service vulnerability in Enforce. |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116658 Tanium addressed a denial of service vulnerability in Enforce. |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116659 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116660 Tanium addressed an improper access controls vulnerability in Enforce. |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108325 Tanium addressed an insertion of sensitive information into log file vulnerabili... |
medium | 6.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108326 Tanium addressed an improper certificate validation vulnerability in Stream Clie... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108328 Tanium addressed an insertion of sensitive information into log file vulnerabili... |
medium | 4.2 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108332 Tanium addressed an improper link resolution before file access vulnerability in... |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108308 Tanium addressed a SQL injection vulnerability in Patch. |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108309 Tanium addressed an uncontrolled resource consumption vulnerability in Performan... |
medium | 5.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108310 Tanium addressed a denial of service vulnerability in Tanium Server. |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Serve... |
medium | 6.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108301 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.0 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108302 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-77173 A user could create a docx or odt file with a # in the filename with confidentia... |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82984 When a team was configured as "visible to everyone", the web UI correctly blocke... |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82986 The user in a group can bypass the group restriction set by an administrator on... |
medium | 4.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-87897 A SSRF vulnerability found that enables access to internal Chrome Devtools Proto... |
medium | 4.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-77172 App passwords were allowed to bypass password confirmation on sensitive endpoint... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-54462 Knative pkg provides common packages shared across Knative repositories. |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-57185 Asterisk is an open source private branch exchange and telephony toolkit. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-57194 Asterisk is an open source private branch exchange and telephony toolkit. |
medium | 5.9 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-48380 Substance3D - Painter is affected by an out-of-bounds read vulnerability that co... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116674 systeminformation is a System and OS information library for node.js. |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-109088 A malicious X server could send malformed RECORD EnableContext reolies that can... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117509 A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117510 A flaw has been found in Dexmal Dexbotic up to 0.2.0. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117505 A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.