October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (325), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117885 Use-after-free in the Layout: Grid component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117875 Use-after-free in the Layout: Scrolling and Overflow component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117876 Use-after-free in the Layout: Text and Fonts component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117874 Use-after-free in the Internationalization component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117603 Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nost... |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117863 Information disclosure due to uninitialized memory in the Audio/Video component. |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117865 Use-after-free in the JavaScript: GC component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117566 EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerabi... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117570 Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validat... |
medium | 5.2 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117562 rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that a... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117563 MrDoc through 1.1.1 contains a broken access control vulnerability in the manage... |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117565 Artalk before 2.10.1 contains an unauthenticated server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117557 SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read v... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117555 CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117556 zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_pre... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117503 A vulnerability was determined in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117504 A vulnerability was identified in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117554 Admidio before 5.0.17 contains an improper access control vulnerability that all... |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-10537 A misconfiguration issue in the affected service in Control-M/Enterprise Manager... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-107067 An issue in Shirt Pocket's SuperDuper! |
medium | 6.2 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-15586 Improper restriction of excessive authentication attempts vulnerability in İdvla... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-56084 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 5.3 | — | Dell / data domain operating system | 2026-10-27 | 2026-11-04 |
| CVE-2026-90728 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90729 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.7 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90730 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-90731 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90732 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-115408 In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8... |
medium | 5.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-41022 Eaton easySoft improperly validates TLS certificates presented by easyE4 devices... |
medium | 5.9 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-105323 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-10752 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to autho... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-117541 svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerabil... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117535 REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117537 REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability tha... |
medium | 4.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117538 REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in... |
medium | 4.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116900 REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to inco... |
medium | 6.7 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117533 REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerab... |
medium | 4.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117534 REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116893 REDAXO core before 5.21.5 contains a missing authorization vulnerability in the... |
medium | 6.8 | — | — | 2026-10-27 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.