October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,459
Low
659
Severity not reported
2,803
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (325), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-58399 llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_mod... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116826 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in Dup... |
medium | 6.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116827 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the... |
medium | 6.8 | — | — | 2026-10-27 | 2026-11-03 |
| CVE-2026-116828 YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116822 YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116823 YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability tha... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-03 |
| CVE-2026-116824 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in han... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService:... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116820 YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116821 YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWith... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116814 OpenPanel before 3.0.0 contains an information exposure vulnerability that write... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116815 OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.ser... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116817 OpenPanel before 3.0.0 contains a missing authentication vulnerability that allo... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116812 OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAc... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116813 OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionServ... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116807 OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authe... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116809 OpenPanel before 3.0.0 contains a missing authorization vulnerability in the eve... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116810 OpenPanel before 3.0.0 contains a missing authorization vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116804 DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that let... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116805 OpenPanel before 3.0.0 contains an information disclosure vulnerability that all... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116806 OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onb... |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116800 WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that all... |
medium | 6.2 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116801 Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate th... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116802 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-116803 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116603 A flaw has been found in SourceCodester Online Food Ordering System 1.0. |
medium | 4.7 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116604 A vulnerability has been found in SourceCodester Online Food Ordering System 1.0... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76654 An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied... |
medium | 5.8 | — | — | 2026-10-26 | 2026-11-03 |
| CVE-2026-2270 A confused deputy attack exists in the StatefulSet controller that allows a user... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116602 A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116745 QloApps through 1.7.0 contains an information disclosure vulnerability in OrderC... |
medium | 6.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116746 QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in th... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116739 VMime through 0.9.2 contains an information disclosure vulnerability in the uuEn... |
medium | 4.3 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-116740 libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_par... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116741 Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in... |
medium | 6.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116742 HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability i... |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116743 libyal libmsiecf through 20260525 contains a double free vulnerability in libmsi... |
medium | 5.5 | — | — | 2026-10-26 | 2026-11-05 |
| CVE-2026-116744 ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_so... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116731 Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngi... |
medium | 6.1 | — | — | 2026-10-26 | 2026-11-05 |
| CVE-2026-116732 libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf... |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-31 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.