October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112481 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.8 | — | Apple / macos | 2026-10-26 | 2026-11-04 |
| CVE-2026-112471 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112475 An out-of-bounds read was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-10-26 | 2026-11-04 |
| CVE-2026-112468 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-11-04 |
| CVE-2026-112455 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-11-05 |
| CVE-2026-112442 A race condition was addressed with additional validation. |
medium | 4.7 | — | Apple / macos | 2026-10-26 | 2026-11-05 |
| CVE-2026-112444 This issue was addressed with improved checks. |
medium | 4.4 | — | Apple / macos | 2026-10-26 | 2026-11-05 |
| CVE-2026-112447 An authorization issue was addressed with improved state management. |
medium | 5.3 | — | Apple / macos | 2026-10-26 | 2026-11-05 |
| CVE-2026-112432 A logging issue was addressed with improved data redaction. |
medium | 6.2 | — | Apple / ipados | 2026-10-26 | 2026-11-03 |
| CVE-2026-112428 A logic issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-10-26 | 2026-11-03 |
| CVE-2026-112429 An out-of-bounds read was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-10-26 | 2026-11-03 |
| CVE-2026-112414 A stack overflow was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-10-26 | 2026-11-03 |
| CVE-2026-112415 An out-of-bounds write was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-10-26 | 2026-11-02 |
| CVE-2026-112416 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-11-04 |
| CVE-2026-112421 A race condition was addressed with improved handling of symbolic links. |
medium | 4.7 | — | Apple / macos | 2026-10-26 | 2026-11-04 |
| CVE-2026-112423 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.1 | — | Apple / ipados | 2026-10-26 | 2026-11-03 |
| CVE-2026-112413 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-10-26 | 2026-11-03 |
| CVE-2026-70382 Some externally supplied values stored by the device may be rendered in the web... |
medium | 4.1 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-70380 A denial-of-service vulnerability has been identified in the Miracast over Infra... |
medium | 5.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-70381 An access-control vulnerability has been identified in the web server configurat... |
medium | 5.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116478 A vulnerability was detected in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116477 A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115927 Tornado is a Python web framework and asynchronous networking library. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116467 A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116476 A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. |
medium | 5.4 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116631 A malicious web page could open a tel link in a window that was showing a differ... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116632 A malicious web page could insert arbitrary text into the FaceTime call prompt s... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104592 libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPL... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-81509 nforwardauth is a forward auth service that allows the use of a single authentic... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72757 Routinator runs out of open connections on the HTTP server when many connections... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72752 Routinator runs out of memory when the JSON output is requested many times concu... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-70379 When the vSolution Matrix feature is enabled, affected devices may make current... |
medium | 6.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-50095 There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earl... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-50096 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGI... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33520 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGI... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33522 Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated a... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116461 A vulnerability was determined in Omega Solution Restro POS up to 20261026. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116463 A vulnerability was identified in FastStone Image Viewer up to 8.5. |
medium | 6.3 | — | — | 2026-10-26 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.