October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116634 OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability t... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116398 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116408 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115922 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-115923 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-115966 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115916 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-11-02 |
| CVE-2026-115917 vLLM is an inference and serving engine for large language models. |
medium | 4.7 | — | Vllm / vllm | 2026-10-26 | 2026-10-31 |
| CVE-2026-115918 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-30 |
| CVE-2026-115919 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115920 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115921 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115914 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-30 |
| CVE-2026-115804 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
medium | 6.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112839 Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommer... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-81039 The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fix... |
medium | 4.3 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-82388 bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82389 In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create()... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116371 A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116384 A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.... |
medium | 6.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116388 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploitin... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116395 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116396 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116403 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115913 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-11-02 |
| CVE-2026-115910 Python Social Auth is a social authentication and registration mechanism. |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115911 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-26 | 2026-10-30 |
| CVE-2026-115906 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115597 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115598 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114710 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-106676 qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImp... |
medium | 5.4 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2013-10077 A weakness has been identified in OctoPrint 1.0.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116538 HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contain... |
medium | 4.7 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnera... |
medium | 5.9 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contai... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116541 Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerabil... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116542 Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulne... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116369 A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to... |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-31 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.