October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116394 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115678 Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds r... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115679 Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FT... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115680 Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116367 A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. |
medium | 6.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-112344 Syncplify Server! |
medium | 6.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-107080 OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains a... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-93849 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-26 | 2026-11-02 |
| CVE-2026-93850 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-26 | 2026-11-02 |
| CVE-2026-94386 Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oaut... |
medium | 4.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-92171 A flaw was found in the Infinispan Operator for Red Hat Data Grid. |
medium | 6.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116340 A vulnerability was identified in iFlytek astron-agent up to 1.1.2. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116497 A NULL pointer dereference vulnerability was found in gssproxy. |
medium | 5.5 | — | — | 2026-10-26 | 2026-11-05 |
| CVE-2026-115930 The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carr... |
medium | 6.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116284 A security vulnerability has been detected in Kameleo up to 5.3.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-110733 Vulnerability in the SQL storage module of Apache SIS. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110748 This issue affects Apache SIS from version 0.7 through 1.6 inclusive. |
medium | 5.5 | — | — | 2026-10-26 | 2026-11-03 |
| CVE-2026-116486 Objenesis before 3.6 contains a type confusion vulnerability that allows code in... |
medium | 4.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116487 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contain... |
medium | 4.6 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-116488 NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contain... |
medium | 6.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116492 Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that... |
medium | 6.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116516 Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat li... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116283 A weakness has been identified in Kameleo up to 5.0.1.26. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116274 A vulnerability has been found in JIZHICMS up to 2.5.6. |
medium | 4.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116275 A vulnerability was found in AllenAI AllenNLP up to 2.10.1. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116280 A vulnerability was determined in Kameleo up to 5.0.1.26. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116282 A security flaw has been discovered in Kameleo up to 5.3.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116213 Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability i... |
medium | 4.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116216 MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in in... |
medium | 5.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116217 RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116210 Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerabi... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116212 Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerab... |
medium | 5.4 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-115195 A broken access control vulnerability exists in the Mautic Stats API (/api/stats... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115196 An Open Redirect vulnerability exists in the public form submission endpoint (/f... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115194 A path traversal vulnerability exists in the Mautic Asset API. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116263 A flaw has been found in HaschekSolutions PictShare up to 3.7.1. |
medium | 4.6 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116262 A vulnerability was detected in libimobiledevice up to 1.4.0. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115718 Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vuln... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115720 Frappe Builder before 1.36.1 contains a server-side request forgery vulnerabilit... |
medium | 5.0 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105947 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.