October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89315 `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, sy... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89316 `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `al... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89317 gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89318 `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vecto... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89319 `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thal... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89320 `HmacShaCryptor.Hash` never hashed its input. |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89312 `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Ope... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89313 `JwksTrustStore.Get` assigned each parsed key to the function's **named return v... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-89314 `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwis... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-115657 When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Ana... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-16762 An attacker able to supply a crafted XML document to an application using QXmlSt... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2025-30052 The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass vi... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30053 The CGM CLININET application runs the cgm-updater process listening on an open n... |
not reported | — | — | — | 2026-10-23 | 2026-11-04 |
| CVE-2025-30054 CGM CLININET is vulnerable to local privilege escalation. |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-58403 CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improp... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30045 CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which pro... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30046 In the CGM CLININET application server, multiple processes responsible for HL7 c... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30047 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30049 The CGM CLININET application stores user passwords as unsalted MD5 hashes. |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30050 CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which d... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30051 The CGM CLININET application stores the production database login and password,... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30043 CGM CLININET is vulnerable to Missing Authentication for Critical Function in th... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4951 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4952 The "ASMobile" web interface, which is part of the VertiGIS software package "GI... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-75775 Improper Neutralization of Special Elements used in an OS Command in certain ASU... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-75779 Improper Neutralization of Special
Elements used in an OS Command (“OS Command I... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-93489 Improper Authentication in ASUS router modules allows an unauthenticated nearby... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-4950 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-107858 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain P... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-86018 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-86019 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-55835 Lookyloo is a web interface that allows users to capture a website page and then... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55600 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-54615 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-19677 An authentication bypass vulnerability in the public onPhase/ frevvo registratio... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-19678 A server-side request forgery (SSRF) vulnerability in the unauthenticated form s... |
not reported | — | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-114583 tarfile.tar_filter could be bypassed using crafted link entries, including symli... |
not reported | — | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub bef... |
not reported | — | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-115519 Missing security attributes on sensitive cookies in KNIME Business Hub before ve... |
not reported | — | — | — | 2026-10-22 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.