October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119262 Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-61671 WeGIA is a web manager for charitable institutions. |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61719 WeGIA is a web manager for charitable institutions. |
high | 8.9 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-45049 Open Access Management (OpenAM) is an access management solution. |
high | 8.3 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119283 joserfc is a Python library that provides an implementation of several JSON Obje... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-13303 HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side reque... |
high | 8.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119325 Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken acc... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-92092 A flaw was found in openshift-ansible. |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-51831 An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected,... |
high | 7.8 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-51832 An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected,... |
high | 7.8 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119191 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | Digitalbazaar / forge | 2026-10-29 | 2026-11-04 |
| CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119187 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | Digitalbazaar / forge | 2026-10-29 | 2026-11-04 |
| CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-9536 A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader Find... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-9535 A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 func... |
high | 8.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-8822 A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functi... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-8824 A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInfo... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119249 A malicious actor with access to the network could exploit a Binding to an Unres... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-31 |
| CVE-2026-119250 A malicious actor with local access and low privileges could exploit an External... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-31 |
| CVE-2026-41216 An invalid pointer dereference vulnerability exists in the vtkPNGReader::Execute... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42057 An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGR... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118782 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-118772 joi is a schema description language and data validator for JavaScript. |
high | 7.5 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-51851 modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Travers... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-51903 SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_... |
high | 8.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-51905 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107347 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-11587 SQL injection allowing an authenticated user with access to ACL management to re... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118763 sigstore-js provides JavaScript libraries for interacting with Sigstore services... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119115 Incorrect authorization in the issuer resolution logic in AWS Private CA Connect... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118758 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.