October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-24718 A path traversal vulnerability has been reported to affect Qsync Central. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2025-68403 An external control of system or configuration setting vulnerability has been re... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-68404 A time-of-check time-of-use (toctou) race condition vulnerability has been repor... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-29897 A buffer copy without checking size of input vulnerability has been reported to... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-29895 A NULL pointer dereference vulnerability has been reported to affect Qsync Centr... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-29896 A NULL pointer dereference vulnerability has been reported to affect Qsync Centr... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110923 Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-110925 Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-110926 Rejected reason: CVE-2026-110926 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-93483 In Znuny through 7.3.6, an attacker can bypass specific standard login procedure... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-93484 Znuny through 7.3.6 constructs a ticket-search database query by directly concat... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110912 In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr()... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110851 n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in t... |
not reported | — | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110852 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an aut... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110853 n8n before 1.123.83 contains an authorization bypass vulnerability that allows a... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110854 Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle error... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110845 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code... |
not reported | — | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110846 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the wa... |
not reported | — | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110847 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stor... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110848 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prot... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting v... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110850 n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stor... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110840 n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerabili... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110841 n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat... |
not reported | — | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110842 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulner... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110843 n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource con... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110844 n8n before 1.123.83 contains an authorization bypass vulnerability that allows s... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105627 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-106006 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-106068 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-106485 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-107795 Omada Controller's MSP and OpenAPI certificate/private-key management APIs do no... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102298 In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce th... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108335 When the password reset functionality is enabled, and email is configured, an at... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108336 When the default self-signed certificate is used, an attacker could gain adminis... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108337 An administrator could retrieve the password reset code for any user and take ov... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-0320 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables... |
not reported | — | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-0318 A stack-based buffer overflow vulnerability in the log processing functionality... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-0319 An improper input handling vulnerability in the GlobalProtect™ gateway of Palo A... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-0312 Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud en... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.