October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118759 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115805 Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107055 Insecure permissions in the autosave component of AppML neutriNote CE versionCod... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107059 An issue in Nextcloud versionCode 30390190 allows attackers to force victim user... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107047 Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized at... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107049 An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change an... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107051 Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified bui... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-107052 Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead v... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107044 Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows un... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96203 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / edge | 2026-10-29 | 2026-11-03 |
| CVE-2026-96187 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 7.4 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-96192 Use after free in Microsoft Edge for iOS allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-96196 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows a... |
high | 8.8 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-96198 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-96199 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-90869 A remote attacker who knows a valid account's enrolled SSH public key can termin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90867 Improper access control in the Web Admin console of Progress Software WS_FTP Ser... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-88077 Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unau... |
high | 8.8 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-85890 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-85897 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-85899 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker... |
high | 8.1 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-84294 Improper limitation of pathname in the Ad Hoc Transfer component of Progress Sof... |
high | 7.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61993 Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61995 Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61996 Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. |
high | 8.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61988 Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61989 Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 v... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54864 Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versio... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54866 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42692 Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42701 Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side... |
high | 8.8 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-27394 Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in th... |
high | 8.1 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in t... |
high | 7.4 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authoriz... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119119 Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker A... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-119120 Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name f... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119123 ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-29 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.