October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57201 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-77167 Abusing the federated share endpoint, an attacker can write arbitrary rows into... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117514 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-48379 Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-114598 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
high | 8.8 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-117512 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117513 A vulnerability was determined in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-112353 GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-s... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path throug... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-114596 In EPICS Base release 7.0.10 and prior, an improper validation of message length... |
high | 8.2 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-109089 A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could ov... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-109090 A malicious X server could cause a heap overflow by injecting a large DEVICE_ENA... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-102637 A maliciously crafted HTML payload in the documentName parameter of a Fusion pro... |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-102638 A maliciously crafted HTML payload in the description of an electronic library (... |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-104349 Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulner... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102636 A maliciously crafted HTML payload in a design name, when displayed after anothe... |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-92376 Improper authentication in the
inter-process communication (IPC) mechanism of Te... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-92377 Improper access control in the Patch
Management update mechanism of TeamViewer F... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117511 A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-92372 An out-of-bounds write vulnerability in the
screen-image decoder of TeamViewer F... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-92374 A time-of-check time-of-use (TOCTOU) race condition combined with improper symbo... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-92375 An improper access control vulnerability in
the IPC communication between TeamVi... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-107672 A maliciously crafted .stack.json file can trigger a trusted Markdown injection... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-111582 A DLL loading vulnerability in the
TeamViewer Remote Management Monitoring insta... |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-111583 Improper access control in the installer
staging directory used by TeamViewer Fu... |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-111584 A race condition in the installation
process of TeamViewer Remote Management - P... |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-111585 An integer overflow in the remote-control
screen processing component of TeamVie... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-104189 The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for N... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger:... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-94346 PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-94347 PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-118008 Privilege escalation in the DOM: Navigation component. |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117936 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117937 Invalid pointer in the JavaScript Engine component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117940 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117925 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117926 Incorrect boundary conditions in the SVG component. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117928 Same-origin policy bypass in the CSS Parsing and Computation component. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.