October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117558 The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vu... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117559 DroidMind through 0.4.0 contains a command injection vulnerability that allows M... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerabi... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-92546 Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity In... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-65119 NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRou... |
high | 8.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-65120 NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a ser... |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-65151 NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a... |
high | 8.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-24269 NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a ser... |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-47486 NVIDIA PhysX for all platforms contains a vulnerability where an attacker could... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116627 Improper neutralization of input during web page generation ('Cross-site Scripti... |
high | 8.7 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-100164 Observable response discrepancy vulnerability in Rolantis Information Technologi... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-41020 Eaton easyE4 uses a static nonce during authentication, which could allow an una... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-41021 Eaton easyE4 uses an insufficiently strong password policy. |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-109995 The Advanced Views – Display Framework for Gutenberg & Elementor plugin for Word... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-117536 REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117540 svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116896 REDAXO before 5.21.5 contains a missing authorization vulnerability in the backu... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116898 REDAXO before 5.21.4 contains a missing authorization vulnerability in the media... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116890 Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vuln... |
high | 7.3 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-03 |
| CVE-2026-116880 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery... |
high | 7.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-04 |
| CVE-2026-116873 Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vuln... |
high | 7.3 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-04 |
| CVE-2026-116876 Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vu... |
high | 7.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-04 |
| CVE-2026-116878 Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource con... |
high | 7.5 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-04 |
| CVE-2026-116871 Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnera... |
high | 7.5 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-04 |
| CVE-2026-116872 Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vu... |
high | 7.5 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-11-04 |
| CVE-2026-82121 Origin Validation Error Vulnerability in HiRDB. |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-65211 This issue may allow an authenticated IPMI Administrator to read and write arbit... |
high | 7.2 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-65219 A flaw in the BMC RAKP+ implementation may allow an attacker to send a request f... |
high | 7.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-65220 A logic flaw in the BMC IPMI implementation may allow an attacker to send specia... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-16521 An OS command injection vulnerability exists because of insufficient input filte... |
high | 7.2 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-18449 The BMC does not correctly enforce integrity and encryption requirements for IPM... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 throug... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-75891 The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Obj... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-111820 The Analytics Insights – Google Analytics Dashboard for WordPress plugin for Wor... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116839 A malicious actor who lures an authenticated user to a malicious page could expl... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116843 Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that al... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116620 A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116623 A vulnerability was detected in code-projects Simple Content Management System 1... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116816 llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116836 A malicious actor with access to the adjacent network and under certain conditio... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.