October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is sma... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72754 When Routinator encounters a CRL with many entries, it may hang or run out of me... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72753 When Routinator encounters an RRDP notification file with gaps in the delta entr... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33521 There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105765 HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an a... |
high | 7.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-105626 HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105608 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-81038 The Object Transfer Service server builds its Object Action Control Point (OACP)... |
high | 7.1 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-116612 A flaw was found in GStreamer Editing Services (gst-editing-services). |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-115907 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-115908 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115909 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115912 vLLM is an inference and serving engine for large language models. |
high | 8.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-115418 SQL injection in the database-query custom resource handlers in the Amazon Web S... |
high | 7.3 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-107091 An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a loc... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-106677 Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. |
high | 7.1 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in... |
high | 7.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116368 A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116489 Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability tha... |
high | 7.5 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-115721 **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysp... |
high | 7.5 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-115748 **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all version... |
high | 8.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-112343 Syncplify Server! |
high | 8.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-107090 An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a... |
high | 7.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-99094 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-99099 In the Linux kernel, the following vulnerability has been resolved:
x86/CPU/AMD... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-90885 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-36698 Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and e... |
high | 8.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116339 A vulnerability was determined in iFlytek astron-agent up to 1.1.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112345 TTLock Android application before v9.8.260718 and associated smart-lock firmware... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-106781 An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in... |
high | 7.2 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability th... |
high | 7.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115189 A server-side template injection vulnerability exists in the Twig theme renderin... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115190 An insecure deserialization (PHP object injection) vulnerability exists in Mauti... |
high | 8.0 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115191 A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Ma... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115192 An SQL Injection vulnerability exists in the dashboard widget data API endpoint... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115193 A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail v... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-94380 Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSA... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116260 A weakness has been identified in libimobiledevice up to 1.4.0. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115717 Frappe Builder versions before 1.36.1 contain a server-side request forgery vuln... |
high | 7.7 | — | — | 2026-10-26 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.