October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116189 rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in sta... |
high | 7.5 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116191 Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav tha... |
high | 7.5 | — | Rclone / rclone | 2026-10-25 | 2026-10-27 |
| CVE-2026-116183 phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerabili... |
high | 7.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116176 vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerabili... |
high | 8.2 | — | Vllm / vllm | 2026-10-25 | 2026-11-04 |
| CVE-2026-116177 vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vul... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116178 vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that a... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116179 vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. |
high | 7.7 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116172 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-11-04 |
| CVE-2026-116173 vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that a... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116174 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116163 Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authenti... |
high | 7.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116149 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buff... |
high | 8.1 | — | Imagemagick / imagemagick | 2026-10-25 | 2026-11-03 |
| CVE-2026-116068 Dokploy through 0.30.10 contains an authorization bypass vulnerability that allo... |
high | 8.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116067 Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSh... |
high | 8.2 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116049 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116050 A vulnerability has been found in krupalshah Employee Recruitment System up to 9... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116048 A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115251 The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upg... |
high | 7.2 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116006 A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116000 A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115999 A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115970 A vulnerability has been found in Travisun Opptrix 0.4.0. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115969 A flaw has been found in Travisun Opptrix 0.4.0. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Conten... |
high | 7.5 | — | — | 2026-10-24 | 2026-11-02 |
| CVE-2026-114704 Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevans... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114191 Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116011 Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116014 open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStr... |
high | 8.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-116016 yudao-cloud through 2026.09 contains an authorization bypass vulnerability that... |
high | 7.1 | — | — | 2026-10-24 | 2026-11-03 |
| CVE-2026-116009 Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows us... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-110018 The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Buil... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114694 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115975 Broken access control in JiraController in Cervantes version v1.3-beta could all... |
high | 7.1 | — | — | 2026-10-24 | 2026-11-02 |
| CVE-2026-112844 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112869 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.