October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114178 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114179 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112207 The Download Monitor WordPress plugin before 5.3.4 does not properly validate th... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113673 The GeoDirectory WordPress plugin before 2.8.194 does not properly escape admini... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115807 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115935 The app/process-api-response-headers action accepts fake Craft API response head... |
high | 8.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-115937 The Mollie webhook endpoint accepts two independent, attacker-controlled paramet... |
high | 7.5 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-searc... |
high | 8.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-115887 GraphQL Scalars is a library of custom GraphQL scalars for creating precise type... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115895 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-58202 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 8.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-65825 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115776 Twisted is an event-based framework for internet applications, supporting Python... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115778 Twisted is an event-based framework for internet applications, supporting Python... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-113877 HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via... |
high | 7.5 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-113951 If an attacker can write to the filesystem of a container k8s cluster container,... |
high | 7.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-79982 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/de... |
high | 8.8 | — | — | 2026-10-23 | 2026-11-04 |
| CVE-2026-79977 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endp... |
high | 8.2 | — | — | 2026-10-23 | 2026-11-04 |
| CVE-2026-79979 The arm64 MMU backend invalidates a single virtual address from the TLB with inv... |
high | 7.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with defau... |
high | 7.5 | — | — | 2026-10-23 | 2026-11-04 |
| CVE-2026-115570 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112342 Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/h... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115863 ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message... |
high | 7.6 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-110975 A flaw was found in Kruize Autotune. |
high | 7.4 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-87901 Improper sanitization in the registration module allows reflected Cross-Site Scr... |
high | 8.3 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-115810 Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerabilit... |
high | 7.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-105482 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be si... |
high | 7.4 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-105483 A flaw in Node.js TLS hostname verification allows a certificate without a match... |
high | 7.4 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-106069 A flaw in Node.js TLS hostname verification can cause a server certificate to be... |
high | 7.4 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnera... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-50787 e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource con... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-52356 An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2025-45528 An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local at... |
high | 7.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displ... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-55459 The Goobi viewer is a web application that allows digitised material to be displ... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-39902 Cacti is an open source performance and fault management framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-106763 An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to e... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-106764 An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbit... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-106765 An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute ar... |
high | 7.5 | — | — | 2026-10-23 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.