October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97635 The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided inpu... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-13599 Missing authentication for critical function vulnerability in ABB Ability Edgeni... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113873 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113874 SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identi... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115513 OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that... |
high | 8.7 | — | — | 2026-10-22 | 2026-11-04 |
| CVE-2026-75507 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-75508 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114605 dnspython is a DNS toolkit for Python. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processin... |
high | 7.7 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-104068 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitra... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-51954 An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to exec... |
high | 8.1 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-115482 In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113872 multer is a middleware for Node.js that handles multipart/form-data file uploads... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114510 Flexible GraphRAG is a Python framework for building graph and retrieval-augment... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-61791 OCO-Server is a self-hosted endpoint management application for computer invento... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-111181 body-parser is body parsing middleware for Node.js and Express. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-92709 Rsyslog is a rocket-fast system for log processing. |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-66282 In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can r... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-66281 In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can resu... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-113582 UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115330 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-11-04 |
| CVE-2026-115331 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115332 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115323 EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in th... |
high | 7.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115324 mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115325 Netmaker through 1.7.0 contains an authorization bypass vulnerability in the upd... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115328 JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi()... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-112822 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112820 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111079 A flaw was found in Goose. |
high | 7.4 | — | — | 2026-10-22 | 2026-11-04 |
| CVE-2024-58396 YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2025-71434 Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQ... |
high | 8.2 | — | — | 2026-10-22 | 2026-11-03 |
| CVE-2022-51023 PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51024 Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQ... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48013 Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthen... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48015 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2021-48017 OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthent... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51021 NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticat... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.