October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1... |
high | 8.2 | — | Gitlab / gitlab | 2026-10-22 | 2026-11-04 |
| CVE-2026-16255 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 bef... |
high | 7.1 | — | Gitlab / gitlab | 2026-10-22 | 2026-11-04 |
| CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3... |
high | 7.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-11-04 |
| CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76526 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76300 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76306 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could u... |
high | 7.5 | — | — | 2026-10-21 | 2026-11-02 |
| CVE-2026-76307 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76293 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user... |
high | 7.2 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76298 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold... |
high | 8.8 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76288 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unau... |
high | 7.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76290 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica... |
high | 7.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76291 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
high | 8.8 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114439 A vulnerability was determined in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114440 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114441 A weakness has been identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as im... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-96778 Pillow is a Python imaging library. |
high | 8.8 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-96640 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-96644 Pillow is a Python imaging library. |
high | 8.1 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-82987 There exists a screen capture endpoint in vCast media streaming service in ViewS... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-29001 TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that all... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114144 toml-node is a TOML parser for Node.js and the browser. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114145 GitPython is a python library used to interact with Git repositories. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114137 Django REST framework is a toolkit for building Web APIs. |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114138 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114135 Jupyter Server is the backend for Jupyter web applications. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114136 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-112408 Missing verification of source of a communication channel in the default_bucket(... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-111805 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111808 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111810 Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-79976 The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c... |
high | 7.1 | — | — | 2026-10-21 | 2026-11-04 |
| CVE-2026-78118 The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a t... |
high | 7.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-19676 The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer... |
high | 7.8 | — | — | 2026-10-21 | 2026-11-04 |
| CVE-2026-113870 MongoDB Compass improperly escapes certain BSON values when converting a stored... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114267 A vulnerability was detected in SourceCodester Food Order Management System 1.0. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.