October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in For... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116235 A flaw has been found in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116233 A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116234 A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116231 A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116232 A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116111 A vulnerability was determined in 2K Games Civilization V 1.0.3.144. |
critical | 9.6 | — | 2k / sid meiers civilization v | 2026-10-26 | 2026-10-29 |
| CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests,... |
critical | 9.1 | — | — | 2026-10-25 | 2026-11-02 |
| CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unau... |
critical | 9.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115214 The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify tha... |
critical | 9.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115995 A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to... |
critical | 9.6 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared s... |
critical | 9.9 | — | — | 2026-10-24 | 2026-11-02 |
| CVE-2026-115932 When a post is published, Postiz treats a media path that is not a web address a... |
critical | 9.6 | — | — | 2026-10-24 | 2026-11-02 |
| CVE-2026-94075 Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112866 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114196 Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-110956 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115806 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their c... |
critical | 9.9 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-115889 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115893 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services M... |
critical | 9.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-53942 Conda Organization Infrastructure is a centralized location for infrastructure c... |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-46652 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-53921 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-99079 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-99078 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-98959 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-57116 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-112854 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center h... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112855 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112856 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vaga... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112857 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo a... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112858 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos all... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112859 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.