October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82166 Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentic... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-71169 Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permis... |
high | 7.0 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-71170 Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Pa... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112777 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112778 Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation f... |
high | 8.8 | — | Traefik / traefik | 2026-10-19 | 2026-10-23 |
| CVE-2026-112780 Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that al... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112782 Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exha... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112770 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code executi... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112772 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112773 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112774 Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112775 Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerabili... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112260 A flaw was found in GIMP. |
high | 7.1 | — | — | 2026-10-19 | 2026-11-04 |
| CVE-2026-112252 A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-O... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string ke... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encodi... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecti... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffer... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110680 Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds whe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scal... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking chan... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110684 Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retai... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110673 Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-6719 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms... |
high | 7.5 | — | Ibm / concert | 2026-10-19 | 2026-11-03 |
| CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111759 markdown-it is a Markdown parser. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-107084 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site requ... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-26 |
| CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-6930 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms... |
high | 7.5 | — | Ibm / concert | 2026-10-19 | 2026-11-03 |
| CVE-2026-12148 IBM MQ Operator could allow an authenticated attacker to cause a denial of servi... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10743 IBM MQ could allow an authenticated attacker to cause a denial of service or cor... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10572 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10574 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-107082 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticate... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107186 An unauthenticated user can send a DWR request with isPasswordUppercase as one c... |
high | 8.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107187 A user can access any database details, such as usernames and passwords by sendi... |
high | 8.5 | — | — | 2026-10-19 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.