October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-10149 The SCIM endpoint does not sufficiently validate authorization for federated use... |
high | 8.2 | — | — | 2026-10-19 | 2026-11-04 |
| CVE-2026-112309 @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPat... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112366 Picomatch through 4.0.7 contains a regular expression denial of service vulnerab... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112368 An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112304 docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pre... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112305 Semaphore UI through 2.19.16 contains a remote code execution vulnerability that... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112306 NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injectio... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112307 sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows a... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112308 crewai-tools through 1.15.28 contains a server-side request forgery vulnerabilit... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112152 A security vulnerability has been detected in vraj404 Criminal-Management-System... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112153 A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d05... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111045 CLI Bridge provides filesystem access within a workspace root. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109431 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing autho... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107571 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112151 A weakness has been identified in vraj404 Criminal Management System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112149 A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112287 Krayin CRM before 2.2.7 contains a broken object level authorization vulnerabili... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112264 BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-r... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112146 A vulnerability was detected in D-Link E15, M32, R15 and R32. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112262 RisingWave before 3.1.0 contains a missing authorization vulnerability that allo... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112263 Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerabi... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112143 A security flaw has been discovered in satya-vinay Events-Management-System up t... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112142 A vulnerability was identified in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-103314 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). |
high | 7.4 | — | — | 2026-10-19 | 2026-10-31 |
| CVE-2026-88900 Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups co... |
high | 8.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-112139 A vulnerability has been found in subhajitkhan online-clinic-management-system u... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-88901 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-85250 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85251 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-80312 Improper Authentication vulnerability in Apache Camel OAuth component. |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-80343 Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP c... |
high | 8.2 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-80344 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. |
high | 8.2 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-83531 Improper Control of Generation of Code ('Code Injection'), Improper Neutralizati... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79984 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79985 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.