October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69077 Exposure of unauthorized cross-project job manipulation vulnerability in Apache... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69080 Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kyli... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-30971 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-59963 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-59970 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-61726 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-108743 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-102607 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-102834 JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia librarie... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-102917 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevatin... |
high | 7.8 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2025-66969 Integer overflow in OpenModSim (<=1.11.0), leading to denial of service |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-81452 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Lea... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111722 LingGuo-Drama through commit 8a6924a contains an insecure direct object referenc... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111723 LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerabil... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111710 Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111702 ChatOllama through commit 96c3ce5 contains an insecure direct object reference v... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111706 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 contains an insecure direct obj... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows a... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111701 OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability t... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111691 WIMOOR through commit ec86736 contains an authentication bypass vulnerability th... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111681 EFAK through 5.1.0 contains a missing authorization vulnerability that allows au... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111684 Magistrala through 1.0.0 contains an authorization bypass vulnerability that all... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111685 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111686 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentic... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111680 APIPark through 1.9.7-beta contains an authorization bypass vulnerability that a... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111671 Cube-studio through 2026.09.01 contains an insecure direct object reference vuln... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111663 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111650 ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111644 Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerabilit... |
high | 7.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111638 sshportal through 1.19.5 contains a missing authorization vulnerability in the m... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111639 bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111642 FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111633 ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111634 Helical Insight through 7.0.0 contains an sql injection vulnerability that allow... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111627 HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allow... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111612 netdisk-fast-download through 0.4.8 contains an information disclosure vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111613 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability t... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.