October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,081
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,903
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 10.0 | Listed | Gitlab / gitlab | 2026-10-13 | 2026-10-30 |
| CVE-2026-103039 The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90866 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93680 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass se... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90717 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FT... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90864 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-87302 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-86400 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86397 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-84295 Improper authentication in Progress Software WS_FTP Server versions prior to 202... |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-110186 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute a... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107329 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107328 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107327 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-104339 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute a... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-28367 A flaw was found in Undertow. |
critical | 9.1 | — | Redhat / build of apache camel - hawtio | 2026-03-27 | 2026-10-30 |
| CVE-2026-98432 In the Linux kernel, the following vulnerability has been resolved:
ipv4: free... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-30 |
| CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61645 Docat is a tool for hosting versioned static documentation. |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85165 n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability wh... |
critical | 9.9 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-75913 CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an... |
critical | 9.3 | — | — | 2026-08-18 | 2026-10-29 |
| CVE-2026-82854 Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsa... |
critical | 9.8 | — | — | 2026-08-31 | 2026-10-29 |
| CVE-2026-6257 Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its m... |
critical | 9.1 | — | — | 2026-04-20 | 2026-10-29 |
| CVE-2026-65689 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa... |
critical | 9.8 | — | Syncfusion / standalone report designer | 2026-07-23 | 2026-10-29 |
| CVE-2026-61451 The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin... |
critical | 9.6 | — | — | 2026-07-15 | 2026-10-29 |
| CVE-2026-54390 JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection... |
critical | 9.8 | — | — | 2026-06-18 | 2026-10-29 |
| CVE-2026-31158 SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 a... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-105215 ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in... |
critical | 9.1 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-107032 Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allo... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105207 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user... |
critical | 9.8 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105209 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorizati... |
critical | 9.6 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2025-71334 Flowise before 3.0.6 contains an arbitrary file access vulnerability due to miss... |
critical | 9.8 | — | Flowiseai / flowise | 2026-06-25 | 2026-10-29 |
| CVE-2024-8517 SPIP before 4.3.2, 4.2.16, and
4.1.18 is vulnerable to a command injection issu... |
critical | 9.8 | — | Spip / spip | 2024-09-06 | 2026-10-29 |
| CVE-2026-83693 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-72765 n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in ex... |
critical | 9.9 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-62008 Unauthenticated PHP Object Injection in Orpheus |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62013 Unauthenticated PHP Object Injection in Edge Decor |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.