October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88924 A flaw was found in the admin backend of gvfs. |
high | 7.0 | — | — | 2026-09-10 | 2026-10-21 |
| CVE-2026-69943 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-20 |
| CVE-2026-107805 Nginx UI is a web user interface for the Nginx web server. |
high | 7.5 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107806 Nginx UI is a web user interface for the Nginx web server. |
high | 7.2 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in A... |
high | 8.1 | — | Acymailing / acymailing | 2026-09-26 | 2026-10-20 |
| CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailb... |
high | 8.1 | — | Acymailing / acymailing | 2026-09-26 | 2026-10-20 |
| CVE-2026-97160 Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection i... |
high | 8.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-97161 Joomla Extension - lomart.fr - Various path traversal / file access vectors in U... |
high | 7.5 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-97627 Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) pro... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112368 An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107571 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107186 An unauthenticated user can send a DWR request with isPasswordUppercase as one c... |
high | 8.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107187 A user can access any database details, such as usernames and passwords by sendi... |
high | 8.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-105299 Summary
Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105941 The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105297 Summary
Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's defau... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2025-10149 The SCIM endpoint does not sufficiently validate authorization for federated use... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-109443 JoySafeter through 1.0.0 contains a remote code execution vulnerability that all... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77926 Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenti... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77937 Letta through 0.16.8 contains an authentication bypass vulnerability that allows... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113352 uTox through 0.18.1 contains a path traversal vulnerability that allows Tox frie... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113358 LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in t... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-53995 MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileSto... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-77934 Coze Studio before 0.5.0 contains an insecure default configuration that allows... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77935 Coze Studio through 0.5.1 contains an insecure direct object reference vulnerabi... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113356 DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Dra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113605 Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in Databa... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in t... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-76788 The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery... |
high | 8.8 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-20 |
| CVE-2026-111764 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol ser... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-84975 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.4 | — | Teluu / pjsip | 2026-09-18 | 2026-10-20 |
| CVE-2026-113619 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH b... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-91041 Mounting an attacker-controlled FAT image with fault tolerance enabled causes an... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-61411 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertio... |
high | 7.7 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.