October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82715 Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and H... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrol... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73539 Gitea substitutes a URL derived from the markup Context field into external rend... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73800 Gitea resolves local reusable workflow files from a fork's head commit when a tr... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73802 Gitea Runner passes workflow-controlled container options into Docker job contai... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73804 Gitea allows a token with write:user scope to register an attacker-controlled SS... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-14765 Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecur... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101941 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101942 An Improper Handling of Length Parameter Inconsistency vulnerability in the rout... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101943 An Improper Input Validation vulnerability in the routing protocol daemon (rpd)... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101940 A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Ne... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users wit... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63160 Omnispace Agora Project before 26.10.0 contains a vulnerability where the persis... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63165 Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63172 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the cur... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-109617 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109186 jshERP through 3.6 contains a mass assignment vulnerability in the UserControlle... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109326 Grav before 2.1.7 contains an information disclosure vulnerability because bundl... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109604 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109612 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnera... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111909 phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the dele... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111389 Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 co... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-110615 jshERP through 3.6 contains a missing authorization vulnerability in the POST /u... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-109399 SWUpdate through 2026.05.1 contains an improper certificate validation vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109640 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109286 Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vul... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109291 Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerabili... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109199 LogicalDOC Community Edition through 9.3 contains a code injection vulnerability... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109227 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in p... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in... |
high | 7.0 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108859 mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTT... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108718 Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108657 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108553 OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-96658 A flaw was found in Foreman. |
high | 8.8 | — | Redhat / satellite | 2026-10-01 | 2026-10-18 |
| CVE-2026-93485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-18 | 2026-10-17 |
| CVE-2026-94177 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-09-30 | 2026-10-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.