October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88101 Weak authentication in Microsoft Input Method Editor (IME) allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-17 |
| CVE-2026-85338 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-17 |
| CVE-2026-103946 An SQL injection vulnerability could allow an authenticated user to read or modi... |
high | 8.3 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-95633 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-63152 Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vul... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-63174 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110112 Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temp... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-106623 ColdFusion is affected by an Incorrect Authorization vulnerability that could le... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-17 |
| CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-100113 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-100118 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-100123 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-85990 Leantime is an open source project management system. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerabi... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110128 fuint through commit 4c4bc8a contains a missing authentication vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110206 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-16 |
| CVE-2026-110211 iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability t... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110216 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109607 A flaw has been found in SourceCodester Online Exam System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108376 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108381 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109429 Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerabili... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85114 A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webser... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55376 Heym builds and runs agentic systems and business-process automations on self-ho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111671 Cube-studio through 2026.09.01 contains an insecure direct object reference vuln... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111681 EFAK through 5.1.0 contains a missing authorization vulnerability that allows au... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111686 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111691 WIMOOR through commit ec86736 contains an authentication bypass vulnerability th... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111701 OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability t... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111706 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109967 yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111606 Huly Platform through 0.7.432 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109522 A vulnerability has been found in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109115 A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109405 A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108966 A vulnerability was identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108970 A vulnerability was detected in itsmeravitejak Online-Examination-System up to e... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108974 A vulnerability was identified in SourceCodester E-Learning System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.