October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79957 ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usua... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated re... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 7.7 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106089 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106090 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-87093 Incorrect Permission Assignment for Critical Resource vulnerability in Progress... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-16 |
| CVE-2026-105901 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105900 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-96915 Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-105897 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published... |
high | 7.3 | — | Techfry / tf content | 2026-10-05 | 2026-10-16 |
| CVE-2026-105751 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-16 |
| CVE-2026-105759 vLLM is an inference and serving engine for large language models. |
high | 7.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-16 |
| CVE-2026-93590 ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR e... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-16 |
| CVE-2026-77396 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.1 | — | Teluu / pjsip | 2026-09-18 | 2026-10-16 |
| CVE-2026-88755 Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections wi... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-80731 In the Linux kernel, the following vulnerability has been resolved:
net: remove... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-80737 In the Linux kernel, the following vulnerability has been resolved:
serial: amb... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-80754 In the Linux kernel, the following vulnerability has been resolved:
Input: syna... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-30971 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111642 FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111607 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111612 netdisk-fast-download through 0.4.8 contains an information disclosure vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111627 HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allow... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111279 Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability th... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-107794 ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB ar... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-105035 The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) us... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105036 EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105040 The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in a... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105033 The EnergizeLab AI Station (RK3562) firmware image ships with default root crede... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105034 The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary rob... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108259 Tina is a headless content management system. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108260 Tina is a headless content management system. |
high | 7.6 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-57458 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-62376 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-92705 Aegisub is a cross-platform advanced subtitle editor. |
high | 7.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-103902 Improper verification of cryptographic signature vulnerability in DigiDoc libdig... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-77363 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57143 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59976 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.