October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59977 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-65954 PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103030 Dio is a powerful HTTP client for Dart and Flutter. |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54640 OpenRemote is an open-source internet-of-things platform. |
high | 7.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-82416 FrankenPHP is a modern application server for PHP. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108379 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108380 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108384 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108385 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55601 MultiTail is a utility for monitoring multiple log files in one terminal. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-86022 VNote is a note-taking platform. |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103905 The authentication middleware of the JTL-Shop
administration backend processes t... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102944 cpp-httplib is a C++ header-only HTTP/HTTPS library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53999 Radius is a cloud-native, portable application platform that makes app developme... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55787 Flyto2 Core is an execution kernel for automation and AI-agent workflows. |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-63626 Mongoose is an embedded web server and network library. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-73252 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-71854 OpenAEV is an open source platform allowing organizations to plan, schedule and... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-45449 : Improper Neutralization of Special Elements used in an OS Command ('OS Command... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-100409 OpenNext Cloudflare is an open Next.js adapter for Cloudflare. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-103936 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55246 bincookie is a header-only binarycookies parser. |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104827 react/http is an event-driven, streaming HTTP client and server implementation f... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97370 Junrar is an open source Java RAR archive library. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109119 Improper Privilege Management in the user management API endpoint (/api/users/{u... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107564 An unauthenticated remote attacker may use an allocation of resources without li... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-101021 MultipartInputStream performs inefficient boundary matching and unnecessary buff... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105273 MP4Parser does not adequately validate MP4 box sizes. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105667 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge mes... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107621 JPEGParser can enter an infinite loop while parsing a specially crafted or trunc... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-48503 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104103 Ludwig is a low-code framework for building custom LLMs, neural networks, and ot... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-9703 Grafana's data source proxy did not apply role-based access control to write req... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-42269 countly-server is the server-side part of Countly, a product analytics solution. |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-42270 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85817 Reliance on untrusted inputs in a security decision in Windows PowerShell allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85820 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108913 omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-pa... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108980 Blinko through 1.8.8 allows directory traversal, overwriting startup files as ro... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108985 ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.