October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,527
Critical
3,295
High
7,946
Medium
7,626
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79839 A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory c... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79840 A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corrupt... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19577 net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's lin... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-19669 The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_ga... |
high | 7.8 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-19736 The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed t... |
high | 7.8 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-110767 Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_que... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106583 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line us... |
high | 7.8 | — | Openbsd / openssh | 2026-10-07 | 2026-10-15 |
| CVE-2026-105407 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105408 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105409 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103929 mise manages dev tools like node, python, cmake, and terraform. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103412 Improper limitation of a pathname to a restricted directory ('path traversal') v... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-103413 Improper input validation vulnerability in Apache Camel Karavan. |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19627 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitr... |
high | 8.2 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-75061 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse di... |
high | 7.5 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-110202 Roo Code through 3.54.0 contains a command approval bypass vulnerability in getC... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-110203 Roo Code through 3.54.0 contains a command approval bypass vulnerability that al... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-110204 Roo Code through 3.54.0 contains a command approval bypass vulnerability that al... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-103821 Substance3D - Designer is affected by an out-of-bounds write vulnerability that... |
high | 7.8 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-100121 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-69435 Missing authorization in Azure SRE Agent allows an authorized attacker to elevat... |
high | 8.1 | — | Microsoft / azure sre agent | 2026-10-08 | 2026-10-15 |
| CVE-2026-100135 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-95632 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-95634 CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vuln... |
high | 8.6 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100124 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-106618 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-100136 CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnera... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100120 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100117 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100115 CAI Content Credentials is affected by an Improper Access Control vulnerability... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100119 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100114 CAI Content Credentials is affected by an Improper Access Control vulnerability... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100137 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100122 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-17475 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
high | 7.1 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-107248 Thelia 3.0.0's back-office Email/Messages feature contains a server‑side templat... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103535 Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-19620 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauth... |
high | 8.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-19480 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.