October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,520
Critical
3,295
High
7,941
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57490 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57492 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55681 WeGIA is a web manager for charitable institutions. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-53574 EspoCRM is an open source customer relationship management application. |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110025 A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110670 A vulnerability was found in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110679 A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109520 A flaw has been found in Colorful iGameCenter 2.0.0.82. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109695 Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109403 A vulnerability was determined in conductor-oss conductor up to 3.32.5. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108964 A vulnerability was found in SourceCodester Performance Indicator System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108968 A weakness has been identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108972 A vulnerability was found in SourceCodester Human Resource Management System 1.0... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108916 A vulnerability was found in Edimax BR-6208AC 1.32. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108900 A vulnerability has been found in Exponent CMS up to 3.0.2patch2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-70282 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-108571 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. |
high | 7.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-105067 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-97012 Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-73597 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-93695 In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyServic... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85973 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transpor... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85974 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-102849 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-102850 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-72895 A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105591 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105592 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105593 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-108693 ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled s... |
high | 7.0 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-109305 Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105106 Koha is vulnerable to OS command injection in the Task Scheduler deletion path. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105107 Koha is vulnerable to SQL injection in the Most-circulated items report. |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-63153 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63158 Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnera... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63159 Omnispace Agora Project before 26.10.0 contains a predictable password-reset tok... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63162 Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability t... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63163 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105595 Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.