October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,520
Critical
3,295
High
7,941
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-74034 Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgra... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74036 Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability wh... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74045 Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105596 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105597 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105598 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105714 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105716 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105717 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-42784 A flaw was found in sequoia-openpgp. |
high | 7.4 | — | — | 2026-09-16 | 2026-10-15 |
| CVE-2026-110769 holaOS through 2026.822.1 contains a missing authorization vulnerability in chan... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109671 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109613 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109608 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109312 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in proces... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109313 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109314 Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109317 Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability th... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-63149 Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerabi... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63154 Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulne... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2020-37281 Gravitee API Management through 4.12.22 contains an authentication bypass vulner... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-17620 IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-15 |
| CVE-2026-91800 A local privilege escalation vulnerability exists in the installer of Foxit PDF... |
high | 8.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-63161 Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110599 L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110632 Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC servic... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110637 buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/k... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110642 xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.s... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110647 Turnpress through 0.4.2 contains an OS command injection vulnerability that allo... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110770 Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability t... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-74920 The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise a... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-105066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86461 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arb... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110667 A security flaw has been discovered in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108491 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108498 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-107416 Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109692 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.