October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,513
Critical
3,295
High
7,934
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. |
high | 8.0 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. |
high | 8.5 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107814 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-78341 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.2 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78026 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78023 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78020 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-14814 GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.... |
high | 8.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-94582 A memory buffer overflow vulnerability exists in the internal diagnostic and rou... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-81839 GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 bef... |
high | 7.7 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-96893 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
high | 7.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side te... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109667 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege esca... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2025-61682 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
high | 8.6 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-71421 UVdesk core-framework before 1.1.7 contains an improper privilege management vul... |
high | 7.2 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2025-1281 The BM Content Builder plugin for WordPress is vulnerable to arbitrary file dele... |
high | 8.8 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-51457 D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vu... |
high | 8.8 | — | — | 2026-09-25 | 2026-10-14 |
| CVE-2025-71423 Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. |
high | 7.3 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-71425 Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and... |
high | 7.3 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-71426 Contrast is a confidential-computing runtime for Kubernetes. |
high | 7.1 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-15643 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-14 |
| CVE-2025-45871 LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection i... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-76266 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux... |
high | 7.7 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-84312 Nginx UI is a web user interface for the Nginx web server. |
high | 7.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85960 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85950 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85954 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-106625 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-96541 A denial-of-service flaw was found in gnome-remote-desktop. |
high | 7.5 | — | — | 2026-09-23 | 2026-10-14 |
| CVE-2026-96423 X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial... |
high | 7.1 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-14 |
| CVE-2026-95680 IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attac... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-93907 IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to b... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77910 Incorrect authorization in Microsoft Exchange Server allows an authorized attack... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70571 Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70175 Improper authentication in ASP.NET Core allows an unauthorized attacker to eleva... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70183 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-65643 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated user... |
high | 8.8 | — | Cpanel / cpanel | 2026-09-01 | 2026-10-14 |
| CVE-2026-53418 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for An... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53420 Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an u... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.