October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,504
Critical
3,294
High
7,930
Medium
7,623
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96188 External control of system or configuration setting in Microsoft PowerToys allow... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110255 Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108905 pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key v... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108783 A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit... |
high | 8.2 | — | Mongodb / php driver | 2026-10-08 | 2026-10-13 |
| CVE-2026-107391 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-107392 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-109521 A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109525 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109606 A vulnerability was detected in SourceCodester Art Gallery Management System 1.0... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability |
high | 8.6 | Listed | Ivanti / Connect Secure | 2026-10-13 | 2026-10-13 |
| CVE-2026-109325 Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109185 jshERP through 3.6 contains a missing authorization vulnerability in the UserCon... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109226 SGLang through 0.5.21 contains a decompression amplification vulnerability in lo... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108826 A vulnerability was found in Zen Cart up to 2.2.2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108836 A vulnerability has been found in Ollama up to 0.34.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108805 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-63697 Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate... |
high | 7.2 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead... |
high | 8.8 | — | Elastic / kibana | 2026-10-06 | 2026-10-13 |
| CVE-2026-71168 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation o... |
high | 7.8 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-100764 Privilege escalation due to incorrect boundary conditions in the Graphics: WebGP... |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100765 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2021-22555 Linux Kernel Heap Out-of-Bounds Write Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2021-07-07 | 2026-10-13 |
| CVE-2026-84317 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-54641 OpenRemote is an open-source internet-of-things platform. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-86684 The Gitea push mirror API checked whether the repository owner, instead of the r... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-16516 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host... |
high | 7.4 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-83540 When password or public key authentication is used with the Windows port of wolf... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-87682 Multiple OS Command Injection vulnerabilities exist in the management interface... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87683 Multiple stack-based buffer overflow vulnerabilities exist in the REST API manag... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-104626 A user who can open a fork pull request can place workflow content with a shared... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-87665 A stack-based buffer overflow vulnerability exists in the Internet Key Exchange... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-104632 Gitea Actions blocks the jobs of workflow runs from first-time fork pull request... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104636 Gitea validated the initial remote URL for push mirrors, wiki remote checks, and... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-78025 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.5 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-75345 OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-75347 EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired poi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-32574 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-42702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.