October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,504
Critical
3,294
High
7,930
Medium
7,623
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109673 Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109633 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-s... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109372 ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypa... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in t... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109334 SurrealDB before 3.3.0 does not check the caller-selected namespace or database... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109343 SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE stat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109225 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108921 A vulnerability was detected in KusalkaSilva Learning-Management-System up to ff... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108101 HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108106 Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108113 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerab... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108159 AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the des... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-70357 Gitea validates a repository migration hostname against its network allow and bl... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-87671 An out-of-bounds memory read vulnerability exists in the web management daemon o... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-79960 When a push was authenticated with a deploy key, Gitea recorded the repository o... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-89430 Gitea validated a push mirror's remote address against the `[migrations]` allow... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-76769 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78018 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78339 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78024 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.7 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78022 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78019 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-88930 The Social Web Suite WordPress plugin through 4.1.12 does not require its shared... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89195 The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89213 The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89214 The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89232 The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89234 The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a par... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89283 The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perfor... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89285 The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape seve... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89287 The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89297 The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize an... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89299 The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89302 The Post Voting System WordPress plugin through 1.0 does not properly sanitize a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-91829 The Subscribe to Comments WordPress plugin before 2.3.3 does not properly valida... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-96227 The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or valid... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-65180 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attac... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65101 NVIDIA AIStore for Linux contains a vulnerability in the distributed sort compon... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65103 NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-s... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65104 NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, wher... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.