October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,504
Critical
3,294
High
7,930
Medium
7,623
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65110 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an atta... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65141 NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65148 NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65161 NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an un... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65164 NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort ar... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65170 NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65172 NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnera... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-85234 A flaw was found in tftp-hpa. |
high | 7.5 | — | — | 2026-09-15 | 2026-10-13 |
| CVE-2026-84315 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109229 SGLang through 0.5.21 contains a denial of service vulnerability that disables P... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105464 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105465 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18166 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105052 IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75881 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-78673 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96261 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96262 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96263 IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96264 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96265 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96266 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90911 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90912 IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cau... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90921 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-102627 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75095 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75782 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker t... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-93891 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 7.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-93892 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103499 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM We... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108899 A flaw has been found in tobychui zoraxy up to 3.3.4. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-100824 Privilege escalation in the Places component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100825 Use-after-free in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-96399 A repository's external issue tracker regular expression containing alternating... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96404 When Gitea's web installer is reachable against a database that already contains... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96580 Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian pro... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-100830 Mitigation bypass in the DOM: Navigation component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100831 Use-after-free in the DOM: UI Events & Focus Handling component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.