October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,504
Critical
3,294
High
7,930
Medium
7,623
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106455 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-13 |
| CVE-2026-106459 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-sentry | 2026-10-06 | 2026-10-13 |
| CVE-2026-106553 In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failur... |
high | 7.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-84316 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84318 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108807 A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d2... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108819 A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108799 A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d1... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-106555 In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can in... |
high | 7.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-105267 The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requi... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106500 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106503 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-107286 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-84360 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-83742 Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-106510 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-07 | 2026-10-13 |
| CVE-2026-106556 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage | 2026-10-07 | 2026-10-13 |
| CVE-2026-106558 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-07 | 2026-10-13 |
| CVE-2026-107212 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107214 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107215 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107216 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107217 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107219 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107223 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109573 phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escap... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109616 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109114 A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108963 databasement before 1.8.2 allows remote code execution because it runs certain c... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108956 A vulnerability was identified in code-projects Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108965 A vulnerability was determined in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108969 A security vulnerability has been detected in itsmeravitejak Online-Examination-... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108973 A vulnerability was determined in SourceCodester Contact Tracing System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-87679 When Brocade Fabric OS versions before 10.0.1 processes trunk configuration oper... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87680 A command injection vulnerability in the REST API management interface of Brocad... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-107295 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.6 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of exe... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104797 The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.