October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,499
Critical
3,294
High
7,928
Medium
7,620
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-68613 n8n Improper Control of Dynamically-Managed Code Resources Vulnerability |
high | 8.8 | Listed | N8n / n8n | 2025-12-19 | 2026-10-13 |
| CVE-2026-84276 IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerabi... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-84275 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM fil... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-78388 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-39460 Usernames and passwords, including the default factory credentials, are stored i... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-19493 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-104078 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bun... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-104077 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability th... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-81774 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
high | 7.5 | — | — | 2026-09-02 | 2026-10-12 |
| CVE-2026-95594 Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-104084 SmarterMail before build 9777 contains a privilege escalation vulnerability wher... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling... |
high | 7.7 | — | — | 2026-10-07 | 2026-10-11 |
| CVE-2026-39453 Navigating to a certain URL on the switch’s web server causes the switch to rebo... |
high | 8.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-28745 Usernames and passwords, including the default credentials, are stored in the co... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-29797 No authentication is required when updating firmware or bootloader, making it ea... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-33367 SNMP can be used to perform administrative actions such as retrieving configurat... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105281 The internal data publisher on openPDC accepts network connections without authe... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-102262 Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-11 |
| CVE-2026-97076 Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocke... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94666 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96336 Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminato... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94064 Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Sho... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94065 Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio color... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105872 Deserialization of Untrusted Data vulnerability in mklacroix Product Configurato... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95608 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96329 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96553 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94158 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94159 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94170 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94415 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94641 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94661 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94060 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94061 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-19491 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-11888 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.