October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,499
Critical
3,294
High
7,928
Medium
7,620
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12109 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.2 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-16916 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-84278 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili... |
high | 7.2 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84245 IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84250 IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protec... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-16823 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-18740 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-19482 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-107639 ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument i... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-77214 libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in... |
high | 8.2 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-95116 An issue in libming through 0.4.8 allows a remote attacker to cause a denial of... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-106059 GitAhead through 2.7.1 on macOS contains a command injection vulnerability that... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-96671 Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94166 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94568 Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94664 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95599 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96461 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploitin... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-75346 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and mast... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104392 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey M... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94058 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94067 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62026 Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108160 AstronRPA through 1.1.6 contains a download of code without integrity check vuln... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105883 Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania all... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107384 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability |
high | 7.5 | Listed | ISC / BIND | 2015-07-29 | 2026-10-09 |
| CVE-2026-106121 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
high | 7.5 | — | Vmware / rabbitmq java client | 2026-10-06 | 2026-10-09 |
| CVE-2026-106122 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
high | 7.5 | — | Vmware / rabbitmq java client | 2026-10-06 | 2026-10-09 |
| CVE-2026-97289 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-10-09 |
| CVE-2026-95598 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95610 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96607 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94161 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94663 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94668 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94062 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-90983 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.