October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,458
Critical
3,286
High
7,915
Medium
7,613
Low
739
Severity not reported
4,905
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107781 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107707 Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerabi... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107720 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-83465 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
high | 8.2 | — | Oracle / mobile application server | 2026-09-15 | 2026-10-09 |
| CVE-2026-83464 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
high | 8.1 | — | Oracle / mobile application server | 2026-09-15 | 2026-10-09 |
| CVE-2026-83463 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
high | 7.5 | — | Oracle / mobile application server | 2026-09-15 | 2026-10-09 |
| CVE-2026-20531 In apu, there is a possible memory corruption due to use after free. |
high | 8.4 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-83461 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
high | 8.2 | — | Oracle / mobile application server | 2026-09-15 | 2026-10-09 |
| CVE-2016-3081 Apache Struts Command Injection Vulnerability |
high | 8.1 | Listed | Apache / Struts | 2016-04-26 | 2026-10-09 |
| CVE-2026-19498 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability |
high | 7.8 | Listed | Zammad GmbH / Zammad | 2026-09-30 | 2026-10-09 |
| CVE-2026-46569 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail()... |
high | 7.7 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-09 |
| CVE-2026-11318 Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-101024 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal v... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-57559 Memory corruption while processing service requests. |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57555 Memory Corruption when executing system service routines due to improper handlin... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57554 Memory Corruption when asynchronous threads access shared performance counter da... |
high | 7.8 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57546 Transient DOS when processing a continuous receive command with a zero-sized glo... |
high | 7.5 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57545 Memory corruption when processing draw objects of incorrect type during graphics... |
high | 7.8 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57537 Memory Corruption when accessing and modifying geographic mapping data concurren... |
high | 7.8 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25302 Cryptographic Issue when processing non-ELF partitions, authentication and signa... |
high | 7.1 | — | Qualcomm / xrv9209 firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25291 Memory corruption when performing concurrent operations on shared memory page li... |
high | 7.8 | — | Qualcomm / sar1165p firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25267 Memory corruption when non-secure loader rewrites page tables before secure memo... |
high | 7.8 | — | Qualcomm / qca6698au firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-96890 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 8.8 | — | Github / enterprise server | 2026-10-06 | 2026-10-09 |
| CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalat... |
high | 7.2 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can... |
high | 7.1 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-104048 A flaw was found in SSSD. |
high | 8.1 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-09 |
| CVE-2026-107385 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107318 @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HT... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107303 JHipster is a development platform to quickly generate, develop, and deploy mode... |
high | 7.6 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against th... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalo... |
high | 8.0 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-75962 The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs,... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-93678 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 7.6 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-106440 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106221 Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106038 Mooncake Store master through 0.3.13.post1 contains a missing authentication vul... |
high | 8.2 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106199 Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8... |
high | 8.2 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-105920 A vulnerability was determined in Kusalkasilva Learning-Management-System up to... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST... |
high | 7.4 | — | — | 2026-10-06 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.