October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,441
Critical
3,284
High
7,910
Medium
7,609
Low
738
Severity not reported
4,900
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107322 An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS database... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-19083 Authorization bypass through User-Controlled key vulnerability in AKIN Software... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-91844 Unrestricted upload of file with dangerous type vulnerability in İzometri IT Ser... |
high | 7.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-20362 A vulnerability in the web-based management interface of Cisco Finesse could all... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76453 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76456 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76457 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76458 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76463 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76467 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76468 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76469 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76470 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76472 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76484 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-13046 A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SA... |
high | 7.2 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-18145 A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service o... |
high | 7.2 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-90979 LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and ro... |
high | 7.3 | — | Apache / karaf | 2026-09-28 | 2026-10-08 |
| CVE-2026-91006 Apache Karaf's instance-management service (InstanceServiceImpl) builds the comm... |
high | 8.8 | — | Apache / karaf | 2026-09-28 | 2026-10-08 |
| CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts. |
high | 7.5 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-42617 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in... |
high | 7.1 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() i... |
high | 7.1 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-46572 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail()... |
high | 7.4 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-46570 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_dow... |
high | 8.1 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-93443 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93449 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93447 IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the... |
high | 7.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93445 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-88962 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-82627 The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builde... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-17196 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106611 Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminato... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105833 EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability... |
high | 7.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2023-3079 Google Chromium V8 Type Confusion Vulnerability |
high | 8.8 | Listed | Google / Chromium V8 | 2023-06-05 | 2026-10-08 |
| CVE-2026-106271 Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106274 Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 15... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-103371 Insertion of Sensitive Information into Log File in Apache Geode Web Management. |
high | 7.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-71183 An authorization vulnerability in Apache DolphinScheduler allows authenticated u... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-71895 An authorization vulnerability in Apache DolphinScheduler allows authenticated n... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.