October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,441
Critical
3,284
High
7,910
Medium
7,609
Low
738
Severity not reported
4,900
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62142 Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allow... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66479 Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComp... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-39723 Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-39790 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-106196 Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.80... |
high | 7.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106387 Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.3... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-67411 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67412 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-100504 Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnera... |
high | 7.0 | — | Nsa / ghidra | 2026-09-26 | 2026-10-08 |
| CVE-2026-93452 snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.... |
high | 7.5 | — | — | 2026-09-18 | 2026-10-08 |
| CVE-2026-90559 snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Sn... |
high | 7.5 | — | — | 2026-09-12 | 2026-10-08 |
| CVE-2026-86435 commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerab... |
high | 7.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2026-87807 siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerabili... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2026-88879 Traefik is an HTTP reverse proxy and load balancer. |
high | 8.2 | — | Traefik / traefik | 2026-09-10 | 2026-10-08 |
| CVE-2026-86429 The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and... |
high | 7.5 | — | Thephpleague / commonmark | 2026-09-07 | 2026-10-08 |
| CVE-2026-86430 league/commonmark versions before 2.9.1 contain multiple denial of service vulne... |
high | 7.5 | — | Thephpleague / commonmark | 2026-09-07 | 2026-10-08 |
| CVE-2026-86431 league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contai... |
high | 7.2 | — | Thephpleague / commonmark | 2026-09-07 | 2026-10-08 |
| CVE-2026-86433 commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerab... |
high | 7.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2026-86434 league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a den... |
high | 7.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2026-86428 commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnera... |
high | 7.5 | — | Thephpleague / commonmark | 2026-09-07 | 2026-10-08 |
| CVE-2026-86201 PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginP... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2026-84189 LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit mes... |
high | 8.1 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-84190 LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in... |
high | 7.2 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-84192 LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in l... |
high | 7.1 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-84199 Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerabilit... |
high | 7.7 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-106198 Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.2 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106188 Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39... |
high | 7.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-100846 MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in... |
high | 8.8 | — | Project-monai / monai | 2026-09-27 | 2026-10-08 |
| CVE-2026-100856 AzuraCast before 0.23.6 contains a code injection vulnerability in the remote re... |
high | 8.8 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100857 AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWri... |
high | 8.0 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100686 Budibase versions before 3.45.0 fail to validate per-app authorization in the PO... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100838 Contrast is a confidential-computing runtime for Kubernetes. |
high | 8.1 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100839 Contrast is a confidential-computing runtime for Kubernetes. |
high | 8.4 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100645 SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnera... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100680 Budibase versions before 3.45.0 fail to disable external JSON reference resoluti... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100682 Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100683 Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename D... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100684 Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the O... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100685 Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint... |
high | 7.7 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100644 SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query e... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.